Configure the BeyondTrust Remote Support SIEM Tool Plugin
All of the steps in this section take place in the BeyondTrust Middleware Administration Tool. Access this tool by going to a browser on the server where the Middleware Engine is installed, and entering the address http://127.0.0.1:53231/.
To begin configuration, and click the clipboard icon next to the plugin name.
Configure Communication between the SIEM Plugin and the BeyondTrust Appliance B Series
Enter the settings for communication between the plugin and the appliance. Configuration sections include:
- Plugin Configuration Name: Any desired value. Because multiple configurations can be created for a single plugin, allowing different environments to be targeted, provide a descriptive name to indicate how this plugin is to be used.
- Appliance Id: This can be left as default or can be given a custom name. This value must match the value configured on the outbound event URL in the BeyondTrust Appliance B Series. If outbound events are not being used, this value is still required, but any value may be used.
- B Series Appliance Host Name: The hostname of the B Series Appliance. Do not include https:// or other URL protocol elements. For example, enter www.example.com.
- BeyondTrust Integration API OAuth Client ID: This field must contain the Client ID of the OAuth account.
- BeyondTrust Integration API OAuth Client Secret: This field must contain the client secret of the OAuth account
- BeyondTrust Integration API User Name: The username of the API service account created on the .
- BeyondTrust Integration API Password: The password of the above user.
- Locale Used for BeyondTrust API Calls: This value directs the B Series Appliance to return session data in the specified language.
- Disabled: Enable or disable this plugin configuration. It must be enabled to function.
- Allow Invalid Certificates: Leave unchecked unless there is a specific need to allow. If enabled, invalid SSL certificates are allowed in calls performed by the plugin. This would allow, for example, self-signed certificates. This is not recommended in production environments.
- Use Non-TLS Connections: Leave unchecked unless it is the specific goal to use non-secure connections to the B Series Appliance. If checked, TLS communication is disabled altogether. If non-TLS connections are allowed, HTTP access must be enabled on the BeyondTrust /login > Management > API Configuration page. Using non-secure connections is discouraged.
When using OAuth authentication, TLS cannot be disabled.
- Outbound Events Types: Check which types of events the plugin processes when received by the middleware engine. Event types selected here must also be configured to be sent in BeyondTrust. The middleware engine receives any events configured to be sent in BeyondTrust but passes them off to the plugin only if the corresponding event type is selected in this section.
- Polling Event Types: If network constraints limit connectivity between the B Series Appliance and the middleware engine such that outbound events cannot be used, an alternative is to use polling. The middleware engine regularly polls the B Series Appliance for any sessions that have ended since the last session was processed, however only the Support Session End event type is supported.
- Polling Interval: Enter only if polling is used. This determines how often the middleware engine polls the B Series Appliance for sessions that have ended. Too frequent polling may cause performance issues.
- Retry Attempt Limit: Enter the number of retries that can be attempted if the plugin fails to process an event. Too many retries may cause performance issues.
- Retry Outbound Event Types: Specify which outbound events the plugin retries if it fails to process the event.
- Retry Polling Event Types: Specify which polling events the plugin retries if it fails to process the event.
For more information about configuring the BeyondTrust Middleware Engine and plugins, please see the BeyondTrust Remote Support Middleware Engine Installation and Configuration Guide.
SIEM Tool Instance
These are the fields and selections needed to configure the plugin for integration with your SIEM tool. Please see your SIEM installation guide for the values to provide.
- Target SIEM System : Select the target SIEM tool from the list.
- SIEM Syslog Host: Enter the hostname or IP address of the SIEM instance that should receive the messages.
- SIEM Syslog Port: Enter the port used by the SIEM instance to receive syslog messages.
- SIEM Syslog Protocol: Select the appropriate protocol from the list.
- Events to Process: BeyondTrust session data can contain many different event types. All types are available; however, a subset may be desired in the SIEM tool. Select only the events you would like sent to the tool. Events matching unchecked event types are ignored.
For a complete list of available events, please see BeyondTrust SIEM Tool Message Reference List.
On the BeyondTrust Middleware Engine server, in the <install dir>\Plugins\<integration>\Templates folder, there are multiple files ending with *.hbs. These are Handlebars template files. These files are used by the plugin to format the session report and exit surveys that are added to the corresponding ticket each time a BeyondTrust session ends or each time a survey is submitted. The templates can be edited if desired.
If you are editing a template, we recommend copying and saving the original in case the changes need to be reverted.
For more information on Handlebars templates, please see the Handlebars website.