Integration with Logrhythm

[jerm10201]

***ERROR*** Error starting eStreamer source xxxxxx eStreamer: SSL authentication failed - closing the connection: A call to SSPI failed, see inner exception.

I am receiving this error on a SIEM when attempting to send logs from the estreamer to SIEM. i have recreated the host and tried the SSL cert with and without a password. Is there any known configuration item needed on the SIEM besides installation of the cert? 

[Marvin Rhoads]

I believe the SSL authentication is mutual - i.e. FMC must trust the LogRhythm certificate (and signing CA if it's not self-signed) and vice versa.

[jerm10201]

Right, I believe that is correct. The issue is that this works fine on the other FMC going to LR. Its this one particular FMC and LR instance that is refusing to cooperate. any insight is very much appreciated. thanks!

[prashant dwivedi]

Hey Guys,

I need to integrate FMC  4000 with LogRhythm , I have exported the cert from FMC. 

Can you please brief me on the steps involved , like what all changes we need to make at server end etc?

Thanks,

Prashant

[Marvin Rhoads]

It's an eStreamer integration. The general process is the same for eStreamer clients.

Here is how you setup the FMC end:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/api/eStreamer/EventStreamerIntegrationGuide/ConfiguringEstreamer.html

Here is a blog article that is a couple of years old but still relevant covering both sides of a setup (albeit not LogRhythm):

https://popravak.wordpress.com/2015/07/29/connecting-sourcefire-to-siem-with-estreamer/