ProxySG Datasource Stoped Reporting Audit Data after Upgrading PSG

Products

• CASB Audit

Issue/Introduction

CloudSOC Audit data source for ProxySG stopped process after the PSG was upgraded.

Environment

ProxySG minimum supported version is SGOS 5.5.

Resolution

Verify the PSG log headers are correct per custom headers in the data source.  Expected default headers are seen here in the CASB documentation. 

Fix the issue one with one of the following:

• Adjusting the CloudSOC data source custom headers to match the PSG configuration.
• Change the PSG configuration to match what the CASB data source expects.

Default header according to the documentation:

date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-username cs-auth-group s-hierarchy s-supplier-name rs(Content-Type) cs(User-Agent) sc-filter-result cs-category x-virus-id s-ip s-sitename r-ip

Check the Datasource Details in CloudSOC for custom header details.

To verify or change the PSG log configuration: