Process Flow

This topic walks you through on how SecMaster collects security logs from third-party (non-Huawei Cloud) systems or products, as well as how it transfers security logs from SecMaster to third-party systems or products. The procedure is as follows.

Figure 1 Log transfer process

This section describes the process of transferring logs in and out SecMaster.

Table 1 Log transfer process

Procedure	Description
(Optional) Step 1: Buy an ECS	Install the log collector.
(Optional) Step 2: Buy a Data Disk	Ensure that there is enough space to run the log collector.
(Optional) Step 3: Attach a Data Disk	Ensure that there is enough space to run the log collector.
Step 4: Create a Non-administrator IAM Account	Use this account to access SecMaster for the log collector on the tenant side.
Step 5: Configure Network Connection	Connect the tenant VPC to the SecMaster network.
Step 6: Install the Component Controller (isap-agent)	Manage the log collector node (ECS) on SecMaster.
Step 7: Install the Log Collection Component (Logstash)	Configure the log collection process.
(Optional) Step 8: Creating a Log Storage Pipeline	This step is required when you transfer security logs from non-Huawei Cloud systems to SecMaster. Skip this step if you only need to transfer Huawei Cloud logs to a third-party system or product. Create a log storage location (pipeline) in SecMaster for log storage and analysis.
Step 9: Configure a Connector	Set the parameters of the log source and destination ends. Complete this step based on your needs: Transferring Third-Party Security Logs to SecMaster Transferring Security Logs from SecMaster to a Third-Party System or Product
(Optional) Step 10: Configure a Log Parser	Configure a log parser to convert source logs to the required data type in codeless mode.
Step 11: Configure a Log Collection Channel	Connect all function components to ensure that SecMaster and the log collector work properly.
Step 12: Test and Verify	Check whether log access is successful.