Clarity Client Automation

Expand all | Collapse all

SIEM entegration for Remote Control Logs

Jump to Best Answer
  • 1.  SIEM entegration for Remote Control Logs

    Posted 04-26-2016 11:44 AM

    Hi All,

     

    We want to get CA remote Control Previus session logs to SIEM. We tied to export All Previous RC Sessions report to csv file and then collect them to qradar. But this is not so suitable. Is here andy Database table to use for this purpose.

     

    Regards,



  • 2.  Re: SIEM entegration for Remote Control Logs

    Posted 04-26-2016 02:00 PM

    HI

    I was looking at the export of the previous sessions and you could choose the option export to ODBC Database Table 4-26-2016 1-57-58 PM.png

     

    I am not sure if this would help you to integrate with SIEM but may be a better option than a .csv export.

    Hope this is helpful

    Joe



  • 3.  Re: SIEM entegration for Remote Control Logs

    Posted 04-28-2016 02:15 AM

    Hi Wiegand,

     

    Thanks for reply. Exporting to an external database is sounds good. I will try this.

     

    Thanks,



  • 4.  Re: SIEM entegration for Remote Control Logs

    Posted 04-27-2016 04:28 PM

    If your RC events are configured to write to the Windows event logs, you could have an event collector (qradar) send it to your SIEM.



  • 5.  Re: SIEM entegration for Remote Control Logs

    Posted 04-28-2016 02:16 AM

    Hello Bill,

     

    Writing to event logs is a good idea. But I dont know how can I can configure this.

     

    Best Regards,



  • 6.  Re: SIEM entegration for Remote Control Logs

    Posted 04-28-2016 12:01 PM

    HI

    Check under the policy

    URC Policy \ Remote Control \ Event Logging \ Host Events

    Remote control session started

    Remote control session stopped

    That may help

    Thanks

    Joe



  • 7.  Re: SIEM entegration for Remote Control Logs

    Posted 04-28-2016 03:58 PM

    The configuration policy needs to be updated in a couple places.

     

    1) Update the remote control event logging

    capture1.JPG

    2) Update the event log destination

    Capture2.JPG

     

    Once they are in the OS event logs, you should be able to capture them with the SIEM tool.  DB queries/export/imports are not necessary.



  • 8.  Re: SIEM entegration for Remote Control Logs
    Best Answer

    Posted 04-28-2016 03:48 PM

    Hi Erhan,

     

    The active and preivous RC Sessions are stored in SQL table : urc_active_session.

     

    For example following query returns details about the previous RC Sessions :

     

    SELECT dateadd ( ss, datesessionstarted + datediff(ss,getutcdate(),getdate()), convert(datetime,'19700101')) 'Start Time',

    strhost 'Host', strviewer 'Viewer', strremoteuser 'Remote User', iduration 'Duration'

    FROM urc_active_session

    WHERE iduration>0

     

    Thanks.

    Regards,

    Jean-Yves



  • 9.  Re: SIEM entegration for Remote Control Logs

    Posted 04-29-2016 03:05 AM

    Hi,

     

    Thank you very much for your support. Both methods are useful.

     

    Best Regards,