Deploying LOGIQ
INTEGRATIONS
LOGIQ Monitoring
Vewing Logs
ANOMALY DETECTION
COMPLIANCE
LOGIQ STREAMING
LOGIQ Configuration
Log Ingest configuration
Sources
Sources provide matching rules for sender ip addresses. Sources can specify a single IP, a range of IP addresses or a list of IP addresses. A source definition can specify one or more of single IP, range of IP addresses or a list of IP addresses. In this case the source condition evaluates true if any of these source definitions are a match.
1
sources:
2
-
3
name: localhost
4
ipv4: 127.0.0.1
5
-
6
name: 3164_ip_1
7
ipv4: 192.168.55.20
8
-
9
name: 3164_ip_2
10
ipv4: 192.168.55.21
11
-
12
name: qa_lab
13
ipv4: 192.168.40.3
14
ipv4_range: 10.0.1.5/24
15
ipv4_list: 192.168.1.1, 192.168.1.10
Copied!
Sources are defined with the "sources" keyword in the config file. All source definitions must have a "name". Sources are referred in rules using their name. The config file validator will flag an error for names that are not found and or source definitions that have a missing name.
name [required]
This key is used to specify a unique name for source matching rules.
1
-
2
name: qa_lab
3
ipv4_list: 192.168.1.1, 192.168.1.10
Copied!
1
rules:
2
-
3
source: localhost
4
destination: t_debug
Copied!
Client IP/Network details [optional]
At least one of ipv4, ipv4_list and ipv4_range is required when selecting a Client IP/Network based source
ipv4 - Specify a single ip address
1
sources:
2
-
3
name: qa_lab_dns
4
ipv4: 192.168.4.21
Copied!
ipv4_list - Specify a list of ip addresses
An IP address list is specified by individual ip addresses separated by commas. Note that in the "ipv4_list" keyword, only individual ip addresses are allowed and not CIDR ranges.
1
sources:
2
-
3
name: qa_lab
4
ipv4_list: 192.168.1.1, 192.168.1.10
Copied!
ipv4_range - Specify a range of ip addresses
The IP address range is specified using the CIDR notation. E.g. 10.0.1.5/24 represents a range of ip's starting from 10.0.1.0 - 10.0.1.255 or a total of 256 addresses.
1
sources:
2
-
3
name: qa_lab
4
ipv4_range: 10.0.1.5/24
Copied!
Cloud S3 storage buckets
Stackdriver logs from GCP cloud storage
LOGIQ can directly ingest from Stackdriver's Google cloud storage sink. You do not need to incur additional pub sub costs for this. Create a
google_cloud_storage source in LOGIQ config for this.1
-
2
name: stackdriver_gcp_storage_bucket
3
s3:
4
type: google_cloud_storage
5
credential: >
6
{
7
"type": "service_account",
8
"project_id": <google_project_id>,
9
"private_key_id": <private_key_id>,
10
"private_key": <private_key_string>,
11
"client_email": <client_email>,
12
"client_id": <client_id>,
13
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
14
"token_uri": "https://oauth2.googleapis.com/token",
15
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
16
"client_x509_cert_url": <client cert url>
17
}
18
bucket: <cloud storage bucket name>
Copied!