Ingest Logs
Prerequisites
Logpoint v7.4.0 or later
Infoblox device
Download and install the integration:
Download and install the Integration
Go to the Marketplace.
Find the Integration and download the .pak file.
Go to Settings >> System Settings from the navigation bar and click Applications.
Click Import.
Browse to the downloaded .pak file.
Click Upload.
Configure Infoblox
You can configure Infoblox using two methods:
Log Source (recommended — centralized interface for all integrations)
Devices
Method 1: Configure via Log Source
Configure the log source settings and connector, routing, normalization, and enrichment.
Source
Configure the log source settings:
Click Source.
Enter the Log Source’s Name.
Select the Device Addresses.
Select the Device Groups.
Select a Time Zone. The timezone of the device must be the same as its log source.
Configure the Risk Values for Confidentiality, Integrity and Availability. They are used to calculate the risk levels of the alerts generated from the device.
Connector
Configure the connection to Infoblox:
Click Connector.
In Proxy Server, select one of the following:
None, for the device to work as a Syslog Collector.
Use as Proxy, to use the device as a proxy. (You won’t see Processing Policy because the logs coming from a proxy device do not need to be normalized and stored.)
Uses Proxy, for the device to use a proxy device to collect the logs. Use the dropdown to select a Proxy IP address of a proxy device and enter the device’s HostName. The hostname is case-sensitive. Parser and Charset disappear after you select Uses Proxy because the parser and charset values added for the proxy device are used for all devices using that proxy.
Select SyslogParser as Parser.
Select the Charset.
Routing
Repos are locations where incoming logs are stored, and routing criteria determine the conditions under which these logs are sent to repos.
To create a repo:
Click Routing and + Create Repo.
Enter a Repo name.
In Path, enter the location to store incoming logs.
In Retention (Days), enter the number of days logs are kept in a repository before they are automatically deleted.
In Availability, select the Remote logpoint and Retention (Days).
Click Create Repo.
In Repo, select the created repo to store logs.
To create Routing Criteria:
Click + Add row.
Enter a Key and Value. The routing criteria is only applied to those logs which have this key-value pair.
Select an Operation for logs that have this key-value pair:
Store raw message to store both the incoming and the normalized logs in the selected repo.
Discard raw message to discard the incoming logs and store the normalized ones.
Discard entire event to discard both the incoming and the normalized logs.
In Repository, select a repo to store logs.
Normalization
Select normalizers for the incoming logs. Normalizers transform incoming logs into a standardized format for consistent and efficient analysis.
Click Normalization.
Either:
Select a previously created normalization policy from the dropdown, or
Select a Normalizer from the list and click the swap icon.
Enrichment
Select an enrichment policy for the incoming logs. Enrichment policies add additional information to a log, such as user information, device type or geolocation, before analyzing it.
Click Enrichment.
Select an Enrichment Policy.
Click Create Log Source to save the configurations of Source, Connector, Routing, Normalization, and Enrichment.
Method 2: Configure via Devices
This method shows how to add normalization and processing policies, add an Infoblox device, and configure the Syslog Collector.
Adding a Normalization Policy
Normalization policies normalize and standardize logs for efficient storage, analysis, and retrieval.
Go to Settings >> Configuration from the navigation bar and click Normalization Policies.
Click Add.
Enter a Policy Name.
In Compiled Normalizer, select InfoBloxNormalizer.
In Normalization Packages, select LP_InfoBlox, LP_InfoBlox Generic, and LP_InfoBlox Lite.
Click Submit.
Adding a Processing Policy
Processing policy dictates how logs are handled, processed, and stored.
Go to Settings >> Configuration from the navigation bar and click Processing Policies.
Click Add.
Enter a Policy Name.
Select the previously created Normalization Policy.
Select the Enrichment Policy and Routing Policy.
Click Submit.
Adding an Infoblox Device
Go to Settings >> Configuration from the navigation bar and click Devices.
Click Add.
Enter a device Name.
Enter the IP address(es) of InfoBlox devices.
Select the Device Groups.
Select a Log Collection Policy.
Select a collector or a forwarder from the Distributed Collector drop-down.
It is optional to select the Device Groups, the Log Collection Policy and the Distributed Collector.
Select a Time Zone. It must be the same as InfoBlox.
Configure the Risk Values for Confidentiality, Integrity and Availability used to calculate the risk levels of the alerts generated from the device.
Click Submit.
Configuring the Syslog Collector for InfoBlox
Go to Settings >> Configuration from the navigation bar and click Devices.
Click the Add icon from Actions of the previously added device.
Click Syslog Collector.
Select Syslog Parser as Parser.
Select the previously created Processing Policy.
Select the Charset.
Proxy Configuration (if needed):
None, for the device to work as a Syslog Collector.
Use as Proxy, to use the device as a proxy. You won’t see Processing Policy because the logs coming from a proxy device do not need to be normalized and stored.
Uses Proxy, for the device to use a proxy device to collect the logs. Use the dropdown to select a Proxy IP address of a proxy device and enter the device’s HostName. The hostname of a proxy device is case-sensitive. Parser and Charset disappear after you select Uses Proxy because the parser and charset values added for the proxy device are used for all devices using that proxy.
Click Submit.
Verify Ingestion
Check Log Ingestion
Use the following query to verify InfoBlox logs are being ingested:
Verify Data Flow
Check Fetcher Status: Ensure InfoBlox is running without errors.
Monitor Log Volume: Verify expected log volumes are being processed.
Validate Normalization: Confirm logs are correctly parsed and normalized.
Test Dashboards: Access InfoBlox dashboards to verify data visualization.
Last updated
Was this helpful?