topic Re: Integration with Logrhythm in Network Security

Integration with Logrhythm

jerm10201 — Fri, 21 Feb 2020 14:53:15 GMT

***ERROR*** Error starting eStreamer source xxxxxx eStreamer: SSL authentication failed - closing the connection: A call to SSPI failed, see inner exception.

I am receiving this error on a SIEM when attempting to send logs from the estreamer to SIEM. i have recreated the host and tried the SSL cert with and without a password. Is there any known configuration item needed on the SIEM besides installation of the cert?

Re: Integration with Logrhythm

Marvin Rhoads — Sat, 02 Dec 2017 02:30:51 GMT

I believe the SSL authentication is mutual - i.e. FMC must trust the LogRhythm certificate (and signing CA if it's not self-signed) and vice versa.

Re: Integration with Logrhythm

jerm10201 — Thu, 01 Mar 2018 16:05:07 GMT

Right, I believe that is correct. The issue is that this works fine on the other FMC going to LR. Its this one particular FMC and LR instance that is refusing to cooperate. any insight is very much appreciated. thanks!

Re: Integration with Logrhythm

prashant dwivedi — Mon, 25 Jun 2018 13:36:49 GMT

Hey Guys,

I need to integrate FMC 4000 with LogRhythm , I have exported the cert from FMC.

Can you please brief me on the steps involved , like what all changes we need to make at server end etc?

Thanks,

Prashant

Re: Integration with Logrhythm

Marvin Rhoads — Mon, 25 Jun 2018 14:45:43 GMT

It's an eStreamer integration. The general process is the same for eStreamer clients.

Here is how you setup the FMC end:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/api/eStreamer/EventStreamerIntegrationGuide/ConfiguringEstreamer.html

Here is a blog article that is a couple of years old but still relevant covering both sides of a setup (albeit not LogRhythm):

https://popravak.wordpress.com/2015/07/29/connecting-sourcefire-to-siem-with-estreamer/