Collect Ubika WAF logs

Supported in:

Google secops SIEM

This docuemnt explains how to ingest Ubika WAF logs to Google Security Operations using the Bindplane agent.

Ubika WAF (formerly DenyAll) is a web application firewall that provides HTTP traffic inspection, bot protection, and API security for on-premise web applications and services.

Before you begin

Make sure you have the following prerequisites:

A Google SecOps instance
Windows Server 2016 or later, or Linux host with systemd
Network connectivity between the Bindplane agent and the Ubika WAF appliance
If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
Privileged access to the Ubika WAF management console with administrator permissions

Get Google SecOps ingestion authentication file

Sign in to the Google SecOps console.
Go to SIEM Settings > Collection Agents.
Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

Note: This JSON file contains credentials for authenticating the Bindplane agent to Google SecOps.

Get Google SecOps customer ID

Sign in to the Google SecOps console.
Go to SIEM Settings > Profile.
Copy and save the Customer ID from the Organization Details section.

Note: The customer ID is required for configuring the Bindplane agent exporter.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

Open Command Prompt or PowerShell as an administrator.

Run the following command:

msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

Wait for the installation to complete.
Verify the installation by running:
```
sc query observiq-otel-collector
```
The service should show as RUNNING.

Linux installation

Open a terminal with root or sudo privileges.

Run the following command:

sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

Wait for the installation to complete.
Verify the installation by running:
```
sudo systemctl status observiq-otel-collector
```
The service should show as active (running).

Additional installation resources

For additional installation options and troubleshooting, see Bindplane agent installation guide.

Configure Bindplane agent to ingest syslog and send to Google SecOps

Locate the configuration file

Linux:

sudo nano /etc/bindplane-agent/config.yaml

Windows:

notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Edit the configuration file

Replace the entire contents of config.yaml with the following configuration:

receivers:
    tcplog:
        listen_address: "0.0.0.0:514"

exporters:
    chronicle/ubika_waf:
        compression: gzip
        creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
        customer_id: '<customer_id>'
        endpoint: malachiteingestion-pa.googleapis.com
        log_type: UBIKA_WAF
        raw_log_field: body

service:
    pipelines:
        logs/ubika_waf_to_chronicle:
            receivers:
                - tcplog
            exporters:
                - chronicle/ubika_waf

Configuration parameters

Replace the following placeholders:

Receiver configuration:
- listen_address: IP address and port to listen on:
  - 0.0.0.0 to listen on all interfaces (recommended)
  - Port 514 is the standard syslog port (requires root on Linux; use 1514 for non-root)
Exporter configuration:
- creds_file_path: Full path to ingestion authentication file:
  - Linux: /etc/bindplane-agent/ingestion-auth.json
  - Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
- customer_id: Customer ID copied from the Google SecOps console
- endpoint: Regional endpoint URL:
  - US: malachiteingestion-pa.googleapis.com
  - Europe: europe-malachiteingestion-pa.googleapis.com
  - Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
  - See Regional Endpoints for complete list

Save the configuration file

After editing, save the file:
- Linux: Press Ctrl+O, then Enter, then Ctrl+X
- Windows: Click File > Save

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Linux, run the following command:

sudo systemctl restart observiq-otel-collector

Verify the service is running:

sudo systemctl status observiq-otel-collector

Check logs for errors:

sudo journalctl -u observiq-otel-collector -f

To restart the Bindplane agent in Windows, choose one of the following options:
- Command Prompt or PowerShell as administrator:
```
net stop observiq-otel-collector && net start observiq-otel-collector
```
- Services console:
  1. Press Win+R, type services.msc, and press Enter.
  2. Locate observIQ OpenTelemetry Collector.
  3. Right-click and select Restart.
  4. Verify the service is running:
```
sc query observiq-otel-collector
```
  5. Check logs for errors:
```
type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
```

Configure Ubika WAF syslog forwarding

Sign in to the Ubika WAF management console.
Go to Management > Logs > Syslog Configuration.
Click Add to create a new syslog destination.
Provide the following configuration details:
- Syslog Server: Enter the IP address of the Bindplane agent host.
- Port: Enter 514.
- Protocol: Select TCP.
- Format: Select the default syslog format.
Select the log types to forward:
- Security alert logs
- Access logs
- Audit logs
- System event logs
Click Save to apply the configuration.
Verify that logs are being sent by checking the Bindplane agent logs.

