Skip to main content

Site CollectorSite Collector Administration Guide

Set Up MySQL Collector

If you use MySQL Relational Database Management Systems (RDBMS), set up the MySQL collector to pull logs from your RDBM sources. The MySQL collector is a set of Site Collector flows, pre-built processors, groups, custom processors, other components, and integrations that pull logs in JSON format from your databases and push the logs to Exabeam Security Operations Platform.

To set up a MySQL collector:

  1. Log in to the Exabeam Security Operations Platform with your registered credentials.

  2. Navigate to Collectors > Site Collectors.

  3. Ensure that Site Collector is installed and in running state.

  4. On the Site Collector page, click the Collectors Library tab, then click MySQL.

    My_SQL_1.png

  5. In the Definition section, enter the following required information.

    My_SQL_3_1.png

    • Collector Name – Specify a name for the MySQL collector.

      Note

      Ensure that you specify different names for Site Collector instance and the collector.

    • Site Collector Instance – Select the site collector instance for which you want to set up the MySQL collector.

    • MySQL Hostname or IP – Enter the hostname or IP address of the MySQL database server from which you want the MySQL collector to pull logs.

    • Port – Enter the port number of your MySQL server.

    • Database – Enter the database name of the destination.

  6. Click Next.

  7. In the Authentication section, enter the username and password of an existing database user of your MySQL server, for establishing the connection with the MySQL source.

    My_SQL_4_2.png

  8. Click Next.

  9. In the Data section, enter the required information as follows.

    My_SQL_5.png

    • Fetch Interval – Select the time interval within which you want the MySQL collector to pull logs. For example: 30 sec, 1 min, 2 min, 3 min, 4 min, and 5 min.

    • Search Query – Enter the details for following fields:

      • Iterator Column – Enter the value that will be used for incremental data pull. Ensure that the column value is unique, and is returned in the query result set.

      • Iterator column initial value – Enter the value for the initial data pull. Use the iterator column initial value to pull historical data.

      • Query – Enter the MySQL query to specify the type of data that you want the collector to pull.

        For example: To fetch logs from the MySQL database, use the following query.

        SELECT *
FROM <table>
WHERE 1=1

        The Iterator column value must be returned as a uniquely named column in the dataset. If you use joins, use AS to specify a rename for the iterator. For example:

        Select table1.id as iterator, table2.id, table2.value from table1 join table2 on table1.id = table2.fk where table2.value > 0

    • Query Preview – View the preview of the query that you enter.

  10. Click Setup.

    The MySQL collector is set up and is ready to pull logs from your MySQL database.

    After the MySQL collector is set up, Site Collector Core starts pulling logs periodically based on the query entered by the user and uploads logs to Exabeam Security Operations Platform. If the MySQL database is not available, Site Collector core resumes pulling logs from the place where it stopped.

    Note

    BLOB fields collection is not supported.

    In case of installation failure, the collector is disabled, and the configuration is saved. You can check the status of the collector by accessing the user interface or by using the support package.