Broker VM

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Broker VM

L1 Bithead

Hi everyone

 

From the Ingest Logs from Elasticsearch Filebeat documentation, it mentioned "use the broker VM to proxy Filebeat communication". May I know how to configure the broker VM as proxy for Filebeat communication?

 

weejh_1-1635231084634.png

 

 

1 accepted solution

Accepted Solutions

Hi Weejh,

 

the screenshot you attached is the configuration of broker VM itself. If your broker vm doesnt have restriction going to internet then you dont need to configure the proxy server. But if your broker vm need proxy to go out then you need to configure this setting.

 

But back to your question on filebeat.

once you deploy and configure broker, you need to configure the local agent setting app on the broker.

Then once its activated, now you can use the broker ip and port in your filebeat configuration 

jcandelaria_0-1635534524666.png

 

View solution in original post

5 REPLIES 5

L3 Networker

Hi Weejh,

Basically you need to setup/configure the Broker VM first, (1st link below) then once you configure the Broker VM, then you can activate/configure the Local Agent Settings app inside the Broker VM (2nd link below)

1. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/...

2. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/...

 

 

Hi 

 

Thanks for your reply.

 

Yes, the broker VM is setup according to links you've shared. I guess the next step is "When using the broker VM, ensure that you activate the Local Agent Settings applet with the Agent Proxy  enabled."

 

May I know how validate that Agent Proxy is enabled?

 

L2 Linker

Click on gear icon (top right corner) --> configurations --> Broker VM list (left side) then select the deployed broker vm and should be able to see if you configured and activated it.

 

jcandelaria_0-1635449192270.png

 

 

Hi

 

Thanks for the reply.

 

from the screenshot, is this the proxy setup that we should use to proxy Filebeat communication?

 

If yes, what should be the address and port? 

 

weejh_1-1635496998323.png

 

Hi Weejh,

 

the screenshot you attached is the configuration of broker VM itself. If your broker vm doesnt have restriction going to internet then you dont need to configure the proxy server. But if your broker vm need proxy to go out then you need to configure this setting.

 

But back to your question on filebeat.

once you deploy and configure broker, you need to configure the local agent setting app on the broker.

Then once its activated, now you can use the broker ip and port in your filebeat configuration 

jcandelaria_0-1635534524666.png

 

  • 1 accepted solution
  • 3741 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!