The below are the high level steps to configure squid syslog to Microsoft Cloud App security using the CASCollector (an ubuntu vm which runs on Azure\\Hyper-V\\AWS)<\/p>\n
Follow steps here: https:\/\/docs.microsoft.com\/en-gb\/cloud-app-security\/discovery-docker-ubuntu-azure<\/p>\n
Summary of commands below which are run on the CASCollector Ubuntu server<\/p>\n
sudo -i<\/p>\n
curl -o \/tmp\/MCASInstallDocker.sh https:\/\/adaprodconsole.blob.core.windows.net\/public-files\/MCASInstallDocker.sh && chmod +x \/tmp\/MCASInstallDocker.sh; \/tmp\/MCASInstallDocker.sh<\/p>\n
(echo cb83b3f208347603e38ea2816c7503ec257159001225001c2b8efa6e06f49951) | docker run –name CASLogCollector -p 514:514\/udp -p 21:21 -p 20000-20099:20000-20099 -e “PUBLICIP=’10.10.10.12′” -e “PROXY=” -e “SYSLOG=true” -e “CONSOLE=cas.eu2.portal.cloudappsecurity.com” -e “COLLECTOR=CASLogCollector” –security-opt apparmor:unconfined –cap-add=SYS_ADMIN –restart unless-stopped -a stdin -i microsoft\/caslogcollector starter<\/p>\n
sudo docker logs UKADLogCollector<\/p>\n
Confirm it is running<\/p>\n
On the CASCollector Ubuntu server
\nSudo apt-get install iptraf<\/p>\n
Open Squid.config and make sure the following 2 entries exist<\/p>\n
access_log C:\/ClientSiteProxy\/var\/logs\/access.log squid
\naccess_log udp:\/\/172.18.1.150:514 squid<\/p>\n
Save the file and then restart the squid service <\/p>\n
The “squid” value at the end of the path sets the format to native, Microsoft CAS (out of the box) supports Native and Common, customised formats can be created but we are keeping this simple.<\/p>\n
Make sure the CAS data source is selected with the format Squid (Native)<\/p>\n
Review “sudo iptraf” network traffic and confirm you can see the incoming UDP traffic on the log collector
\nReview the governance logs from the CAS portal (gear icon > governance log)
\nInstall a separate syslog receiver test tool (confirm syslog traffic is appearing)
\nInstall a separate syslog transmitter test tool (confirm syslog udp traffic is appearing) <\/p>\n
NB: this article relates to squid 2.7 or above and Symantec client site proxy (was known as messagelabs)<\/p>\n","protected":false},"excerpt":{"rendered":"
The below are the high level steps to configure squid syslog to Microsoft Cloud App security using the CASCollector (an ubuntu vm which runs on Azure\\Hyper-V\\AWS) Install CAS Collector Follow steps here: https:\/\/docs.microsoft.com\/en-gb\/cloud-app-security\/discovery-docker-ubuntu-azure Summary of<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[21],"tags":[2784,2664,2654,2551],"class_list":["post-4454","post","type-post","status-publish","format-standard","hentry","category-microsoft","tag-cas","tag-cloud-app-security","tag-mcas","tag-microsoft"],"jetpack_publicize_connections":[],"yoast_head":"\r\n