Before deployment, please:
- examiner les architectures des clients de streaming d'événements et définir l'architecture cible.
- review Event Streaming Client Requirements
Le déploiement d'Event Streaming Client nécessite les étapes suivantes :
- Configuration de l'accès à l'API
- Client installation for each Event Streaming Client to deploy.
- Une configuration de format pour définir les données qui seront transmises au SIEM
- Une configuration de destination pour définir les cibles SIEM pour chaque client et le format actif
- La configuration du flux de journaux permet alors d'activer la destination du client de flux d'événements.
Accès à l'API
La création d'un rôle et d'un jeton est abordée dans la section Accès à l'API du client de streaming d'événements.
Installation du client
L'installation du client se fait en 2 étapes :
- Déclaration d'un client New via l'API et génération d'un jeton
- Déploiement du client sur l'hôte périphérique
Configuration du client
Après une authentification réussie à l'API Swagger de Netskope, la configuration de l'Event Streaming Client est disponible avec les points d'extrémité /api/v2/streamingclient/clients :
- Créez un client New avec la méthode POST en utilisant le bouton "Try it out" :
- Il est possible de vérifier les clients créés avec la méthode GET
Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.
Téléchargez le programme d'installation
De Swagger
De Linux
Commandement :
curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ
Exemple :
root@lab-esc1:~# curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 10796 100 10796 0 0 57922 0 --:--:-- --:--:-- --:--:-- 58994
root@lab-esc1:~# tar -zxvf NS_StreamingClient_Installer.tar.gz
netskope_event_streamingclient_installer.py
README.md
Déploiement de l'instance
- Se connecter au serveur Linux
- Assurez-vous que Python3 et Docker sont installés.
- Récupérez le programme d'installation de l'étape précédente
- Vérifiez la configuration dédiée à votre système
Pour utiliser Docker avec un proxy HTTP, reportez-vous à Configuration du proxy pour Docker.
Pour utiliser RHEL avec Podman, reportez-vous à Red Hat et la configuration de Podman. - Exécutez le script d'installation
python3 netskope_event_streamingclient_installer.py
6. Select install option et répondez à toutes les questions posées :
- emplacement des fichiers, par défaut
/root/ns Enter the client keyest le jeton généré avec l’API /api/v2/streamingclient/clients/{id}/token- Jour et heure de la semaine pour la mise à jour automatique
- Définissez éventuellement le proxy HTTP
Exemple
root@lab-esc2:~# python3 netskope_event_streamingclient_installer.py NETSKOPE LOG STREAM CLIENT INSTALLER I.2025.11.1 Please specify an option: 1. install - Set up and configure the container 2. reinstall - Remove and recreate the container 3. uninstall - Remove the container and cleanup Enter option (install/reinstall/uninstall): 1 INSTALLATION >>> Checking if operating system is supported... SUCCESS: Check for operating system passed. >>> Checking if hardware architecture is supported... SUCCESS: Check for Architecture passed. >>> Checking if Docker is installed and running... SUCCESS: Docker is installed. SUCCESS: Docker daemon is running. SUCCESS: All the systems checks passed. Configuring container ... Enter the directory path to store the installation files and logs [default: /root/ns]: Enter the client key : eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhb Client key: eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhbWluZ2NsaWVudC1h Please set up a weekly schedule for automatic Docker image updates. Do you want to use the default schedule (Thursday at 23:00)? [y/n]: y >>> Configuring proxy settings... Do you need proxy setup for Streaming Client? [y/n] (default: n): y INFO: Configuring proxy for containers --- Streaming Client Container Proxy Configuration --- This proxy will be used by the running containers for their operations. HTTPS Proxy URL (e.g., http://proxy.company.com:8080 or https://proxy.company.com:8080): http://163.xxx.xxx.80:80 INFO: Container HTTPS proxy configured: http://163.xxx.xxx.80:80 >>> Setting up and starting the container... INFO: Using existing installation directory: /root/ns >>> Pulling Docker image: netskope/nsstreamingclient:stable The process might take a moment... stable: Pulling from netskope/nsstreamingclient 645635fbf4d2: Pull complete c9debdf8207a: Pull complete 94e09fa58eb4: Pull complete c5b5b574d9eb: Pull complete 9a47257481ca: Pull complete 2f5e1dfb2cd4: Pull complete f9514487b3cf: Pull complete 78e884c4c39d: Pull complete 2aac2ff272d9: Pull complete da51ee03c947: Pull complete a84060cbac16: Pull complete 477d64974173: Pull complete 9a1325d79269: Pull complete a71a358f9aef: Pull complete 44d06538ce68: Pull complete 14477cceda61: Pull complete 8fb98c22d537: Pull complete db9fdfbf3f52: Pull complete 4958661942a9: Pull complete 1540d139dc0c: Pull complete b1f4e241f375: Pull complete 94bfc05d13f2: Pull complete 7f247b6c83f6: Pull complete a8cda5c427fe: Pull complete 28eedd26b6c7: Pull complete b9ce487eef38: Pull complete 0f452909bfe0: Pull complete bcdfc9f5c9e1: Pull complete 082b67164622: Pull complete 336355755be8: Pull complete 9e505fd59acf: Pull complete c4a41b87cf93: Pull complete de55d536641a: Pull complete 11aacba49461: Pull complete Digest: sha256:ea143d8520 Status: Downloaded newer image for netskope/nsstreamingclient:stable docker.io/netskope/nsstreamingclient:stable SUCCESS: Docker image pulled successfully! INFO: Configuring container volumes and environment variables... INFO: Initialized installer information log file. INFO: Container configuration file created successfully INFO: Creating proxy configuration file... INFO: Creating proxy configuration file... SUCCESS: Proxy configuration saved to proxy.env INFO: Starting container... INFO: Adding HTTPS proxy to container: http://163.xxx.xxx.80:80 e9fe4c230e5cc191 SUCCESS: Container 'nsstreamingclient' started successfully! Container files and