This page explains how to configure SIEM integration when using ALog (On-Premises Edition).

Note: To integrate with TrustLogin, a plugin provided by Amiya Corporation is required.
　For details on installing ALog, obtaining the plugin, and other related information, please contact Amiya Corporation.

Note: If you are using ALog (Cloud Edition), please also contact Amiya Corporation for configuration instructions.

Configuration Steps

Preparation

1. On the TrustLogin side, please create a token.

2. Prepare the plugin installation file and extract it.

   
   Note: After extraction, the folder contains the following files.

   • diffgmotrustlogin.exe
   • diffgmotrustlogin.ini
   • AnyLogTemplate.GMO TrustLogin.Rev.1.xml
   • schtasks.cmd
   • schtasks.xml

   

Steps

1. On the host where ALog is installed, create the following folders.

   • C:\GMO TrustLogin
   • C:\GMO TrustLogin\bin

2. Copy the following files to the C:\GMO TrustLogin folder.
   • diffgmotrustlogin.ini
   • AnyLogTemplate.GMO TrustLogin.Rev.1.xml
   • schtasks.cmd
   • schtasks.xml
     
3. Copy the following file to the C:\GMO TrustLogin\bin folder.
   • diffgmotrustlogin.exe
     
4. Open C:\GMO TrustLogin\diffgmotrustlogin.ini in a text editor,
   and set the Token entry value in the [API] section to the token value you obtained in step 1 of Preparation.
   After configuring it, save the file and close the text editor.
   
   
   Note: Regarding the "AuditLog1stTimeDuration" value:
   　By default, this is configured to collect logs starting from one day before the first run. Please change this as needed.
   

5. Open Windows Command Prompt with Windows local administrator privileges, run the following command, and
   then close Windows Command Prompt.

   C:
   cd "\GMO TrustLogin"
   schtasks.cmd

   
   

6. Open the ALog Web Console and, from "Management > Import/Export Settings",
   import the GMO TrustLogin collection template (AnyLogTemplate.GMO TrustLogin.Rev.1.xml) that you copied in step 2.
   
   
   Note: Reference (external site)
   ALog User Guide - 5.15.2. Import
   
7. Register the target host in the ALog Web Console.
   Click the "Target Host > Add" button.
   
   
8. The "Add Target Host Wizard" opens.
   Click "Next."
   
   
9. On the "Select Log Type" screen, select "GMO TrustLogin (user)"
   and click "Next."
   
   

10. On the "Specify Host" screen, configure the following settings.

    • Enter any name (e.g., GMO TRUSTLOGIN) in "Host Name"
    • Uncheck "Check existence by ping"
    • Enter "JSON" in "Source Type"

    

    Click "Next."
    

11. On the "Log Collection Settings" screen, configure the following settings.

    • Select "Collect from local folder" for "Log Collection Method"
    • Enter "C:\GMO TrustLogin\output" in "Folder"
    • Enter "*.json" in "File Name"
    • Select "Delete" for "Delete collected files"

    

    Click "Next."
    
    

12. On the "Task Settings" screen, click "Next" while keeping the default settings.
    Note: With the default settings, the task runs once every hour. Please change the settings as needed.
    
    
13. On the "Mapping Settings - Input" screen, click "Next" while keeping the default settings.
    
    
14. On the "Mapping Settings - Output" screen, click "Next" while keeping the default settings.
    
    
15. The "Add Target Host Wizard Complete" screen is displayed.
    Check the contents, and if there are no issues, click the "Complete" button.
    
    
    Note: Reference (external site)
    ALog User Guide - 3.2. Registering a Target Host
    ALog User Guide - 3.2.10. Log Collection Settings for Other Systems
    

This completes the configuration work. Next, follow the steps below to check whether log collection is running.

Checking the Configuration

1. Launch Command Prompt with administrator privileges and enter the following command to open Task Scheduler.

   taskschd.msc 

2. From the Task Scheduler Library, select "Alog" and check whether the "GMO TrustLogin" task is enabled.
   If the status is "Disabled," right-click the "GMO TrustLogin" task and select "Enable" from the menu that appears.

Log Storage Location

Synchronized raw log data is automatically stored in the "output" folder inside the "GMO TrustLogin" folder that you created.