LogicMonitor

nile has added support for integration with logicmonitor logicmonitor is a hybrid observability platform that is used by enterprises to monitor anything from cloud services to network infrastructure in a 2024 g2 report https //www logicmonitor com/resource/compare the top network monitoring software , logicmonitor has been placed in the leader's quadrant traditionally, network monitoring relied on snmp, logs, events, cli of the network infrastructure however, in the case of nile, since it is offered as a service, the approach taken is to export synthesized events to the logicmonitor from the nile cloud the following events are sent to the logicmonitor end user device events this includes all the events seen on the device details page of the customer’s nile portal for e g device connection/disconnection, authentication pass/fail, dhcp pass/fail, and several more service related alerts includes all the alerts that are seen today under the alerts section of the control center (nile portal), which includes service, infrastructure (customer’s dhcp, radius, dns), security and application monitoring related alerts, including nile infrastructure related alerts audit trail any action taken by a user inside the nile portal, such as modifying settings nile leverages the logicmonitor’s generic log ingestion feature a secure https based connection is created between the nile cloud and the logicmonitor instance using lm’s access key and access code which is generated from within lm’s settings and provided in the integration settings screen settings logicmonitor settings url this is the logicmonitor instance url that has been provided to the customer in this example we’ll use please note the url is unique to a customer logicmonitor hosted monitoring system https //nile logicmonitor com/santaba access code and access key the customer has to log into their lm instance and navigate to the screen below settings > users and roles > api tokens nile uses the lmv1 token add a new lmv1 token using the add button enter the required details and an access id and access key will be generated copy those and store them in a text file important the access key is displayed only once, so be sure to copy it on this screen the customer may choose to use an existing user or create a separate use specifically for api access the users can be created under the users tab in the lm nile settings navigate to the new integrations screen global settings > integrations and '+' a new integration add logicmonitor input the url, access id and access key that has been generated from logicmonitor provide a name to this integration on the top field so its easy to identify it later resource id map resource maps to the component that generated the log so we create a "nile" resource in logicmonitor and give the resource id of "nile" resource in the configuration so all the logs nile sends have this resource id and logicmonitor automatically maps into the "nile" resources this makes it easier for searching, grouping, etc for example if a customer creates a resource called ‘nile access service’ inside logicmonitor, they have to note what value the lm assigned to the resource nile access service, lets assume 1 in the rsources tab in logicmonitor, click the resource and it will show below you can use resource attribute as "system deviceid" or "system devicegroupid" and the resource value would be the value shown in the table in this case it would be 1 or 17 ⚠️note nile currently supports only one siem integration at a time and the 'name' of the siem that is added needs to be named as 'default' if you add additional siems, only one will be active at any point in time on the next screen, select the topics to subscribe to nile supports sending end device events, alerts and audit events to logicmonitor today testing capability once the logicmonitor instance is integrated successfully, it appears as below there is an ability to ‘test’ the connection to logicmonitor from the nile cloud and the logicmonitor widget will display the time and status once a successful connection is ensured, the events, alerts and audit can be verified in logicmonitor under the logs tab