You can upload decryption keys and bind them to your account. The decryption keys are stored on syslog-ng Store Box(SSB), but they are only made available for this user account, and can also be protected (encrypted) with a passphrase.
To use persistent decryption keys
-
Select User menu > Private keystore. A pop-up window is displayed.
-
Select Permanent > 
, then select Certificate > 
. A pop-up window is displayed.
Figure 219: User menu > Private keystore — Adding decryption keys to the private keystore
-
Paste or upload the certificate used to encrypt the logstore.
-
Select Key > . A pop-up window is displayed.
-
Paste or upload the private key of the certificate used to encrypt the logstore.
-
Repeat Steps 2-5 to upload additional keys if needed.
-
Select Security passphrase > Change, and enter a passphrase to protect the private keys.
Figure 220: User menu > Private keystore — Securing the private keystore with a passphrase
-
Click Apply.
You can upload decryption keys to browse encrypted logspaces for the duration of the session only. These keys are automatically deleted when you log out from syslog-ng Store Box(SSB).
To use session-only decryption keys
-
Select User menu > Private keystore. A pop-up window is displayed.
-
Select Temporary > , then select Certificate > . A pop-up window is displayed.
Figure 221: User menu > Private keystore — Adding decryption keys to the private keystore
-
Paste or upload the certificate used to encrypt the logstore.
-
Select Key > . A pop-up window is displayed.
-
Paste or upload the private key of the certificate used to encrypt the logstore.
-
Repeat Steps 2-5 to upload additional keys if needed.
-
Click Apply.
You can add a private key (or set of keys) to a logstore, and use these keys to decrypt the logstore files. This way, anyone who has the right to search a particular logspace can search the messages. These decryption keys are stored unencrypted in the syslog-ng Store Box(SSB) configuration file.
As this may raise security concerns, avoid this solution unless absolutely necessary.
To assign decryption keys to a logstore
-
Navigate to Log > Logspaces and select the encrypted logspace you want to make searchable for every user via the SSB web interface.
-
Select Decryption private keys > . A pop-up window is displayed.
Figure 222: Log > Logspaces — Adding decryption keys to a logstore
-
Paste or upload the private key of the certificate used to encrypt the logstore.
-
Repeat Steps 2-3 to upload additional keys if needed.
NOTE: You need an additional key if the certificate used to encrypt a logstore expires. If this happens, you must upload a new certificate. However, to read the logstore encrypted with the old (expired) certificate(s), you must keep the old encryption key(s) with the new one.
-
Click 
.
The syslog-ng Store Box(SSB) appliance can create statistics from the Facility, Priority, Program, Pid, Host, Tags, and .classifier.class columns. Use Customize columns to add the required column, if necessary.
NOTE: The .classifier.class data is the class assigned to the message when pattern database is used. For details, see Classifying messages with pattern databases in the Administration Guide. The pattern databases provided by One Identity currently use the following message classes by default: system, security, violation, or unknown.
You can display statistics on the web interface, export the related data as CSV, and also save the statistics to include in a report.
