Site CollectorSite Collector Administration Guide

Collectors use digital security certificates to create safe and encrypted connections with Site Collector. These certificates are subject to expiration and require periodic renewal. Collector security certificates are issued and managed by Site Collector, not by individual collectors. Renewals are performed on the Site Collector via Certificate Rotation on the New-Scale Security Operations Platform or by a Site Collector administrator.

Once the Site Collector acquires new certificates, each individual collector updates automatically by having its management agent check the certificate status every six hours. If the certificates are within seven days of expiration, or have expired, or if the certificate authority changes, the agent automatically downloads the current certificates. The agent then installs these certificates, performs a brief collector restart, and restores the previous certificates automatically if the new ones fail validation. Finally, if the Site Collector is unreachable or has not been renewed, the collector continues to operate with its existing certificates and retries the update periodically.

The Site Collector version 2.3 enables you to start an automated process for updating the security certificates, hence upgrade the Site Collector instance to version 2.3 or later.

It is recommended to upgrade Windows Event Log Collector, Windows File Collector, and the Windows Archive Collector to version 2.3 or later before starting with the certificate refresh process.

Use the following steps to start the certificate refresh process.

If you use the Site Collector version 2.2, use the following steps to set auto certificate refresh. Ensure that Site Collector instance status is 'Running'.

If you use the Site Collector version 2.2, use the following steps to regenerate TLS certificates.

sudo ./ngsccli certificate regenerate --newca=false

sudo ./ngsccli certificate upload

Use the following CLI to stop, regenerate, and restart, and automatically disable hardening for 24 hours for agent collectors to pull the new certificate.

sudo ./ngsccli certificate orchestrate

Site Collector Core (Nifi) generates security certificates for secure communication. When security certificates expire, all connected agent collectors including Windows Event Log Collector, File, and other log forwarders will fail TLS verification and cease communication with the Site Collector.

To avoid disrupting collector operation, refresh the SSL/TLS certificates by using the following steps.

cd /opt/exabeam/bin
sudo ./ngsccli certificate orchestrate

cd /opt/exabeam/bin
sudo ./ngsccli sitecollector stop
sudo ./ngsccli certificate regenerate
sudo ./ngsccli sitecollector start

sudo /opt/exabeam/bin/ngsccli sitecollector harden --off

sudo /opt/exabeam/bin/ngsccli sitecollector harden

sudo /opt/exabeam/nifi/nifi_scripts/regenerate_certificate.sh

The primary and recommended method for certificate recovery is through the user interface. Use the following method only as a fallback option.

The collcli certupdate command retrieves and installs the latest certificates from the Site Collector. This command is aimed at certificate-specific recovery and not at a comprehensive installation validation.

Following are some examples of the collcli certupdate command usage.

# Update certificates for a single collector
collcli certupdate --collector-type lfc

# Update certificates for all installed collectors on a host
collcli certupdate --all

# Force retrieval of a fresh certificate bundle
collcli certupdate --collector-type lfc --refetch-certs

Use the collcli certupdate command in case of the following scenario.

Use the collcli certupdate command to complete the following tasks.

Scenario 1: If the regenerate_certificate script at /opt/exabeam/nifi/nifi_scripts/regenerate_certificate.sh fails because of incompatibility of specific CURL versions with Site Collector Core (Nifi) API, modify the script on your VM by updating the generate_nifi_token() function as follows.

generate_nifi_token() {
  NIFI_WEB_UI_TOKEN=$(curl --silent $TLS_FLAG $CIPHERS_FLAG $CURVES_FLAG --fail -XPOST -k "$NIFI_API/access/token" -H "Content-Type: application/x-www-form-urlencoded" -d "username=$SINGLE_USER_CREDENTIALS_USERNAME&password=$SINGLE_USER_CREDENTIALS_PASSWORD" 2>&1)
  NIFI_VERSION="2.0.0-SNAPSHOT"
        
  return 0
}

Save the changes to generate and upload a new certificate, then restart your Site Collector instance.

Scenario 2: The regenerate_certificate.sh restarts Site Collector core. However if the certificate is already expired, restarting Site Collector core fails. In this case, restart the Nifi service using systemctl restart exabeam-ngsc.