ProxySG Datasource Stoped Reporting Audit Data after Upgrading PSG
Article ID: 224166
Updated On:
Products
Issue/Introduction
CloudSOC Audit datasource for ProxySG stopped process after the PSG was upgraded.
Environment
ProxySG minimum supported version is SGOS 5.5.
Resolution
Verify the PSG log headers are correct per custom headers in the datasource. Expected default headers are seen here in the CASB documentation.
Fix the issue one with one of the following:
- Adjusting the CloudSOC datasource custom headers to match the PSG configuration.
- Change the PSG configuration to match what the CASB datasource expects.
Default header according to the documentation:
date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-username cs-auth-group s-hierarchy s-supplier-name rs(Content-Type) cs(User-Agent) sc-filter-result cs-category x-virus-id s-ip s-sitename r-ip
Check the datasource details in CloudSOC for custom header details.
To verify or change the PSG log configuration:
Attachments
Feedback
