Support

For setup help or any questions, please post them on answers.splunk.com and tag them with SplunkAppForBlueCoatProxySG.

Highlights

Real-time dashboards, panels, and search fields to easily view and investigate Blue Coat data
Contains latest performance and scalability improvements
Correlate Blue Coat data with other data sources in Splunk Enterprise to detect and remediate additional advanced threats

Dependencies

The app requires the Google Maps (http://splunk-base.splunk.com/apps/22365/google-maps) app from Splunkbase. You do not need to install this apps if you do not wish to use the mapping features. However, the main dashboard will not render properly without the above apps.

Installing

If you want to use the map feature, install the app dependencies from Splunkbase. If you are running a distributed splunk setup, the app contains an Add-on that you can install on the indexers. Otherwise, you just need to install the app from splunk base.

Getting data in

In Splunk, you will need to add a new TCP Data input. The app expects the source type to be bcoat_log. You may choose something different, but you will need to modify the app as well. Too add this input, log into Splunk and click on Manager. Under the Data section, click on "Data inputs". Then click on "Add new" for a TCP input. On this page, you can enter the port number, 20108 for example. You can optionally override the source name as well. Leave "Set sourcetype" as "From list", and choose bcoat_log from the dropdown list. Click on more settings, and set the index for this source to be bcoat_logs.

In Blue Coat, you will have to set up custom client for the logs you want to forward to Splunk. You will need to give it the Splunk indexer IP address and the TCP port you specified earlier.

If you are using a different index, in addition to modifying the bcoat_request macro, you will need to modify the bcoat_overview dashboard. To do this:

From the Splunk for Bluecoat app, click on Manager on the top right portion of the screen
Click User Interface
Click Views
Click bcoat_overview
In the text-editor, search for index=bcoat_index and replace it with the correct index
Click Save
Navigate back to the app, and the splash page should now work.

Configuring the app

You may have to modify the incoming sourcetype, transforms.conf, and props.conf depending on your BlueCoat configuration. By default, the app expects the incoming logs to be in the bcreportermain_v1 format for ProxySG 6.2.x and above. Specifically, it expects these fields:

date, time, time_taken, c_ip, cs_username, cs_auth_group,
x_exception_id, filter_result, category,http_referrer,
sc_status, action, cs_method, http_content_type, cs_uri_scheme,
cs_host, cs_uri_port, cs_uri_path, cs_uri_query,
cs_uri_extension, http_user_agent, s_ip, sc_bytes, cs_bytes,
x_virus_id, x_bluecoat_application_name, x_bluecoat_application_operation

If you are running an earlier version of SGOS, you can create an entry in the bcoat_proxysg section of your local props.conf file to use the brceportermain_v1_old format. It's the same format but without x_bluecoat_application_name and x_bluecoat_application_operation.

If you use a different log format than those, you will need to create an entry for it in your local transforms.conf file. Then in the bcoat_proxysg section of your local props.conf, you will need to set REPORT-main to the name you specified in the transforms.conf. You may need to set appropriate field aliases as well.

Modifying the macros

The app uses macros to define the categories for WFA issues and possible infections. Depending on your policies, you may want to modify these macros to suite your needs. These are located in the macros.conf file.

Splunk for Blue Coat ProxySG

0