Using Blumira HTTP Ingestion

Overview

You can integrate log sources that support HTTP directly with Blumira using Blumira HTTP Ingestion. This method streamlines the process by removing the need for a local Ubuntu sensor or an API-polling Cloud Connector. HTTP Ingestion uses Blumira’s Cloud Ingest API, which provides a unique HTTPS endpoint for your organization to send structured logs in either JSON or RAW format.

Most Blumira editions have no limit to the number of HTTP integrations you can add. However, the following restrictions apply:

• Detect Lite, Respond Core, and SIEM Core editions have a limit of one ingestion source
• M365 Edition accounts do not include access to any HTTP logging

Before you begin

Before configuring any log source for outbound HTTP log streaming, you must generate your unique Blumira ingestion credentials by doing the following:

1. In the app, navigate to Ingestion > HTTP Ingestion.
2. Click Add Ingestion Instance.
3. In the Add Ingestion Instance window, do the following:
   1. In Vendor, select Universal Ingestion Source (JSON) or Universal Ingestion Source (RAW).
   2. In Vendor Name for Universal Ingestion Source, type the vendor’s name using only lowercase letters and hyphens, which ensures we can easily match the name in the future to a supported parser if and when it becomes available.
      Example: If integrating with Bitdefender, type “bitdefender” and this will create the service URL required for the Bitdefender HTTP log integration.
   3. (Optional) In Ingestion Instance Name, edit the pre-populated name.
       
   4. (Optional) In Description, type a description that provides context for this instance being created.
   5. Click Save.

4. In the Credentials window, copy and save each credential to use in your vendor integration. Keep this window open so you can paste values into the vendor’s site.

   Important: You must copy the token before you close the window. You will not be able to see the token again after you close the window.

   

Integrating with an HTTP log source

Blumira supports log ingestion from any source capable of transmitting JSON or RAW logs via HTTP. However, parsing is not yet available for every vendor. Review the list of supported and parsed HTTP integrations in the app, and find specific instructions for each in the Blumira HTTP Ingestion section of the support site. Parsed HTTP integrations currently include the following:

• Bitwarden

• Cloudflare

• DNSFilter

• GitHub Enterprise

• Keeper Security

• KnowBe4 PhishER

• KnowBe4 KMSAT

• LastPass

• Ping Identity

To integrate with a vendor that supports HTTP log forwarding using the Universal Ingestion option, review that vendor’s integration instructions, as each vendor has different requirements.

Here are some common Blumira log integrations that support HTTP forwarding:

• Bitdefender GravityZone
• Falco Alerts
• Heroku AI PaaS
• Jamf
• Sentry
• Sonicwall Cloud Secure Edge
• Tailscale
• Tanium
• Zoho

Managing HTTP Ingestion integrations

After configuring a new integration, you can manage log failure notifications, update your tokens, and delete individual ingestion instances if you no longer need them.

Managing notifications

New HTTP integrations automatically include the option to receive notifications when an ingestion instance stops collecting logs for more than four hours. However, users must set their personal delivery method options to receive those alerts. If you see a "No delivery method is configured" note, navigate to Notification Settings > "Monitored ingestion sources stopped sending logs..." to select how you want to receive ingestion failure notifications.

To disable notifications, do the following:

1. In the app, navigate to Ingestion > HTTP Ingestion.
2. Click the name of the instance you want to disable notifications for.
3. Next to Notifications, slide the switch to the "off" position.

To enable notifications, do the following:

1. In the app, navigate to Ingestion > HTTP Ingestion.
2. Click the name of the instance you want to enable notifications for.
3. Next to Notifications, slide the switch to the “on” position.
4. If you see a “No delivery method is configured” note, navigate to Notification Settings to configure log alerts.

Managing tokens

You can generate a new token in the app to reset the connection between Blumira and the vendor.

To generate a new token, do the following:

1. In the app, navigate to Ingestion > HTTP Ingestion.
2. Click the name of the instance you need to generate a new token for.
3. Under Tokens, click +Generate Token.

To delete a token, do the following:

1. Click Delete next to the respective token.
2. In the Delete Active Token window, click Confirm.

Deleting an ingestion instance

To delete an ingestion instance, do the following:

1. In the app, navigate to Ingestion > HTTP Ingestion.
2. In the instance’s row, click More actions.
3. Click Delete.
4. In the Delete HTTP instance window, click Confirm.

You can also delete an instance in its details page by doing the following:

1. In the app, navigate to Ingestion > HTTP Ingestion.
2. Click the name of the instance you need to delete.
3. Click Delete.
4. In the Delete HTTP instance window, click Confirm.