Running the SIEM log file download script for Forcepoint storage

You can use the parameters described below to customize the sample download script used to download reporting logs from the cloud service for use by your SIEM tool.

Some parameters have a short form (for example, -v) and a long form (for example, --verbose). For these parameters, both options are listed.

Parameter Description

-u <username>

--username

Mandatory. Defines the logon user name for connecting to the cloud service. This must be an administrator contact with Log Export permissions.

For example:

-u siem_user@example.com

-p <password>

--password

Mandatory. This is the password for the specified user name.

For example:

-p Ft2016Logs
--stream

Mandatory. This is used to determine the type of files to be downloaded. Valid values are web, email, or all.

If “all” is specified, /web and /email folders are created under the destination directory and files are downloaded to the corresponding folder.

-v

--verbose

Optional. Runs the script in verbose mode, which displays progress messages.

Verbose mode provides feedback on the script’s progress, for example:

  • Downloading filelist from <host name> as <user name>
  • No files available to download
  • Downloading <file> to <file name location>

-h <hostname>

--host

Optional. Defines the host name to connect to. This is specified in the script by default, so you would only need this option if you have edited the script to remove it, or if you have been given a different URL to connect to.

For example:

-h https://sync-web.mailcontrol.com

-d <file path>

--destination

Optional. Defines the destination directory for the downloaded log files. If not specified, the files are downloaded into your current working directory.

For example:

-d /cloudweb/logs

-m

--md5sum

 Optional. Checks the md5sum of each downloaded file. The MD5 hash is commonly used to verify the integrity of files and can be used to check the files before they are deleted from the server.

-l

--list-only

 Optional. Displays a list of available log files without downloading them.
--proxy <proxy details>

Optional. Specifies an HTTP proxy to use if you are having difficulty connecting to the cloud service. The proxy must be in the form http:// username:password@host:port

For example:

--proxy http:// jsmith:Abc123@proxy_server:80
--max_download_children

Optional. Specifies the number of downloading processes to run in parallel. If not set, a single process is used. The maximum number of processes that can run in parallel is 10.

If the list-only parameter returns a large number of files not yet downloaded, set this value to 10 to allow the downloads to process those files.
--infinite_loop Optional. When configured, the download and reformat processes are run in an infinite loop. If not set, files that become available when the script is running are not downloaded.
--man Optional. Displays the list of parameters with their descriptions.
--help Optional. Displays a brief description of the program’s purpose.
--cfgfile Optional. Specifies the location of a configuratoin file which can include values for the other paramters.

A configuration file might look like this:

username=admin@company.com password=password1 
host=sync- web.mailcontrol.com infinite_loop=false 
verbose=true max_download_children=3 md5sum=false 
list_only=true stream=all destination=/tmp proxy=http:// 
user2@company.com:password2@myproxy.com:8081/ pidfile=/var/tmp/ftl.pid

See Getting started with SIEM integration for additional details on setting up SIEM integration and scheduling the download.