找出 config.yaml 檔案。通常位於 Linux 的 /etc/bindplane-agent/ 目錄，或 Windows 的安裝目錄。
使用文字編輯器 (例如 nano、vi 或記事本) 開啟檔案。
按照下列方式編輯 config.yaml 檔案：
receivers:udplog:# Replace the port and IP address as requiredlisten_address:"0.0.0.0:514"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the path to the credentials file you downloaded in Step 1creds_file_path:'/path/to/ingestion-authentication-file.json'# Replace with your actual customer ID from Step 2customer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# Add optional ingestion labels for better organizationlog_type:'FORCEPOINT_CASB'raw_log_field:bodyingestion_labels:service:pipelines:logs/source0__chronicle_w_labels-0:receivers:-udplogexporters:-chronicle/chronicle_w_labels
視基礎架構需求，替換通訊埠和 IP 位址。
將 <customer_id> 替換為實際的客戶 ID。
將 /path/to/ingestion-authentication-file.json 更新為您在「取得 Google SecOps 擷取驗證檔案」部分儲存驗證檔案的路徑。
重新啟動 Bindplane 代理程式，以套用變更
如要在 Linux 中重新啟動 Bindplane 代理程式，請執行下列指令：
sudosystemctlrestartbindplane-agent
如要在 Windows 中重新啟動 Bindplane 代理程式，可以使用「服務」控制台，或輸入下列指令：
net stop BindPlaneAgent && net start BindPlaneAgent
下載 Forcepoint SIEM 工具
登入 Forcepoint CASB 管理入口網站。
依序前往「設定」>「工具和代理程式」>「SIEM 工具」。
點選「下載」即可下載名為 SIEM-Tool-\[operating system\]-\[release date\].zip 的 ZIP 檔案 (例如 SIEM-Tool-Windows-2021-10-19.zip)。視下載版本而定，ZIP 檔案會包含下列其中一個檔案：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-10 (世界標準時間)。"],[],[],null,["# Collect Forcepoint CASB logs\n============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest Forcepoint CASB (Cloud Access Security Broker)\nlogs to Google Security Operations using Bindplane. The parser extracts fields from\nForcepoint CASB syslog messages formatted with CEF. It uses Grok to parse the\nmessage, KV to separate key-value pairs, and conditional logic to map extracted\nfields to the Unified Data Model (UDM), handling various event types and\nplatform specifics.\n\nBefore you begin\n----------------\n\nMake sure you have the following prerequisites:\n\n- Google SecOps instance\n- A Windows 2016 or later, or a Linux host with `systemd`\n- If running behind a proxy, firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open\n- Privileged access to Forcepoint CASB\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane will be installed.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall the Bindplane agent\n---------------------------\n\nInstall the Bindplane agent on your Windows or Linux operating system according\nto the following instructions.\n\n### Windows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\n### Linux installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\n### Additional installation resources\n\nFor additional installation options, consult the [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure the Bindplane agent to ingest Syslog and send to Google SecOps\n------------------------------------------------------------------------\n\n1. Access the configuration file:\n - Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n - Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n udplog:\n # Replace the port and IP address as required\n listen_address: \"0.0.0.0:514\"\n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the path to the credentials file you downloaded in Step 1\n creds_file_path: '/path/to/ingestion-authentication-file.json'\n # Replace with your actual customer ID from Step 2\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # Add optional ingestion labels for better organization\n log_type: 'FORCEPOINT_CASB'\n raw_log_field: body\n ingestion_labels:\n\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - udplog\n exporters:\n - chronicle/chronicle_w_labels\n\n - Replace the port and IP address as required in your infrastructure.\n - Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n - Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/forcepoint-casb#get-auth-file) section.\n\nRestart the Bindplane agent to apply the changes\n------------------------------------------------\n\n1. To restart the Bindplane agent in **Linux**, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n2. To restart the Bindplane agent in **Windows** , you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nDownload the Forcepoint SIEM tool\n---------------------------------\n\n1. Sign in to the **Forcepoint CASB** management portal.