This document explains how to collect Micro Focus NetIQ Access Manager logs to Google Security Operations using Bindplane. Micro Focus NetIQ Access Manager is an identity and access management (IAM) solution designed to secure applications and data by providing centralized authentication, authorization, and single sign-on (SSO) capabilities.
Before you begin
Ensure that you have a Google Security Operations instance.
Ensure that you are using Windows 2016 or later, or a Linux host with systemd.
If running behind a proxy, ensure firewall ports are open.
Ensure that you have privileged access to NetIQ Access Manager.
Get Google SecOps ingestion authentication file
Sign in to the Google SecOps console.
Go to SIEM Settings > Collection Agents.
Download the Ingestion Authentication File. Save the file securely on the
system where Bindplane will be installed.
Get Google SecOps customer ID
Sign in to the Google SecOps console.
Go to SIEM Settings > Profile.
Copy and save the Customer ID from the Organization Details section.
Install the Bindplane agent
Windows installation
Open the Command Prompt or PowerShell as an administrator.
Configure the Bindplane agent to ingest Syslog and send to Google SecOps
Access the configuration file:
Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
Open the file using a text editor (for example, nano, vi, or Notepad).
Edit the config.yaml file as follows:
receivers:tcplog:# Replace the port and IP address as requiredlisten_address:"0.0.0.0:5252"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the path to the credentials file you downloaded in Step 1creds:'/path/to/ingestion-authentication-file.json'# Replace with your actual customer ID from Step 2customer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# Add optional ingestion labels for better organizationingestion_labels:log_type:SYSLOGnamespace:netiq_accessraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-tcplogexporters:-chronicle/chronicle_w_labels
Replace the port and IP address as required in your infrastructure.
Replace <customer_id> with the actual customer ID.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis guide outlines how to collect Micro Focus NetIQ Access Manager logs and send them to Google Security Operations using Bindplane.\u003c/p\u003e\n"],["\u003cp\u003ePrerequisites include having a Google Security Operations instance, Windows 2016+ or Linux with \u003ccode\u003esystemd\u003c/code\u003e, open firewall ports, and privileged access to NetIQ Access Manager.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves obtaining a Google SecOps ingestion authentication file and customer ID, installing the Bindplane agent on either Windows or Linux, and configuring the agent to ingest Syslog.\u003c/p\u003e\n"],["\u003cp\u003eNetIQ Access Manager's Identity Server, Access Gateway, and Logging Server must be configured to forward audit events to Bindplane, using either TCP or UDP.\u003c/p\u003e\n"],["\u003cp\u003eThe feature is covered by the Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms.\u003c/p\u003e\n"]]],[],null,["Collect Micro Focus NetIQ Access Manager logs \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to collect Micro Focus NetIQ Access Manager logs to Google Security Operations using Bindplane. Micro Focus NetIQ Access Manager is an identity and access management (IAM) solution designed to secure applications and data by providing centralized authentication, authorization, and single sign-on (SSO) capabilities.\n\nBefore you begin\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to NetIQ Access Manager.\n\nGet Google SecOps ingestion authentication file\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane will be installed.\n\nGet Google SecOps customer ID\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall the Bindplane agent\n\nWindows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\nLinux installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\nAdditional installation resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure the Bindplane agent to ingest Syslog and send to Google SecOps\n\n1. Access the configuration file:\n\n 1. Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n 2. Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the port and IP address as required\n listen_address: \"0.0.0.0:5252\"\n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the path to the credentials file you downloaded in Step 1\n creds: '/path/to/ingestion-authentication-file.json'\n # Replace with your actual customer ID from Step 2\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # Add optional ingestion labels for better organization\n ingestion_labels:\n log_type: SYSLOG\n namespace: netiq_access\n raw_log_field: body\n\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/netiq-am#get-auth-file) section.\n\nRestart the Bindplane agent to apply the changes\n\n- To restart the Bindplane agent in Linux, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- To restart the Bindplane agent in Windows, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Identity Server audit events in NetIQ Access Manager\n\n1. Sign in to the NetIQ administration console.\n2. Select **Devices \\\u003e Identity server \\\u003e Servers \\\u003e Edit \\\u003e Auditing and logging**.\n3. For **Audit logging** , select **Enabled**.\n4. To audit all events, select **Select All**.\n5. Click **Apply \\\u003e OK**.\n6. Click **Servers \\\u003e Update servers**.\n\nConfigure Access Gateway audit events in NetIQ Access Manager\n\n1. Sign in to the NetIQ administration console.\n2. Go to **Devices \\\u003e Access gateways \\\u003e Edit \\\u003e Auditing**.\n3. Click **Select All**.\n4. Click **OK \\\u003e OK**.\n5. On the **Access gateways** page, click **Update**.\n\nConfigure Logging Server in NetIQ Access Manager\n\n1. Sign in to the NetIQ administration console.\n2. Click **Auditing**.\n3. Specify the following details:\n\n | **Note:** The log file option is not recommended for production use.\n - **Audit messages using syslog**: select this option to send audit events to the audit server.\n - **Stop service on audit server failure**: leave blank.\n - **Server listening address** : enter **Bindplane** IP Address.\n - **Port** : specify the syslog port used to connect to **Bindplane**.\n - **Format** : select **CSV**.\n - **Management console audit events** : select **All**.\n4. If syslog is selected for auditing, do the following:\n\n 1. In `nam.conf`, change the `SYSLOG_DAEMON` value to `rsyslog`. This changes the default syslog daemon to `rsyslog`.\n 2. To edit the `Auditlogging.cfg` file and set both `SERVERIP` and `SERVERPORT` macros as empty, run the following:\n\n LOGDEST=syslog\n FORMAT=JSON\n SERVERIP=\n SERVERPORT=\n\n5. To configure UDP, run the following:\n\n #$ModLoad imtcp # load TCP listener\n $InputTCPServerRun 1290\n $template ForwardFormat,\"\u003c%PRI%\u003e%TIMESTAMP:::date-rfc3164% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\\n\"\n $ModLoad imudp\n local0.* @FORWARDERIP:\u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e;ForwardFormat\n\n | **Note:** If Audit logs are being forwarded to the remote Bindplane server IP and port using UDP. Replace `{\"\u003cvar\u003e\"}}PORT_NUMBER` with the port number of Bindplane.\n6. Restart the `rsyslog` service.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
