Enabling Log Access

Scenario

SecMaster can access logs of Huawei Cloud services with your authorization, services such as Web Application Firewall (WAF), Host Security Server (HSS), and Object Storage Service (OBS). After you authorize the access, you can manage logs centrally and search and analyze all collected logs. For details, see Cloud Service Log Access Supported by SecMaster.

For the first workspace in each region, most types of logs recommended by SecMaster will be automatically loaded. For non-first workspaces, you need to configure log data access manually.

NOTE:

You are advised to enable access to asset details, asset alerts, baseline inspection results, vulnerability data, and logs in one workspace. This will make it easier for centralized security operations and association analysis.

This topic describes how to access logs and view where logs are stored.

Limitations and Constraints

It takes about 10 minutes for the log access settings to take effect.

Allowing SecMaster to Access Cloud Service Logs

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

5. In the navigation pane on the left, choose Settings > Data Integration.
   Figure 2 Data Integration page
   

6. Locate the target cloud service and click in the Logs column.

   Enable log access based on the cloud services you have enabled in the current region. For example, if you have enabled HSS and there is HSS security data in the current region, you can enable HSS log access to aggregate HSS data to SecMaster for centralized management and analysis.

   If all cloud services supported have been enabled in the current region, you can enable log access to all these services in just one click: click on the left of Access Service Logs.

7. Set the lifecycle.

   Set the data storage duration as required.

8. Set Automatically converts alarms.

   Locate the row containing the target security products. In the Automatically converts alarms column of that row, click to enable the function. After that, SecMaster will automatically convert cloud service logs into alerts when the logs meet certain alert rules. Those alerts will be displayed on the Alerts page.

   NOTE:

   • If this function is disabled, logs that meet certain alert rules will not be converted into alerts or displayed on the Alerts page.
   • You can access host vulnerability scan results on the Vulnerabilities page of SecMaster. If such results have been accessed during data integration but this conversion function is disabled, the results will not be displayed on the Vulnerabilities page.

9. Click Save. In the displayed dialog box, click OK.
   NOTE:

   It takes about 10 minutes for the log access settings to take effect. After the access is complete, a default data space and pipeline are created.

Viewing Logs and Storage Locations

After log integration, choose Security Analysis > Security Data Tables and view integrated logs.

1. Go to the target workspace. In the navigation pane on the left, choose Threats > Security Analysis. The Security Analysis page is displayed.
2. In the data space navigation tree on the left, click a data space name to show the pipeline list. Click a pipeline name. On the page displayed on the right, you can search the pipeline data.

   You can view the integrated logs on the pipeline data query page.

Related Operations

• Canceling Data Access
  1. In the Logs column of the target cloud services, click to disable the access to cloud service logs.
  2. Click Save. In the displayed dialog box, click OK.
• Editing the Data Access Lifecycle
  1. In the Lifecycle column of the target cloud services, enter the data storage period.
  2. Click Save. In the displayed dialog box, click OK.
• Canceling Automatic Converting Logs into Alarms
  1. In the Automatically converts alarms column of the target cloud products, click to disable the alarms.
  2. Click Save. In the displayed dialog box, click OK.