\n2. Go to **Settings \\\u003e Tools and Agents \\\u003e SIEM Tool**.\n3. Click **Download** to download a zip file named `SIEM-Tool-\\[operating system\\]-\\[release date\\].zip` (for example, `SIEM-Tool-Windows-2021-10-19.zip`). The zip file contains one of the following files, depending on the version you download:\n - `SIEMClient.bat` (if you downloaded the Windows tool)\n - `SIEMClient.sh` (if you downloaded the Linux tool)\n\nInstall the SIEM tool\n---------------------\n\n| **Note:** The SIEM tool requires that Java v1.8 or higher be installed before completing these steps.\n\nFor secure connection of the SIEM tool to the Forcepoint CASB service,\nthe tool requires the trust store file that can be downloaded from the Forcepoint\nCASB management portal. Follow these steps:\n\n1. Sign in to the **Forcepoint CASB** management portal.\n2. Go to **Settings \\\u003e Tools and Agents \\\u003e SIEM Tool**.\n3. Click **Download Trust Store**.\n4. Save the downloaded trust store file in a location that the SIEM tool can access after it's installed.\n5. Extract the **SIEM tool** archive on a host that has **Java v1.8 or higher** installed and can access the organizational Forcepoint CASB management server.\n6. Open a command prompt, go to the location of the **SIEMClient** files, and run the following command:\n - Windows: `SIEMClient.bat --set.credentials ---username \u003cuser\u003e --password \u003cpassword\u003e --credentials.file \u003cfile\u003e`\n - Linux: `SIEMClient.sh --set.credentials ---username \u003cuser\u003e --password \u003cpassword\u003e --credentials.file \u003cfile\u003e`\n7. Provide the following configuration parameters:\n - `\u003cuser\u003e` and `\u003cpassword\u003e`: Forcepoint CASB administrator credentials. Optionally, if you omit the --username and --password arguments, you will be prompted to provide them interactively.\n - `\u003cfile\u003e`: Path and filename for the credentials store.\n8. Run the SIEM tool from the command prompt: `\u003ctool\u003e --credentials.file \u003cfile\u003e --host \u003chost\u003e --port \u003cport#\u003e --output.dir \u003cdir\u003e [ truststorePath=\u003ctrust\u003e ] [ exportSyslog=true syslogHost=\u003cbindplaneAgentIP\u003e syslogFacility=\u003cfacility\u003e ] [ cefVersion=\u003ccef.version\u003e ] [ cefCompliance=\u003ccef.flag\u003e ] [ --proxy.host \u003cproxy.host\u003e ] [ --proxy.port \u003cproxy.port\u003e ]`\n9. Provide the following configuration parameters:\n - `\u003ctool\u003e`: On **Windows** : `SIEMClient.bat`, On **Linux** : `SIEMClient.sh`.\n - `\u003cfile\u003e`: Path and filename of the credentials store.\n - `\u003chost\u003e` and `\u003cport#\u003e`: Connection details to the Forcepoint CASB management server. Port is usually 443.\n - `\u003cdir\u003e`: Directory where the SIEM tool saves the produced activity files. Required even if pushing to syslog.\n - `\u003ctrust\u003e`: Path and filename of the trust store file downloaded previously.\n - `\u003cbindplaneAgentIP\u003e`: IP address of the Bindplane agent.\n - `\u003cfacility\u003e`: Enter **local1**.\n - `\u003ccef.version\u003e`: Set the version of CEF to **2** .\n - If cefVersion=1, the tool uses the legacy CEF format.\n - If cefVersion=2, the tool uses the true CEF format.\n - If cefVersion=3, the tool uses a newer version of CEF that supports the new activities columns (Target, Message, and Properties).\n - If the cefVersion parameter is included in the command, the tool ignores the cefCompliance parameter.\n - If the cefVersion parameter is omitted from the command, the tool uses the cef Compliance parameter.\n - `\u003ccef.flag\u003e`: Enable the **true** CEF format.\n - If cefCompliance=true, the tool uses the true CEF format.\n - If cefCompliance=false, the tool uses the legacy CEF format.\n - If the parameter is omitted from the command, the value defaults to false and the tool uses the legacy CEF format.\n - `\u003cproxy.host\u003e` and `\u003cproxy.port\u003e`: Connection details to the proxy server if connecting to the Forcepoint CASB management server through a proxy server.\n\nUDM mapping table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
