Collecting Nginx Proxy Manager logs in QRadar

Prerequisites of the collection

Nginx Proxy Manager installed with Docker and working properly
Rsyslog service installed on the physical server
Network flow opened between your physical server and your syslog or SIEM server (minimum 1 port)

Let's dig a bit on the configuration and prerequisites to validate and configure necessary point. The event collection implementation used Nginx Proxy Manager deployed in Docker container. Below the design of the collection:

In your Nginx Proxy Manager container configuration file, you need to add a volume for your logs file in order to be able to access directly from the hosting server. To do so, add these lines:

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    
# application configuration

    volumes:
      - ./data:/data # line to add

After that, deploy your new configuration and validate the fact that logs are being populated in the ./data/logs/ folder.

Second configuration to made is the rsyslog service in order to grab logs from your ./data/logs/ folder and send them to your syslog or SIEM server. The best way is to create a dedicated configuration file for this located in /etc/rsyslog.d/nginx-proxy-manager.log.

module(load="imfile" PollingInterval="10")

input(type="imfile"
      File="/path/to/nginx/proxy/manager/folder/data/logs/*.log"
      Tag="nginx-pm"
      Severity="info"
      Facility="local7")

local7.*                @@<SERVER_IP>:<SERVER_PORT>

Before apply the new configuration, run rsyslogd -N1 to validate that you are not bringing errors to the rsyslog configuration. If no errors, restart the service and validate reception of logs in your syslog server.

Key points of the DSM

Custom Properties:

Property Name	Extraction Type	Extraction Expression	Group captures	Reuse of native QRadar property
Destination IP	Regex	`\[Sent-to\s+([\d\.]+)`	1	YES
Event Category	Regex	`<\d+>\w+([\d\s:]+)<SERVER_HOSTNAME>\s([^\s]+)`	2	YES
Event ID	Regex	`\[[^\]]+][^\d]+(\d+)`	1	YES
HTTP Host {1}	Regex	`([^\s]+)\s+"([^\s]+)"\s+\[Client`	1	NO
HTTP Host {2}	Regex	`server:\s+([^\s]+),\s+request`	1	NO
HTTP Method {1}	Regex	`\d+\s-\s(\w+)`	1	NO
HTTP Method {2}	Regex	`request:\s"(\w+)`	1	NO
HTTP Path {1}	Regex	`([^\s]+)\s+"([^\s]+)"\s+\[Client`	1	NO
HTTP Path {2}	Regex	`request:\s+"\w+\s+([^\s]+)`	1	NO
Log Source Time {1}	Regex	`\[([^\s]+)\s+\+\d+]`	1	YES
Log Source Time {2}	Regex	`(\d{4}/\d{2}/\d{2}\s\d{2}:\d{2}:\d{2})`	1	YES
Packet Length	Regex	`Length\s+(\d+)`	1	NO
Source IP {1}	Regex	`\[Client\s+([\d\.]+)`	1	YES
Source IP {2}	Regex	`client:\s([\d\.]+)`	1	YES
User Agent	Regex	`\[Sent-to\s+[\d\.]+]\s+"([^"]+)"`	1	NO

Event Mapping

The mapping is very close to other reverse proxy and used HTTP code to map. Not every code is mapped, and you can add your own custom mapping depending on your infrastructure.

Download the DSM export of this article directly

You reach the end of this article, huge thanks for reading 🫶

👨‍👩‍👧‍👦 To become a more friendly guru of QRadar, join the community on Github and leave a ⭐.

🤗 To become a nicer guru of QRadar, leave a comment, your feedback will always be welcome (when constructive of course).

Comments

Be the first to comment.