Log files will be stored in: /root/ns >>> Setting up watcher container to monitor the main container... INFO: Pulling watcher image... stable: Pulling from netskope/nswatcher 21b919804656: Pull complete 891cc33da41a: Pull complete e6eb3a86a632: Pull complete edeb9247ddd4: Pull complete f988b2dd9cbf: Pull complete ef090e4f8d13: Pull complete b935cef6a087: Pull complete 06e748922bc3: Pull complete 49b990c12c1f: Pull complete fa2956f00aa5: Pull complete 3df31e584803: Pull complete 4164121f60f1: Pull complete f99197fd9601: Pull complete 1737cff1e8c9: Pull complete 60957cee4d80: Pull complete 964929934f06: Pull complete 5d335edf6f34: Pull complete 26ddf93d0751: Pull complete 141fda38c9b5: Pull complete 093dc20aa13e: Pull complete Digest: sha256:8eb9a2 Status: Downloaded newer image for netskope/nswatcher:stable docker.io/netskope/nswatcher:stable INFO: Starting watcher container... INFO: Adding container HTTPS proxy to watcher container: http://163.xxx.xxx.80:80 f519daf55cax SUCCESS: Watcher container started successfully! >>> Waiting for configuration to complete (max 60 seconds)... PROGRESS: Client is not enabled INFO: Installation successful. Waiting for configuration download... INFO: Monitoring for 15s ... Successfully downloaded stream configuration INSTALLATION COMPLETE root@lab-esc2:~#
Validation de l'instance
Pour vérifier que l'instance fonctionne, nous vous recommandons de vérifier les éléments suivants
- L'instance est en cours d'exécution
root@lab-esc1:~# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ac518e00355f netskope/nsstreamingclient:stable "./start.sh s h ' ' …" 2 minutes ago Up 2 minutes nsstreamingclient bf534b netskope/nswatcher:stable "bash start.sh" 2 days ago Up 2 days ns-watcher root@lab-esc1:~#
- Journaux Docker
root@lab-esc1:~# docker logs nsstreamingclient
2025/09/04 13:16:53 Primary config missing (/opt/ns/cfg/container_config). Trying fallback (/app/container_config)...
Install Log: Starting static configuration and token loading process.
Install Log: Configuration variables loaded successfully.
2025/09/04 13:16:53 Start decrypting container and connection keys from the env app.env file
2025/09/04 13:16:53 Starting metrics logging
{"level":"info","timestamp":"2025-09-04T13:16:53.112Z","caller":"log/log.go:86","msg":"Start collecting the system metrics"}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Connected with syslog."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Syslog details verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Configuration verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"Successfully downloaded stream configuration"}
{"level":"info","timestamp":"2025-09-04T13:16:53.202Z","caller":"log/log.go:86","msg":"starting stream config watcher"}
{"level":"info","timestamp":"2025-09-04T13:16:53.209Z","caller":"log/log.go:86","msg":"Creating connections for log streamer","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c","conNum":8}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.582Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.583Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.676Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"starting stream...."}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log streamer","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
- Les fichiers journaux se trouvent également dans le dossier
container_files/logsà l'intérieur de l'emplacement sélectionné lors de l'installation.
La description des messages du journal est fournie dans la section "Dépannage" au bas du guide.
Format configuration
Event Streaming Client prend en charge les formats suivants :
- CEF
- ELFF
- JSON
Si JSON est le plus universel, c'est aussi le plus lent en raison de sa structure. Le CEF est généralement un bon compromis entre soutien large et performance. ELFF reste la solution la plus performante, mais elle n'est pas prise en charge de manière native par tous les SIEM.
- Utilisez POST pour créer un premier format
- PATCH peut être utilisé pour ajouter ou modifier des options après la création.
- The Format ID is required to configure Destination object
- Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.
Example with Default JSON Format:
{
"name": "Default JSON",
"type": "JSON",
"definition": {
"remove_empty_fields": true,
"customize": false
}
}
Configuration de la destination
L'objet Destination est utilisé pour définir l'adresse SIEM de chaque client.
Pour obtenir une configuration pleinement opérationnelle, les informations suivantes sont nécessaires :
- L'ID du client trouvé dans l'objet Client (l'objet Client doit être activé).
- L'ID du format trouvé dans l'objet Format
- L'IP/le domaine du SIEM, le port et le protocole à utiliser.
- Créer une destination avec l'API POST
- PATCH peut être utilisé pour ajouter ou modifier des options après la création.
- Assurez-vous que la destination a
- Une cible avec un identifiant de client fonctionnel
- La cible est activée
- L'objet Destination est activé
- L'objet Client est activé
- Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.
Example:
{
"name": "Sample destination",
"enabled": true,
"type": "syslog_tcp",
"format": "019914ed",
"targets":
[
{
"client": "0198eb4f",
"ip": "lab-splunk4.info",
"port": 5151,
"enabled": true
}
]
}
Configuration de la diffusion du journal
Un seul flux de journaux peut être configuré pour les événements de transaction.
Il n'y a actuellement aucune validation de l'ID de destination, assurez-vous que l'ID de destination est correct.
Utilisez l'API POST /api/v2/events/logstreaming/stream pour enregistrer la destination.
{
"streamType": "transaction",
"name": "Transaction Stream",
"provider": "streamingclient",
"credential": {
"streamingclient": {
"client-destination": "REPLACE WITH YOUR DESTINATION ID"
}
},
"compressionType": "zstd"
}
- Pour modifier une configuration existante, utilisez l'API PUT /api/v2/events/logstreaming/stream/{streamId} API
- Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.