How-To: Export your EZSSH Logs to CrowdStrike Falcon

Learn how to monitor your SSH access requests by sending all security logs to your CrowdStrike Falcon SIEM provider.

Prerequisites

  1. Registering the application in your tenant
  2. Selecting a Plan

How To Export Your EZSSH Audit Logs to CrowdStrike Falcon

To export your EZSSH logs to CrowdStrike Falcon, you will need to enable Audit Log exports in your EZSSH subscription, set up your CrowdStrike Falcon environment with the proper endpoint, and then establish a connection from EZSSH to CrowdStrike Falcon. The following steps will walk through how to set this up.

How To Enable Log Export in EZSSH Portal

  1. Go to the EZSSH Portal.

  2. Click on Settings.

    EZSSH Agentless JIT Access portal dashboard with Settings item highlighted in the left navigation sidebar

  3. Expand your subscription’s Advanced Settings.

    EZSSH Agentless JIT Access subscription settings page showing Advanced Settings section with expand arrow highlighted

  4. Enable the Send Audit Logs to SIEM option.

    EZSSH Agentless JIT Access Advanced Settings panel with Send Audit Logs to SIEM checkbox highlighted

How To Configure the CrowdStrike Falcon SIEM in EZSSH Portal

To complete the connection in EZSSH you’ll need to configure your SIEM settings in CrowdStrike Falcon first. Follow these steps to set up EZSSH log imports.

How to Create a CrowdStrike Falcon Next-Gen SIEM HEC Data Connector

  1. In another tab, log into CrowdStrike Falcon.

  2. From the left-hand nav menu, click Next-Gen SIEM.

    Navigate to Next-Get SIEM in CrowdStrike Falcon

  3. Under Log management click Data onboarding.

    Navigate to Data Onboarding in Next-Gen SIEM

  4. Click Add connection.

    Click Add Connection button in Next-Gen SIEM

  5. Find and select HEC/HTTP Event Data Connector.

  6. Click Configure.

    New Connection Dialog configure Data Connector in Next-Gen SIEM

  7. Fill in the Connection name.

  8. Under Parsing and enrichment click Create new parser.

    How to Creating a New Parser in Next-Gen SIEM for EZSSH

  9. Change the dropdown from Blank template to Import.

  10. Download the EZSSH parser template: keytos-ezssh.yaml

    Note: This is a template parser for EZSSH that is designed to be used as a starting point for your final parser. It is intentionally bare-bones so it can be customized to your needs.

  11. Click Upload file to upload the provided parser.

    How to Upload a New Parser in Next-Gen SIEM for EZSSH

  12. Name the parser and click Create.

  13. Check the Terms and Conditions box.

  14. Click Create connection.

  15. Click Close.

  16. It will take a few seconds for the connector to be ready to receive data. Reload the page every few seconds until you see a prompt to Generate API key.

    How to Generate API key in Next-Gen SIEM

  17. Click Generate API key. (This page can only be opened during setup so record you API key.)

  18. Copy your API Key and your API URL.

How to Add Your Next-Gen SIEM HEC Connection Details in EZSSH

  1. Go back to your EZSSH tab.

  2. Select Splunk Cloud as the SIEM Provider, as Splunk uses the same HTTP Event Collector (HEC) log format used by Next-Gen SIEM.

  3. Paste your API key in Workspace Key.

  4. In EZSSH, paste your API URL in Splunk URL. It should look something like this.

    EZSSH with Advanced Settings Expanded showing Configuration for Next-GEN SIEM

  5. Click the Test Connection button, this will create a test log in Next-Gen SIEM to make sure EZSSH can write to Next-Gen SIEM.

  6. If the connection test was successful, click Save changes at the top of the page.

How To Create a CrowdStrike Falcon LogScale SIEM Data Connector

  1. In another tab, go to your CrowdStrike Falcon LogScale instance.

  2. Click on the Settings tab.

  3. Select the Ingest Tokens menu.

  4. Click on the Add Token button.

    Create Ingest Token in CrowdStrike Falcon LogScale

  5. Enter the token name.

  6. Assign the json parser and click Create.

    Create json parser in CrowdStrike Falcon LogScale

  7. Copy the token and the ingest host name.

    Copy the CrowdStrike Falcon LogScale token for EZSSH

How to Add Your LogScale Connection Details in EZSSH

  1. Go back to the EZSSH tab.

  2. Select CrowdStrike Falcon LogScale as the SIEM Provider.

    Set CrowdStrike Falcon LogScale as the SIEM in EZSSH

  3. Paste the ingest host name in the Ingestion Endpoint field.

  4. Paste the token in the Ingestion Token field.

  5. Click the Test Connection button, this will create a test log in LogScale to make sure EZSSH can write to LogScale.

    EZSSH Advanced Settings showing CrowdStrike Falcon LogScale SIEM configuration with Test Connection button highlighted

  6. If the connection test was successful, click Save changes at the top of the page.

    EZSSH Advanced Settings showing CrowdStrike Falcon LogScale SIEM configuration with Save Changes button highlighted