Collect Trellix IPS logs

Supported in:

Google secops SIEM

This document explains how to ingest Trellix IPS logs to Google Security Operations using the Bindplane agent.

Trellix IPS (formerly McAfee IPS/Network Security Platform) is a network intrusion prevention system that provides real-time detection and prevention of network-based threats, including exploits, malware, and denial-of-service attacks. It uses signature-based and behavioral analysis to inspect network traffic inline, automatically blocking malicious activity while allowing legitimate traffic to pass through.

Before you begin

Make sure you have the following prerequisites:

A Google SecOps instance
A Windows 2016 or later or Linux host with systemd
If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
Privileged access to the Trellix IPS Manager (Network Security Manager) console

Get Google SecOps Ingestion Authentication File

Sign in to the Google SecOps console.
Go to SIEM Settings > Collection Agents.
Download the Ingestion Authentication File.
Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

Sign in to the Google SecOps console.
Go to SIEM Settings > Profile.
Copy and save the Customer ID from the Organization Details section.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows Installation

Open the Command Prompt or PowerShell as an administrator.

Run the following command:

msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

Linux Installation

Open a terminal with root or sudo privileges.

Run the following command:

sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

Additional Installation Resources

For additional installation options, consult this installation guide.

Configure the Bindplane agent to ingest Syslog and send to Google SecOps

Access the Configuration File:
- Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
- Open the file using a text editor (for example, nano, vi, or Notepad).

Edit the config.yaml file as follows:

receivers:
  tcplog:
    # Replace the port and IP address as required
    listen_address: "0.0.0.0:514"

exporters:
  chronicle/chronicle_w_labels:
    compression: gzip
    # Adjust the path to the credentials file you downloaded in Step 1
    creds_file_path: '/path/to/ingestion-authentication-file.json'
    # Replace with your actual customer ID from Step 2
    customer_id: YOUR_CUSTOMER_ID_HERE
    endpoint: malachiteingestion-pa.googleapis.com
    # Add optional ingestion labels for better organization
    log_type: 'MCAFEE_IPS'
    raw_log_field: body
    ingestion_labels:

service:
  pipelines:
    logs/source0__chronicle_w_labels-0:
      receivers:
        - tcplog
      exporters:
        - chronicle/chronicle_w_labels

Replace the port and IP address as required in your infrastructure.
Replace YOUR_CUSTOMER_ID_HERE with the actual Customer ID.
Update /path/to/ingestion-authentication-file.json to the file path where the authentication file was saved in Step 1.
Update the endpoint value to match your tenant's region.

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Linux, run the following command:
```
sudo systemctl restart observiq-otel-collector
```
To restart the Bindplane agent in Windows, you can either use the Services console or enter the following command:
```
net stop observiq-otel-collector && net start observiq-otel-collector
```

Configure Trellix IPS syslog forwarding

Sign in to the Trellix Network Security Manager (formerly McAfee Network Security Manager) console.
Go to Manager > Setup > Notification > Syslog.
Click Enable to enable syslog notification.
Click Add to add a new syslog server.
Provide the following configuration details:
- Syslog Server IP Address: Enter the IP address of the Bindplane agent host (for example, 192.168.1.100).
- Port: Enter 514 (or the port configured in Bindplane).
- Protocol: Select TCP.
- Facility: Select Local0 (or as required by your environment).
In the Notification section, select the alert severity levels to forward:
- Informational
- Low
- Medium
- High
- Critical
In the Message Format section, select the syslog message format:
- Select Standard Syslog or CEF (Common Event Format) based on your requirements.
Click Save to save the syslog server configuration.
Go to Manager > Setup > Notification > Forward Alerts.
Enable alert forwarding and select the syslog server configured in the previous steps.
Select the alert types to forward:
- IPS Alerts
- Fault Alerts
- Audit Alerts
Click Save to apply the configuration.

Note: For more information, see the Trellix Network Security Manager documentation.

UDM mapping table

Log Field	UDM Mapping	Logic
`_intermediary`	`intermediary`	Merged
`_event_type`	`metadata.event_type`	Directly mapped
`_network`	`network`	Renamed/mapped
`_principal`	`principal`	Renamed/mapped
`_security_result`	`security_result`	Merged
`_target`	`target`	Renamed/mapped
N/A	`intermediary`	Constant: `_intermediary`
N/A	`metadata.product_name`	Constant: `MCafee IPS`
N/A	`metadata.vendor_name`	Constant: `MCafee`
N/A	`security_result`	Constant: `_security_result`

Need more help? Get answers from Community members and Google SecOps professionals.