Export logs for Machine Learning Service API interactions

1. Generate a server certificate for the HTTP server.

   Note:

   If you already have a certificate, you can skip this step.

   1. Run the following command to generate the certificate authority (CA) key:

      openssl genrsa -aes256 -out serverca.key 4096

      Copy
   2. Run the following command to generate the CA certificate:

      openssl req -new -key serverca.key -x509 -out serverca.crt -days 3650

      Copy
   3. Run the following command with your variables to generate a certificate signing request:

      openssl req -new \
          -nodes \
          -newkey rsa:4096 \
          -keyout server.key \
          -out server.req \
          -batch \
          -subj "/C=US/ST=WA/L=Seattle/O=ORGANIZATION_NAME/OU=router/CN=SERVER_URL" \
          -reqexts SAN \
          -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:SERVER_URL,IP:SERVER_IP_ADDRESS"))

      Copy

      Replace the following variables in the command above:

      SERVER_IP_ADDRESS: The IP address of your server.

      SERVER_URL: The URL of your server.

      ORGANIZATION_NAME: The name of your organization.

   4. Run the following command with your variables to generate the server certificate:

      openssl x509 -req \
          -in server.req \
          -CA serverca.crt \
          -CAkey serverca.key \
          -CAcreateserial \
          -out server.crt \
          -days 3650 \
          -sha256 \
          -extfile <(printf "subjectAltName=DNS:SERVER_URL,IP:SERVER_IP_ADDRESS")

      Copy

      Replace the following variables in the command above:

      SERVER_IP_ADDRESS: The IP address of your server.

      SERVER_URL: The URL of your server.

   5. Run the following command to create a certificate in a format that you can upload to the sensor or console.

      cat server.key server.crt serverca.crt > trusted-server.pem

      Copy
2. Go to the ExtraHop code-examples GitHub repository and download the ml_api_logger/ml_api_logger.go file to your local machine.
3. Run the following command, replacing CERT_PATH with the path of the TLS certificate you generated for the server:

   export LOGGER_CERT=CERT_PATH

   Copy
4. Run the following command, replacing KEY_PATH with the path of the key you signed the certificate with:

   export LOGGER_KEY=KEY_PATH

   Copy
5. Run the following command, replacing PORT with the port that the server listens on:

   export LOGGER_PORT=PORT

   Copy
6. Restrict the logger to only receive packets on a specific server IP address.
   By default, the Go application receives logs on all IP addresses configured for the server. To restrict the application to a single IP address, run the following command, replacing IP with the IP address:

   export LOGGER_IP=IP

   Copy
7. In the ml_api_logger directory, run the following command to compile the Go code:

   go build ml_api_logger.go

   Copy
8. Run the following command to start the server and save the API logs to extrahop-ade-log.json:

   ml_api_logger > extrahop-ade-log.json

   Copy

You must configure the sensor or console to export logs to the server you configured.

1. Log in to the Administration settings on the sensor or console through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Appliance Settings section, click Running Config.
3. Click Edit config.
4. In the hop_cloud section, add an entry where the key is api_logging_target and the value is an object with the following fields:

   enabled: Boolean

   Specifies whether API interaction logging is enabled. Specify true.

   hostname: String

   The hostname of the server you configured to receive API interaction logs.

   port: Number

   The port that the third-party server is listening on.

   The updated hop_cloud section should look similar to the following JSON:

      "hopcloud": {
           "api_logging_target": {
               "enabled": true 
               "hostname": "example.extrahop.com"
               "port": 100
           }
           "analysis_settings": {}
       }

   Copy