Rapid7 Plugin for Log Shipper

This document explains how to configure your Rapid7 v3.1.1 plugin with the Log Shipper module of the Netskope Cloud Exchange platform. This plugin supports ingestion of Alerts (Anomaly, Legal Hold, Compromised Credential, Policy, Malsite, Malware, DLP, Security Assessment, Quarantine, Remediation, UBA, Watchlist, CTEP), Events (Page, Application, Audit, Infrastructure, Network, Incident, Endpoint), Web Transaction data, and CE logs (Debug, Information, Error, Warning) to Rapid7 in JSON and CEF format.

Prerequisites

To complete this configuration, you need:

Rapid7 Plugin Support

The Rapid7 plugin is used to ingest all the Alert, Events, WebTx (via Netskope LogStreaming), and CE Logs in JSON and CEF format to the specified Rapid7 server.

API Details

The plugin uses a logging 3rd-party library to push the data to the Syslog collector.

Library: logging

This module defines functions and classes which implement a flexible event-logging system for applications and libraries.

The key benefit of having the logging API provided by a standard library module is that all Python modules can participate in logging, so your application log can include your own messages integrated with messages from third-party modules.

Refer to the official documentation for more information on the logging library:https://docs.python.org/3/library/logging.html.

List of Methods Used

Method: logging.getLogger(name=None)

Return a logger with the specified name or, if the name is None, return a logger which is the root logger of the hierarchy

All calls to this function with a given name return the same logger instance. This means that logger instances never need to be passed between different parts of an application.

Method: setLevel(level)

Sets the threshold for this logger to level. Logging messages that are less severe than the level will be ignored; logging messages that have a severity level or higher will be emitted by whichever handler or handlers service this logger, unless a handler’s level has been set to a higher severity level than the level.

Method: handlers

The list of handlers is directly attached to this logger instance.

Note that this attribute should be treated as read-only; it is normally changed via the addHandler() and removeHandler() methods, which use locks to ensure thread-safe operation.

• Method: addHandler(hdlr): Adds the specified handler hdlr to this logger.
• Method: removeHandler(hdlr): Removes the specified handler hdlr from this logger.

Performance Matrix

Description	Specification
Stack details	Size: Large RAM: 32 GB CPU: 16 Cores
Alerts/Events ingested to SIEM	~200K EPM

Workflow

Click play to watch a video.

1. Go to Log Shipper > Log Delivery and click Add Log Delivery Configuration.
2. For alerts and events, select the Source plugin (CLS Netskope), Destination plugin (CLS Rapid7), and a business rule.
3. For WebTx, select the Source plugin (AWS Netskope Log Streaming or Azure Netskope Log Streaming), and Destination plugin (CLS Rapid7).
4. For Logs sharing, select the Source plugin (CLS Syslog for CE), and Destination plugin (CLS Rapid7).
5. Click Save.

After the Log Delivery configuation is added, the data will start to be pulled from the Netskope tenant, transformed, and ingested into the Rapid7 platform.