Setting up SIEM Agent to use Transport Layer Security (TLS)

SIEM Agent allows you to protect the communication between SIEM Agent and SIEMS. Protection is provided by use of the TLS (Transport Layer Security) protocol. SIEM Agent supports TLS version 1.2.

In order to use TLS to encrypt a SIEM Agent connection, you must use a digital certificate. If your organization has already purchased a trusted digital certificate, copy the certificate file to your SIEM server and configure your SIEM solution settings accordingly. If a certificate is not available, you can create one using IBM’s Digital Certificate Manager. See To create a self-signed digital certificate.

To configure SIEM Agent to use TLS

  1. Grant PTUSER *RX authority to the /QIBM/UserData/ICSS/Cert directory and all its subdirectories.

    CHGAUT OBJ('/QIBM/UserData/ICSS/Cert/') USER(PTUSER) DTAAUT(*RX) SUBTREE(*ALL)
  2. Create a new Output of type *NETWORK, or modify an existing Output as follows.
    1. In SIEM Agent, from the Main Menu, choose option 3, Work with Outputs.
    2. Press F6 to create a new Output or select option 2 on an existing Output to modify it.
    3. Configure the Output to send data to the SIEM server. Specify the following to secure the connection:
      1. Type: *NETWORK
      2. Location: the IP address specified in the Certificate Authority
      3. Port: the port specified in the Certificate Authority
      4. Protocol: *TLS
      NOTE: Consult the documentation of your SIEM solution for more information about identifying the required IP address and port required to use the Certificate Authority.

The following example demonstrates how to do this for the Kiwi Free Syslog server.

EXAMPLE: To configure the certificate on a Kiwi server:
  1. Import the certificate to your Kiwi server:

    1. Copy the certificate file to the server.

    2. Start / Run / mmc [Enter]
    3. Choose File > Add/Remove Snap-in…
    4. Choose Available snap-ins > Certificates.
    5. Select Add.
    6. Select Computer account and then Next.
    7. Select Local computer, then Finish.
    8. Choose OK.
    9. Expand Certificates (Local Computer).
    10. Right-click Personal, choose All Tasks > Import.
    11. Find the certificate file you copied over from the IBM i.
    12. Enter the password you entered when the certificate was exported and click Next.
    13. Select Certificate Store ‘Personal’ and click Next.
    14. Click Finish.
  2. Point Kiwi to this certificate.
    1. Choose File > Setup.
    2. Scroll down and expand Inputs.
    3. Click UDP and un-check Listen for UDP Syslog messages.
    4. Click on TCP and un-check Listen for TCP Syslog messages.
    5. Click on Secure TCP.
    6. Check Listen for secure (TLS) TCP Syslog messages.
    7. Click Select Certificate.
    8. In the Certificate Store drop-down, choose My.
    9. In the list of available certificates, find the one where ‘CN=xxx’ matches the common name noted during step 1 above.
    10. Highlight that entry and click Select.
    11. Enter the TCP port number you would like to use.
    12. Click OK.

  3. Configure a *NETWORK Output in SIEM Agent that uses the *TLS protocol and the same port you entered in Kiwi. See above.

To create a self-signed digital certificate

  1. Open the Digital Certificate Manager by going to:

http://your server name :2001/QIBM/ICSS/Cert/admin/qycucm1.ndm/main0

NOTE: Ensure the HTTP Admin server is running. To start the HTTP server, use the following command:

STRTCPSVR SERVER(*HTTP) HTTPSVR(*admin)
  1. If no certificate authority was previously configured, click Create a Certificate Authority (CA) on the left side menu.
  2. Enter the requested information and click Continue.
  3. For 'Install Local CA Certificate,' review the text and click Continue.
  4. For 'Certificate Authority (CA) Policy Data,' verify information and click Continue.
  5. On the 'Policy Data Accepted' screen, click Continue again.
  6. On the Create a Server or Client Certificate screen, you are prompted to create the Certificate store *SYSTEM. Enter the requested information and click Continue.
  7. Select applications that should trust the Certificate Authority and click Continue.
  8. Continue to create an Object Signing Certificate.
  9. Copy the certificate file to your SIEM server and configure your SIEM solution settings accordingly.