Set up the Global Log Receiver

• Enter the group name for the target CloudWatch logs stream in the Group Name box.

• Enter the stream name for the target CloudWatch logs stream in the Stream Name box.

• From the AWS Cloud Credentials list, select a cloud credentials object. You can also use Add Item to create a new object. For instructions on creating cloud credentials, see Cloud Credentials.

• Select a region from the AWS Region list. Make sure that you select the same region in which the S3 storage is configured.

• Enter your AWS S3 bucket name in the S3 Bucket Name box.

• From the AWS Cloud Credentials list, select a cloud credentials object. You can also use Add Item to create a new object. For instructions on creating cloud credentials, see Cloud Credentials.

• Select a region from the AWS Region list. Make sure that you select the same region in which the S3 storage is configured.

• Select Configure to set up the Azure Blob storage connection string.

• Select Blindfolded Secret from the Secret Type list.

• Use the Action list to select:

  • Blindfold New Secret: Select Built-in from the Policy Type list and enter your connection string into the Secret to Blindfold box, or select Custom for the policy type and then select a custom policy and enter your connection string.

  • Use Existing Blindfolded Secret: Enter your connection string into the Blindfolded Secret box.

• To get the Azure Blob connection string:

  • Go to All Services > Storage accounts > (name of account).
  • Select Access Keys on the navigation list for the storage account you have selected.
  • In the Access Keys pane, select one of the access keys and select Show for the Connection String. Select Copy to Clipboard on the left side of the shown box.

Figure: Azure Blob Connection String Location

• Select Apply.

• In the Container Name box, enter the name of the Azure container into which the logs are sent.

• Select Configure to set up the Azure Event Hubs storage connection string.

• Select Blindfolded Secret from the Secret Type list. Your connection string looks like EntityPath=<EventHubName>.

• Use the Action list to select:

  • Blindfold New Secret: Select Built-in from the Policy Type list and enter your connection string into the Secret to Blindfold box, or select Custom for the policy type and then select a custom policy and enter your connection string.

  • Use Existing Blindfolded Secret: Enter your connection string into the Blindfolded Secret box.

• To retrieve the Azure Event Hubs connection string, refer to the Get an Azure Event Hubs connection string article.

• Select Apply.

• In the Event Hubs Namespace box, enter the namespace of the Azure instance that stores the logs.

• In the Event Hubs Instance box, enter the name of the Azure instance that stores the logs.

• Enter the URL for Datadog into the Datadog Site box (datadoghq.com).

• Select Configure to set up the Datadog API key.

• Select Blindfolded Secret from the Secret Type list.

• Use the Action list to select:

  • Use Existing Blindfolded Secret: Enter your Datadog API Key into the Blindfolded Secret box.

  • Blindfold New Secret: Select Built-in from the Policy Type list and enter your Datadog API key into the Secret to Blindfold box, or select Custom for the policy type and then select a custom policy and enter your Datadog API key.

• To get the Datadog API key:

  • Go to API Keys. For Datadog documentation, see API App Keys.
  • Create an API key or select an existing one. A pop-up window appears.
  • Select Copy from the pop-up window and paste this value into the Global Log Receiver configuration for the API key.

Figure: Datadog API Key Location

• Select Apply.

• In the GCP Bucket Name box, enter the name of the bucket into which the logs are sent.

• Use the GCP Cloud Credentials list to select an existing set of credentials. Alternatively, select Add Item to create new credentials. For help creating new credentials, see Cloud Credentials.

• Enter the URI for your HTTP receiver in the HTTP Uri box.

• Select an authentication type from the Authentication list:

  • None: No authentication performed.
  • Basic Authentication: Enter your username in the User Name box and select Configure to enter your password.
  • Token Authentication: Select Configure to enter your authentication token.

Enter the URI for your QRadar receiver in the Log Source Collector URL box. For more information, refer to the HTTP Receiver protocol configuration options IBM article.

