Introduction to Log Relay

Requirement Type

Product Compatibility

Description

Supported Devices

• Armor Enterprise Cloud

• Armor Anywhere

Only Linux machines can be converted to Log Relays. Machines must be in an OK state to be converted.

To learn more about the health status of a virtual machine, see Health Overview Dashboard.

Log Relay will support receiving logs from devices such as WAFs or next-gen firewalls. The Armor Agent is not needed on devices to pass logs through a relay.

Pricing Information

• Armor Enterprise Cloud

• Armor Anywhere

While log collection is available to all users, there is a cost associated with sending and storing logs.

For pricing information, please contact your Account Manager.

Permissions

• Armor Enterprise Cloud

• Armor Anywhere

In order to use Log Relay, you must have the following permissions included in your account:

• Write Virtual Machine

• Delete Log Management

• Read Log Endpoints

• Read Log Relays

• Write Log Relays

• Delete Log Relays

To learn more about permissions, see Roles and Permissions.

Log Retention Plan

• Armor Enterprise Cloud

• Armor Anywhere

• Armor Enterprise Cloud virtual machines that are converted to a log relay device will be automatically enrolled in the Compliance Professional plan.

This plan:

• Collects and stores your logs for 13 months at an additional cost.

• Provides certain HIPAA and PCI compliance.

For pricing information, please contact your Account Manager.

Armor Anywhere agents that are converted to a log relay device will retain the default Log Management Essentials plan subscription. This plan collects and stores your logs for 30 days.

Firewall Rules

• Armor Anywhere

Armor Anywhere users must add the following generic firewall rules:

Inbound:

• Service/Purpose

  • Log Relay (Logstash)

• Port

  • 5140/udp

  • 5141/tcp

• Destination

  • The IP address for your virtual machine

Outbound:

• Service/Purpose

  • Armor's logging service (ELK)

• Port

  • 5443/tcp

  • 5400-5600/tcp (Reserved)

    • Armor reserves the right to utilize this port range for future expansion or service changes.

• Destination

  • 52.38.171.243

  • 52.26.92.237

  • 35.155.168.100

    • (1d.log.armor.com)

The above-mentioned ports do not provide security analytics. To receive security analytics for logs from supported remote log devices, you must add additional firewall rules; these additional ports are described in the configuration documents listed in Create and Configure Remote Log Sources.

For non-supported remote log sources, collected logs will not receive any security analytics.

To learn more about firewall rules, see Requirements for Armor Anywhere.

Log type

Additional information

Detailed instructions

AWS CloudTrail

For this log type, you must be able to:

• Gather your AWS account information

• Create a new trail and sync your AWS S3 bucket

Create a Remote Log Source - AWS CloudTrail

AWS GuardDuty

For this log type, you must be able to:

• Update your AWS permissions for GuardDuty, Lambda, CloudWatch, and CloudFormation

• Retrieve your AWS credentials (AWS account number / account ID, AWS Access Key, AWS Secret Key)

• Configure the AWS GuardDuty CloudFormation StackSet Template

Create a Remote Log Source - AWS GuardDuty

AWS VPC Flow Logs

For this log type, you must be able to:

• Update your AWS permissions for VPC, Lambda, CloudWatch, and CloudFormation

• Configure a Web ACL

• Configure the AWS WAF CloudFormation Stack Template

Create Flow Connection - AWS VPC Flow Logs

AWS WAF

For this log type, you must be able to:

• Update your AWS permissions for WAF, Lambda, CloudWatch, and CloudFormation

• Configure the AWS VPC Flow Log CloudFormation Stack Template

Create a Remote Log Source - AWS WAF

Check Point

For this log type you must be able to:

• Log into and pre-configure the Check Point box

• Configure your Check Point device

Create a Remote Log Source - Check Point

Cisco ASA

For this log type, you must be able to:

• Log into your Cisco ASA device

• Access the privileged EXEC mode

Create a Remote Log Source - Cisco ASA

Cisco ISR

For this log type, you must be able to:

• Log into your Cisco ISR device

• Access the privileged EXEC mode

Create a Remote Log Source - Cisco ISR

Juniper

For this log type, you must be able to:

• Log into your Juniper SRX device

• Access the privileged EXEC mode

Create a Remote Log Source - Juniper

Fortinet FortiGate

For this log type, you must be able to:

• Log into your Fortinet Security Gateway

• Access the CLI Console

Create a Remote Log Source - Fortinet Security Gateway

Imperva Incapsula

For this log type, you must be able to:

• Access the AWS console

• Configure the IAM Role for an EC2 server or non-EC2 server

• Log into your log relay server

Create a Remote Log Source - Imperva Incapsula

Palo Alto Firewall

For this log type, you must be able to:

• Access the Palo Alto console

• Configure your server and server profile

Create a Remote Log Source - Palo Alto Firewall

SonicWall

For this log type, you must be able to:

• Log into the SonicWall console

• Configure your SonicWall device

Create a Remote Log Source - SonicWall

Cylance

For this log type:

• The user has a Log Relay device online

• The user is not blocking traffic on port TCP and UDP port 14015 between the Cylance and the Log Relay

Create a Remote Log Source - Cylance

Storage Only

For this log type, you must be able to:

• Configure your device or application for compliance log storage only

Create a Storage Only Log Source

Appliance

Threshold

Minimum number of CPU cores

Suggested Memory in GB

Armor Log Relay

2,500 EPS or less

4

8

5,000 EPS or less

8

16

10,000 EPS or less

16

32