User's Guide: Logging

1.0  Introduction: Audit Log

This article describes how to integrate Fortanix Data Security Manager (DSM) with External logging systems. Fortanix DSM automatically maintains an internal audit log of system operations. You can configure Fortanix DSM to send these audit log entries to an external logging system. In this article you will learn how to send Fortanix DSM audit logs to the following external logging systems:

• Splunk
• Google Stackdriver
• Syslog Server

Typical enterprises have a requirement to collect and maintain logs of all systems including Fortanix DSM in a single place. Enterprises write rules with external logging systems such as Splunk, Google Stackdriver, and Syslog to generate actions such as alerts, emails, and so on to match on a log or event. Fortanix DSM supports pushing logs/system events to Splunk, Google Stackdriver, and Syslog for external logging.

2.0  Fortanix Data Security Manager External Logging

Fortanix Data Security Manager Audit Log

The Fortanix DSM external event logging is configured on a per-account basis. Logs/events of an account are not visible to another account within an enterprise. Fortanix DSM automatically maintains an internal audit log of system operations. To view the audit log:

1. Click the Events tab in the Fortanix DSM UI.

Figure 1: Fortanix DSM Audit Logging

For convenience, when viewing the details of a security object and other Fortanix DSM objects, the most recent audit log entries applicable to the object are shown in the right-hand pane.

Figure 2: Log of Security Object

Log Invalid API Requests

Sometimes applications encounter invalid API requests that lead to 4XX errors, such as 400 (bad request) type error. To debug an application against 4XX errors, the Fortanix DSM enables audit logging for such errors using the Log Management feature. To enable this:

1. In the Fortanix DSM UI, go to LOG MANAGEMENT option in the Account Settings
2. Enable the toggle for Logging invalid API requests.
   Figure 3: Enable logging for invalid API request
3. To see the 4XX logs, click the Events tab in the Fortanix DSM UI.
   Figure 4: Event logs for 4XX error

High Volume Security Objects

In scenarios where a security object is used for cryptographic operations with very high usage, audit logging related to these operations can be explicitly disabled for the security object. This is the only scenario where audit logs can be disabled for an object.

To disable audit log on an existing security object:

1. Go to the detailed view of the object and click the toggle for audit logging to disabled mode.
   Figure 5: Disable audit logging for high volume key
2. If the group has a quorum policy set, then you will see “HIGHVOLUME” in the “Key operations permitted” section of the “Quorum approval request” dialog. The presence of HIGHVOLUME operation indicates that audit log is requested to be disabled.
   Figure 6: High Volume

To disable audit log for a security object during object creation:

1. Scroll to the bottom of the Security Object Create/Import page.
2. Clear Enable audit logging option.
   Figure 7: Create high volume key

Log Management

Currently, Fortanix DSM supports the following logging systems:

• Splunk
• Google Stackdriver
• Syslog

To integrate with the above logging systems, click the Settings tab in the Fortanix DSM UI left pane, and then click Log Management. It will give you three options for integration: Splunk, Google Stackdriver, and Syslog. It is possible to have more than one integration active at the same time. Logs will be pushed from Fortanix DSM to all logging facilities that are configured.

Figure 10: Log Management

Sending Audit Logs to Splunk

You can configure Fortanix DSM to send audit log entries to a Splunk server via the HTTP Event Collector (HEC).

 To configure logging events to Splunk,

1. Click the Settings icon in the Fortanix DSM UI.
2. Click the Log Management tab from the left panel.
3. In the Custom Log Management Integrations section, click the Add Integration button for Splunk.
   Figure 11: Add Splunk Integration
4. Configuring a Splunk integration requires the following information:
   1. Enter the IP Address or the hostname of your Splunk server.
      1. Select Enable HTTPS to communicate with the Splunk server over HTTPS (recommended) and also select the Enable SSL checkbox in the Splunk Global Settings. Refer to the Appendix for the screenshot. 
         NOTE

         If you are using an HTTP connection, then clear the Enable HTTPS checkbox in the Fortanix DSM Log Management screen and also clear the Enable SSL checkbox in the Splunk Global Settings. Refer to the Appendix for the screenshot.
         Depending on the type of TLS certificate the Splunk server is using:
      2. Select Global Root CAs if you are using a certificate that is signed by a well-known public CA.
      3. Select Custom CA Certificate, if you as an enterprise want to self-sign the certificate using your own internal CA. To do this, upload the CA certificate using the UPLOAD A FILE button. When Fortanix DSM as a client connects to the Splunk server and is presented the server’s certificate, it will be able to validate it using the enrolled custom CA Certificate. To generate the CA certificate, run the following command:

         openssl s_client -connect <endoint/ipaddress>:port -showcerts

         Where,
         • ipaddress: is the IP address of the Splunk server.
         • port: is the value of the Management port, under Server settings->General settings in the Splunk Server. Refer to the Appendix for the screenshot.
      4. In case the Custom CA Certificate has a Common Name (CN) that does not match with the server in which Splunk is deployed, clear the Validate Hostname checkbox which prompts Fortanix DSM to ignore the hostname of the Splunk deployment instance. Only the certificate chain will be validated in this case.
   2. The default Port number is 80. If you are running on a different port, add the applicable port number. If you enable HTTPS in "Step a" above, then the default port number is 443.
   3. Add the name of the Splunk index in the Index field to submit events. The index value should be the same as the index in Splunk. Refer to the Appendix for the screenshot. When you push the logs to Splunk, you need to push it to a specific index. This value is sent to the Splunk server and can be set to whatever you like. This will allow distinguishing logs from different sources. For example, the logs from Fortanix DSM can be pushed to the Index source name SDKMS.
   4. Enter a valid Authentication token to authenticate to the HTTP Event Collector of your Splunk instance. The Authentication token will authenticate Fortanix DSM as a client to Splunk and allows it to push the events to Splunk. See the Splunk documentation for detail about generating HEC authentication tokens. 
      Figure 12: Splunk Log Management Integration Form
      NOTE

      For security reasons, the authentication token is not displayed in the interface when editing an existing configuration.
5. Click ADD INTEGRATION to save the Splunk integration.

