ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

ProxySG Datasource Stoped Reporting Audit Data after Upgrading PSG

book

Article ID: 224166

calendar_today

Updated On:

Products

CASB Audit

Issue/Introduction

CloudSOC Audit datasource for ProxySG stopped process after the PSG was upgraded.

Environment

ProxySG minimum supported version is SGOS 5.5.

Resolution

Verify the PSG log headers are correct per custom headers in the datasource.  Expected default headers are seen here in the CASB documentation. 

Fix the issue one with one of the following:

  • Adjusting the CloudSOC datasource custom headers to match the PSG configuration.
  • Change the PSG configuration to match what the CASB datasource expects.

Default header according to the documentation:

date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-username cs-auth-group s-hierarchy s-supplier-name rs(Content-Type) cs(User-Agent) sc-filter-result cs-category x-virus-id s-ip s-sitename r-ip

Check the datasource details in CloudSOC for custom header details.

To verify or change the PSG log configuration:

Attachments

Powered by Wolken Software