UDM mapping table

Log Field	UDM Mapping	Logic
sqliFingerprint_label, eaNewRulesWarningMode_label, eaTotalScore_label, matching_part_key_label, matching_part_key_match_label, partKeyOperator_label, partKeyPattern_label, partValue_label, partValueMatch_label, partValueOperator_label, partValuePatternName_label, partValuePatternUid_label, partValuePatternVersion_label, scoringlistRuleId_label, scoringlistRuleWeight_label, ConfigurationUid_list, Matched_Rule_ID_list	additional.fields	Merged with labels from eventt.tokens.sqliFingerprint, eventt.tokens.eaNewRulesWarningMode, eventt.tokens.eaTotalScore, matchingPart.partKey, matchingPart.partKeyMatch, matchingPart.partKeyOperator, matchingPart.partKeyPattern, matchingPart.partValue, matchingPart.partValueMatch, matchingPart.partValueOperator, matchingPart.partValuePatternName, matchingPart.partValuePatternUid, matchingPart.partValuePatternVersion, matchingPart.scoringlistRuleId, matchingPart.scoringlistRuleWeight, eventt.tokens.securityExceptionConfigurationUids, eventt.tokens.securityExceptionMatchedRuleUids
context.applianceName	intermediary.application	Value copied directly from context.applianceName
inter_ip	intermediary.asset.ip	Merged from inter_ip (derived from context.backendHost if IP)
context.backendHost	intermediary.hostname	Set from context.backendHost if not an IP
inter_ip	intermediary.ip	Set from inter_ip (derived from context.backendHost if IP)
context.applianceUid	intermediary.file.sha1	Value copied directly from context.applianceUid
has_principal, has_target, has_network, has_principal_user, has_target_resource	metadata.event_type	Set to "NETWORK_HTTP" if has_principal, has_target, has_network; "USER_COMMUNICATION" if has_principal, has_principal_user; "STATUS_UPDATE" if has_principal; "USER_RESOURCE_ACCESS" if has_target_resource; else "GENERIC_EVENT"
tokens.eventType, type, eventt.tokens.eventType, eventData.tokens.eventType	metadata.product_event_type	Value from tokens.eventType if set, else type, else eventt.tokens.eventType, else eventData.tokens.eventType
eventUid, logAlertUid, eventt.eventUid, tempData.uid, eventData.eventUid	metadata.product_log_id	Value from eventUid if set, else logAlertUid, else eventt.eventUid, else tempData.uid, else eventData.eventUid
	metadata.product_name	Set to "UBIKA_WAF"
	metadata.vendor_name	Set to "UBIKA_WAF"
uri_protocol, request.protocol	network.application_protocol	Set to "HTTP" if uri_protocol == "HTTP" or request.protocol == "HTTP"
uri_method, request.method	network.http.method	Value from uri_method if set, else request.method
uri_path, request.path, header.value	network.http.referral_url	Value from uri_path if set, else request.path, else header.value if Referer
uri_res_code	network.http.response_code	Converted to integer from uri_res_code
user_agent, header.value	network.http.user_agent	Value from user_agent if set, else header.value if User-Agent
target_hostname, header.value, request.hostname, tempData.request.hostname	principal.asset.hostname	Value from target_hostname if set, else header.value if Host and not IP, else request.hostname if not IP, else tempData.request.hostname
src_ip, request.ipSrc, source_ip	principal.asset.ip	Merged from src_ip, request.ipSrc, source_ip (from header.value if Host and IP)
target_hostname, header.value, request.hostname, tempData.request.hostname	principal.hostname	Value from target_hostname if set, else header.value if Host and not IP, else request.hostname if not IP, else tempData.request.hostname
src_ip, request.ipSrc, source_ip	principal.ip	Merged from src_ip, request.ipSrc, source_ip (from header.value if Host and IP)
src_port, header.value	principal.port	Value from src_port if set, else header.value if X-Forwarded-Port, converted to integer
request.requestUid, tempData.request.requestUid	principal.user.userid	Value from request.requestUid if set, else tempData.request.requestUid
cookie_label, header_label, reverseProxyName_label, reverseProxyUid_label, tunnelName_label, tunnelUid_label, workflowName_label, workflowUid_label	security_result.about.resource.attribute.labels	Merged with labels from request.cookies, request.headers, context.reverseProxyName, context.reverseProxyUid, context.tunnelName, context.tunnelUid, context.workflowName, context.workflowUid