Sometimes, the Global Log Receiver receives multiple events at once. Configure the QRadar receiver to split the events into multiple records. To do this, configure the Message Pattern box as follows:

Figure: QRadar Message Pattern Configuration

• In Kafka Bootstrap Server List, enter the bootstrap server as host:port. Use Add Item to add more pairs.

• Enter the Kafka Topic name for the reported events.

• Select the endpoint that is applicable to your New Relic account from the NewRelic Account Endpoint list.

• Select Configure to set up the New Relic license key.

• Select Blindfolded Secret from the Secret Type list.

• Use the Action list to select:

  • Use Existing Blindfolded Secret: Enter your New Relic license key into the Blindfolded Secret box.

  • Blindfold New Secret: Select Built-in from the Policy Type list and enter your New Relic license key into the Secret to Blindfold box, or select Custom for the policy type and then select a custom policy and enter your New Relic license key.

• Select Apply.

According to a Splunk article, there are two different Splunk HEC URIs:

• For Splunk Cloud customers, the standard HEC URI is https://http-inputs-customer_stack.splunkcloud.com. Splunk Cloud customers do not need to specify port 8088. All HEC traffic goes over port 443.

• For customers using AWS Firehose, you have a second HEC URL: https://http-inputs-firehose-customer_stack.splunkcloud.com.

• For customers running HEC on their own deployments or using the Splunk test drive instance, you need to specify port 8088: https://input-prd-uniqueid.cloud.splunk.com:8088.

In either of the scenarios, you can use the following commands to validate the URLs:

• For Splunk Cloud, enter nslookup http-inputs-<customer_stack>.splunkcloud.com.

• For Splunk Test Drive, enter nslookup input-prd-uniqueid.cloud.splunk.com.

See Splunk documentation.

• Enter the Splunk HEC Logs Endpoint.

• Select Configure to set up the Splunk HEC token.

• Select Blindfolded Secret from the Secret Type list.

• Use the Action list to select:

  • Use Existing Blindfolded Secret: Enter your Splunk HEC token into the Blindfolded Secret box.

  • Blindfold New Secret: Select Built-in from the Policy Type list and enter your Splunk HEC token into the Secret to Blindfold box, or select Custom for the policy type and then select a custom policy and enter your Splunk HEC token.

• Select Apply.

• Select Configure to set up the HTTP Source Address URL.

• Select Blindfolded Secret from the Secret Type list.

• Use the Action list to select:

  • Use Existing Blindfolded Secret: Enter your Sumo Logic HTTP collector URL into the Blindfolded Secret box.

  • Blindfold New Secret: Select Built-in from the Policy Type list and enter your Sumo Logic HTTP collector URL into the Secret to Blindfold box, or select Custom for the policy type and then select a custom policy and enter your Sumo Logic HTTP collector URL.

• Select Apply.

Using batch options, you can apply limits, such as the maximum number of messages bytes or batch timeout age for a batch of logs that is sent to the receiver.

The default Batch Options are:

• Timeout Seconds: 300s (5 minutes)
• Max Events: (no limit/unset)
• Max Bytes: 10 MB

To modify the default configurations, select the Show Advanced Fields toggle on and do the following in the Batch Options section:

• From the Batch Timeout Options list, select Timeout Seconds and enter a timeout value in the Timeout Seconds box.

• From the Batch Max Events list, select Max Events and enter a value between 32 and 2000 in the Max Events box.

• From the Batch Bytes list, select Max Bytes and enter a value between 4096 and 1048576 in the Max Bytes box. The logs are sent after the batch reaches the specified size.

• Select Use TLS for the TLS list.

• Select Server CA Certificates from the Trusted CA list. Enter the certificates in PEM or Base64 format in the Server CA Certificates box.

• Select Enable mTLS from the mTLS config list and enter the client certificate in PEM or Base64 format in the Client Certificate box.

  • Select Configure in the Client Private Key box, and enter the secret in the box with the Secret Type selected as Clear Secret.

  • Select Apply. Wait for the operation to complete and select Apply.