Configure TCP over TLS Log Forwarding to the CCE (SSL Certificate and Key Creation)

Table of Contents

• Overview
• Prerequisites
• SSL Certificate and Key Creation
• Configuring CCE for TCP over TLS
  • A. If LTS is Enabled (CCE Logs Manager)
  • B. If LTS is Not Enabled (CCE Logs Processor)
• Troubleshooting (TCP 514 Issues)
• Verification (MSSP Only)
  • From ADR UI
  • From CCE CLI

Overview

This article explains how to configure encrypted log forwarding from devices to the ADR CCE (Collection and Control Engine) using TCP over TLS.

By default, syslog traffic uses UDP 514 or TCP 514 in plaintext. Enabling TLS encryption ensures confidentiality, integrity, and authenticity of log data during transit between devices and the ADR platform.

Prerequisites

Before starting, ensure:

• Administrator access to the CCE server.

• Basic knowledge of Linux commands.

• TCP port 514 (or alternative TLS-enabled port) is open between devices and the CCE.

• No conflicting syslog service (e.g., rsyslog) running on CCE.

SSL Certificate and Key Creation

On the CCE server, generate a self-signed certificate and key:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout logserver.key -out logserver.crt

You will be prompted to provide the following information:

1. Country Name (2-letter code): US

2. State or Province Name: New York

3. Locality Name: New York City

4. Organization Name: Bouncy Castles, Inc. (example)

5. Organizational Unit Name: IT Security

6. Common Name: Use the CCE FQDN or IP address

7. Email Address: admin@your_domain.com

This generates two files:

• logserver.crt → Certificate

• logserver.key → Private Key

Store them securely under /home/seceon/ for device configuration.

Ref: https://www.logzilla.net/configuring-tls-tunnels-in-syslog-ng.html

Configuring CCE for TCP over TLS

A. If LTS is Enabled (CCE Logs Manager)

1. Enter the Logs Manager container:

   otmdoc -s cce-logs-manager

2. Edit the syslog configuration file:

   vi /docker/config/syslog_base_var.yml

   Update:

   tcp_over_tls: true

3. Restart the container:

   otmdoc -r cce-logs-manager

4. Navigate to certificates folder:

   cd syslog/config/
   ls

   You should see the .crt and .key files. Copy them to /home/seceon for device-side use.

B. If LTS is Not Enabled (CCE Logs Processor)

1. Enter the Logs Processor container:

   otmdoc -s cce-logs-processor

2. Edit the Logstash configuration file:

   vi /docker/config/logstash_base_var.yml

   Update:

   tcp_over_tls: true

3. Restart the container:

   otmdoc -r cce-logs-processor

4. Navigate to certificates folder:

   cd logstash/config/
   ls

   You should see the .crt and .key files. Copy them to /home/seceon for device-side use.

Troubleshooting (TCP 514 Issues)

If TCP traffic is not reaching the CCE server:

1. Verify if another application is already listening on port 514:

   sudo lsof -i :514

2. If rsyslog or another service is bound to port 514, disable it:

   sudo systemctl stop rsyslog
   sudo systemctl disable rsyslog

3. Restart the respective CCE container and test again.

Verification (MSSP Only)

From ADR UI

1. Log in to ADR dashboard.

2. Navigate: System → Logs and Flows Collection Status.

3. Confirm that the Source Device IP appears and logs are ingested.

From CCE CLI

Run:

sudo tcpdump -i any port 514 -s0 -vvv

You should see incoming encrypted logs from the configured devices.