vlan_label, riskLevel_label, riskLevelOWASP_label, logAlertUid_label, engine_name_label, resolveType_label, part_label, cwe_label, icxPolicyName_label, icxPolicyUid_label, icxRuleName_label, icxRuleUid_label, eaPolicyName_label, eaPolicyUid_label, eaRuleId_label, eaStaticPolicyUid_label, tag_label, geoipCode_label, geoipName_label, appliance_id_label, backendHost_label, reverseProxyName_label, reverseProxyUid_label, tunnelName_label, tunnelUid_label, workflowName_label, workflowUid_label, reason_label, timestampImport_label, matching_cwe_label, matching_part_label, match_riskLevel_label, match_riskLevelOWASP_label, partValue_label, partValueMatch_label	security_result.detection_fields	Merged with labels from vlan, tokens.riskLevel, tokens.riskLevelOWASP, logAlertUid, eventt.tokens.engineName, eventt.tokens.resolveType, eventt.tokens.part, eventt.tokens.cwe, eventt.tokens.icxPolicyName, eventt.tokens.icxPolicyUid, eventt.tokens.icxRuleName, eventt.tokens.icxRuleUid, eventt.tokens.eaPolicyName, eventt.tokens.eaPolicyUid, eventt.tokens.eaRuleId, eventt.tokens.eaStaticPolicyUid, tempData.context.tags, tempData.context.geoipCode, tempData.context.geoipName, tempData.context.applianceUid, tempData.context.backendHost, tempData.context.reverseProxyName, tempData.context.reverseProxyUid, tempData.context.tunnelName, tempData.context.tunnelUid, tempData.context.workflowName, tempData.context.workflowUid, eventt.tokens.reason, tempData.timestampImport, matchingPart.cwe, matchingPart.part, matchingPart.riskLevel, matchingPart.riskLevelOWASP, matchingPart.partValue, matchingPart.partValueMatch
desc, tokens.customMessage, eventt.tokens.customMessage, eventData.tokens.customMessage	security_result.description	Value from desc if set, else tokens.customMessage, else eventt.tokens.customMessage, else eventData.tokens.customMessage
tokens.severity, eventt.tokens.severity, severity_level	security_result.severity	Set to INFORMATIONAL if severity in 1-3; CRITICAL if severity in 4-5; MEDIUM if severity in 6-7; else UNKNOWN_SEVERITY
tokens.reason, eventt.tokens.reason, eventData.tokens.reason	security_result.summary	Value from tokens.reason if set, else eventt.tokens.reason, else eventData.tokens.reason
tokens.attackFamily, eventt.tokens.attackFamily, eventData.tokens.attackFamily	security_result.threat_name	Value from tokens.attackFamily if set, else eventt.tokens.attackFamily, else eventData.tokens.attackFamily
source_ip	src.ip	Set from source_ip (from header.value if Host and IP)
target_hostname	target.asset.hostname	Value copied directly from target_hostname
request.ipDst, target_ip_label	target.asset.ip	Merged from request.ipDst, target_ip_label
tempData.request.path	target.file.full_path	Value copied directly from tempData.request.path
target_hostname, header.value	target.hostname	Value from target_hostname if set, else header.value if Host
request.ipDst, target_ip_label	target.ip	Merged from request.ipDst, target_ip_label
target_port, request.portDst, context.backendPort, tempData.request.portDst, tempData.context.backendPort	target.port	Value from target_port if set, else request.portDst, else context.backendPort, else tempData.request.portDst, else tempData.context.backendPort, converted to integer
engineUid_label, engine_name_label, cwe_label, resolveType_label, part_label, matching_cwe_label, matching_part_label, match_riskLevel_label, match_riskLevelOWASP_label, matching_part_key_label, matching_part_key_match_label, partKeyOperator_label, partKeyPattern_label, partValue_label, partValueMatch_label, partValueOperator_label, partValuePatternName_label, partValuePatternUid_label, partValuePatternVersion_label, scoringlistRuleId_label, scoringlistRuleWeight_label	target.resource.attribute.labels	Merged with labels from tokens.engineUid, tokens.engineName, tokens.cwe, tokens.resolveType, tokens.part, eventData.tokens.engineUid, eventData.tokens.engineName, eventData.tokens.cwe, eventData.tokens.resolveType, eventData.tokens.part, matchingPart.cwe, matchingPart.part, matchingPart.riskLevel, matchingPart.riskLevelOWASP, matchingPart.partKey, matchingPart.partKeyMatch, matchingPart.partKeyOperator, matchingPart.partKeyPattern, matchingPart.partValue, matchingPart.partValueMatch, matchingPart.partValueOperator, matchingPart.partValuePatternName, matchingPart.partValuePatternUid, matchingPart.partValuePatternVersion, matchingPart.scoringlistRuleId, matchingPart.scoringlistRuleWeight
target_path	target.url	Value copied directly from target_path

Need more help? Get answers from Community members and Google SecOps professionals.