cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

2200
Views
0
Helpful
4
Replies
Beginner

Integration with Logrhythm

***ERROR*** Error starting eStreamer source xxxxxx eStreamer: SSL authentication failed - closing the connection: A call to SSPI failed, see inner exception.

 

I am receiving this error on a SIEM when attempting to send logs from the estreamer to SIEM. i have recreated the host and tried the SSL cert with and without a password. Is there any known configuration item needed on the SIEM besides installation of the cert? 

 

 

4 REPLIES 4
Hall of Fame Master

Re: Integration with Logrhythm

I believe the SSL authentication is mutual - i.e. FMC must trust the LogRhythm certificate (and signing CA if it's not self-signed) and vice versa.

Beginner

Re: Integration with Logrhythm

Right, I believe that is correct. The issue is that this works fine on the other FMC going to LR. Its this one particular FMC and LR instance that is refusing to cooperate. any insight is very much appreciated. thanks!

Highlighted

Re: Integration with Logrhythm

Hey Guys,

I need to integrate FMC  4000 with LogRhythm , I have exported the cert from FMC. 

 

Can you please brief me on the steps involved , like what all changes we need to make at server end etc?

 

Thanks,

Prashant

 

Hall of Fame Master

Re: Integration with Logrhythm

It's an eStreamer integration. The general process is the same for eStreamer clients.

 

Here is how you setup the FMC end:

 

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/api/eStreamer/EventStreamerIntegrationGuide/ConfiguringEstreamer.html

 

Here is a blog article that is a couple of years old but still relevant covering both sides of a setup (albeit not LogRhythm):

 

https://popravak.wordpress.com/2015/07/29/connecting-sourcefire-to-siem-with-estreamer/