Sending Audit Logs to Google Stackdriver

You can configure Fortanix DSM to send audit log entries to Google Stackdriver.

1. To configure logging events to Google Stackdriver, in the Custom Log Management Integrations section, click the Add Integration button for Google Stackdriver.
   Figure 13: Add google Stackdriver Integration
1. Log ID is the ID of the log to write to. Log ID must be a URL-encoded within the Log Name. Log Name is the resource name of the log to which this log entry belongs. For example, organizations/1234567890/logs/cloudresourcemanager.googleapis.com%2Factivity
   For more information, see Google Stackdriver reference URL.
2. Upload Service account key or configuration file. To connect to the Google Stackdriver, you will need a configuration file that contains the Service account key and other information. Upload this configuration file using the UPLOAD A FILE button.
   Figure 14: Google Stackdriver Log Management Integration Form

Sending Audit Logs to Syslog

You can configure Fortanix DSM to send audit log entries to the Syslog server. 

To configure logging events to Syslog, in the Custom Log Management Integrations section, click the ADD INTEGRATION button for Syslog.

Figure 15: Add Syslog Integration

1. Configuring a Syslog management integration requires the following information:
   1. Enter the Hostname or IP address of your Syslog server.
   2. You can communicate with a Syslog server either over a non-secure connection or a secure connection using TLS. Depending on the type of TLS certificate that the Syslog server is using,
      1. Select Global Root CAs, if you are using a certificate that is signed by a well-known public CA.
      2. Select Custom CA Certificate, if you as an enterprise want to self-sign the certificate using your own internal CA. To do this, upload the CA certificate using the UPLOAD A FILE button. When Fortanix CCM as a client connects to the Syslog server and is presented with the server’s certificate, it will be able to validate it using the enrolled custom CA Certificate
   3. The default Port number is TCP 514 at which the server must listen for Syslog messages. If you are running on a different port, change to the applicable port number.
   4. When you log an event in Syslog, you can choose to log it in different facilities. This allows you to filter your log for a specific facility. The facilities appearing in the Facility list are well-defined facilities in the Syslog protocol. For example: User, Local0, Local1, and so on. You can configure the Fortanix DSM system to use the Local0 facility for instance. This will help in filtering logs from a particular appliance using a facility.
      Figure 16: Syslog Integration Form

Sending Audit Logs to Rapid7 InsightIDR

For detailed list of instructions on how to export the Fortanix DSM log files to the Rapid7 InsightIDR centralized log management utility, refer to Using Fortanix DSM with Rapid7 InsightIDR.

Log Structure

A system event in Fortanix DSM generates a log that has the following components:

1. Log Severity – Severity of the message (Critical issues, Errors, Warnings, and Info). As of today, the backend for Logging only supports the Severities – “Info” and “Errors”. A severity is logged as “Error” when logging requests have failed for some reason such as client error or internal server error. For all the other cases where the audit logs describe crypto operations, object updates and so on the severity is logged as “Info”.
2. Groups – The Fortanix DSM group that the event belongs to.
3. IP-Address – This is the IP address of the client/user whose request triggered the log message. The client IP is recorded whenever it is available. For some logs, the IP-Address field might appear empty due to one of the following reasons:
   • When Kubernetes is used for load balancing instead of an external load balancer, Kubernetes reroutes requests and does not preserve the original client IP address. This is something Fortanix will address in the future.
   • Since this was a new field introduced recently the older logs would have the IP_Address field empty.
4. Apps/Users – The log message can be a user event or application event.
5. Time – Timestamp of when the event occurred.
6. Type – Type of event (Administrative, Auth, and Crypto Operations).
   • Administrative - Operations that users can perform such as generating/importing/updating/deleting keys and other objects are classified as “Administrative” events.
   • Crypto Operation – Operations such as encryption/decryption/signing/ and so on are classified as “Crypto Operation” events.
   • Auth – Operations such as logging in or logging out, applications authenticating to get a session, or terminating their session are classified as “Auth” events.

When a log is pushed to a third-party external logging system, the log structure with all the log components above are sent to the server.

Figure 17: Fortanix DSM System Events

The format of a message logged on any external logging system is as follows:

<message string> acct_id=<corresponding account id> groups=[corresponding group ids] actor=<Actor type>:<Actor Id> obj=<Object Id> action=<Action Type>

Where,

• All the ids are UUID of the respective object
• Actor types can be User or App
• Action types can be Administrative, Auth, or Crypto Operation

For Example,

User "bob@company.com" created key "key_test" acct_id=8fb9b132-0b68-4d33-aba2-f1f9db3ab0e9 groups=[5f1d12e9-614a-4f5b-a4ed-837d9fb001b8] actor=User:9dbd5192-ee09-46f6-89fd-812e96863aa4 obj=3da3bf54-610b-4e89-816d-d4931f59f102 action=CRYPTOOPERATION

Appendix

Following are the Splunk Server screenshots-

• If you are using an HTTPS connection, then select the Enable SSL check box below in the Global Settings.
  Figure 18: Enable SSL
• Port number on the Splunk server used for generating Custom CA Certificate.
  
  Figure 19: Management Port Number
• The index value in the Fortanix DSM Splunk Log Management Integration form should be the same as the Default Index value.
  
  Figure 20: Fortanix DSM System Events