Collect Nyansa Voyance / VMware Edge Network Intelligence logs

Supported in:

This document explains how to ingest Nyansa Voyance (VMware Edge Network Intelligence) logs to Google Security Operations using Bindplane.

Nyansa Voyance, now known as VMware Edge Network Intelligence (ENI), is a network analytics and IoT security platform that provides visibility into client access, network services, IoT devices, and enterprise applications. The platform collects data from wireless controllers, switches, and network devices to analyze user experience, application performance, and device behavior across wired and wireless networks.

Before you begin

Make sure you have the following prerequisites:

  • A Google SecOps instance
  • Windows Server 2016 or later, or Linux host with systemd
  • Network connectivity between the Bindplane agent and your Nyansa Voyance / VMware Edge Network Intelligence instance
  • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
  • Access to the VMware SD-WAN Orchestrator portal with Enterprise Admin privileges
  • Nyansa Voyance GraphQL API v2 access token
  • Java 1.8 or above installed on a Linux or macOS system to run the Nyansa SIEM syslog agent
  • At least 2GB of free memory for the Java Virtual Machine (JVM)

Get Google SecOps ingestion authentication file

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Collection Agents.

  3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Profile.

  3. Copy and save the Customer ID from the Organization Details section.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

  1. Open Command Prompt or PowerShell as an administrator.

  2. Run the following command:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. Wait for the installation to complete.

  4. Verify the installation by running:

    sc query observiq-otel-collector

    The service should show as RUNNING.

Linux installation

  1. Open a terminal with root or sudo privileges.

  2. Run the following command:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

  3. Wait for the installation to complete.

  4. Verify the installation by running:

    sudo systemctl status observiq-otel-collector

    The service should show as active (running).

Additional installation resources

For additional installation options and troubleshooting, see Bindplane agent installation guide.

Configure Bindplane agent to ingest syslog and send to Google SecOps

Locate the configuration file

  • Linux:

    sudo nano /etc/bindplane-agent/config.yaml

  • Windows:

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Edit the configuration file

  • Replace the entire contents of config.yaml with the following configuration:

    receivers:
  udplog:
    listen_address: "0.0.0.0:6514"

exporters:
  chronicle/nyansa_events:
    compression: gzip
    creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
    customer_id: 'YOUR_CUSTOMER_ID'
    endpoint: malachiteingestion-pa.googleapis.com
    log_type: NYANSA_EVENTS
    raw_log_field: body
    ingestion_labels:
      env: production
      source: nyansa

service:
  pipelines:
    logs/nyansa_to_chronicle:
      receivers:
        - udplog
      exporters:
        - chronicle/nyansa_events

Configuration parameters

Replace the following placeholders:

  • Receiver configuration:

    • listen_address: Set to 0.0.0.0:6514 to listen on all interfaces on port 6514 (or use a different port if needed)

  • Exporter configuration:

    • creds_file_path: Full path to ingestion authentication file:
      • Linux: /etc/bindplane-agent/ingestion-auth.json
      • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
    • customer_id: Replace YOUR_CUSTOMER_ID with your Chronicle customer ID from step 3
    • endpoint: Regional endpoint URL:
      • US: malachiteingestion-pa.googleapis.com
      • Europe: europe-malachiteingestion-pa.googleapis.com
      • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
      • See Regional Endpoints for complete list
    • log_type: Set to NYANSA_EVENTS
    • ingestion_labels: Optional labels in YAML format (customize as needed)

Save the configuration file

  • After editing, save the file:
    • Linux: Press Ctrl+O, then Enter, then Ctrl+X
    • Windows: Click File > Save

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Linux:

  1. Run the following command:

    sudo systemctl restart observiq-otel-collector

  2. Verify the service is running:

    sudo systemctl status observiq-otel-collector

  3. Check logs for errors:

    sudo journalctl -u observiq-otel-collector -f

To restart the Bindplane agent in Windows:

  1. Choose one of the following options:

    • Command Prompt or PowerShell as administrator:
    net stop observiq-otel-collector && net start observiq-otel-collector
    • Services console:
      1. Press Win+R, type services.msc, and press Enter.
      2. Locate observIQ OpenTelemetry Collector.
      3. Right-click and select Restart.

  2. Verify the service is running:

    sc query observiq-otel-collector

  3. Check logs for errors:

    type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Configure Nyansa Voyance API access

To enable the Nyansa SIEM syslog agent to retrieve events from Voyance, you need to create an API token with appropriate permissions.

Create API token in VMware SD-WAN Orchestrator

  1. Sign in to the VMware SD-WAN Orchestrator portal as an Enterprise Admin user.
  2. Go to Administration > Administrators.
  3. Locate your administrator account in the list.
  4. Click Actions > Modify for your administrator account.
  5. Navigate to the Developer API tab.
  6. Click Generate New Token or Create API Token.
  7. Copy and save the generated API token securely.

Record API endpoint URL

  • Your Voyance GraphQL API v2 URL follows this format:

    • Legacy Nyansa customers: https://yourcompany.nyansa.com/api/v2/graphql
    • VMware Edge Network Intelligence: https://your-eni-domain/api/v2/graphql

    Replace yourcompany or your-eni-domain with your actual organization domain.

Install and configure Nyansa SIEM syslog agent

The Nyansa SIEM syslog agent is a Java application that polls the Voyance GraphQL API and forwards events to syslog. This agent acts as a bridge between the Voyance API and your Bindplane agent.

Download the Nyansa SIEM syslog agent

  1. Download the latest release from the official GitHub repository:

    wget https://github.com/Nyansa/voyance-siem-syslog-agent/archive/refs/tags/v0.9.4.tar.gz

  2. Extract the archive:

    tar xf v0.9.4.tar.gz
cd voyance-siem-syslog-agent-0.9.4

  3. Build the package using Maven:

    mvn clean package

  4. Extract the generated package:

    tar xf target/VoyanceSiemSyslogAgent-0.9.4-package.tar.gz
cd VoyanceSiemSyslogAgent-0.9.4

Configure the agent properties

  1. Edit the config/config.properties file:

    nano config/config.properties

  2. Configure the following required parameters:

    # Voyance GraphQL API v2 URL
voyance.dev.api.url = https://yourcompany.nyansa.com/api/v2/graphql

# Voyance GraphQL API v2 Access Token
voyance.dev.api.token = YOUR_API_TOKEN_HERE

# HTTP Proxy (optional, leave blank if not needed)
http.proxy = 

# API Data Fetches Enabled
# Available options: iotOutlierList_all, iotDeviceStatsList_last3h, iotDeviceStatsList_last24h,
# iotDeviceStatsList_last7d, iotDeviceStatsList_last14d, iotGroupStatsList_last3h,
# iotGroupStatsList_last24h, iotGroupStatsList_last7d, iotGroupStatsList_last14d,
# deviceList_updated, applicationList_last3h, applicationList_last24h, deviceEventList_all
api.fetches.enabled = iotOutlierList_all,iotDeviceStatsList_last24h,deviceEventList_all
    • voyance.dev.api.url: Enter your Voyance GraphQL API v2 URL
    • voyance.dev.api.token: Enter the API token created in the previous step
    • http.proxy: Enter proxy hostname and port if required (for example, proxy.company.com:3128), otherwise leave blank
    • api.fetches.enabled: Comma-separated list of API fetch IDs to enable (customize based on your needs)

  3. Save the file.

Configure syslog destination

  1. Edit the config/log4j2.xml file:

    nano config/log4j2.xml

  2. Locate the <Properties> section and configure the syslog settings:

    <Properties>
    <!-- SIEM Syslog Properties -->
    <Property name="SiemSyslogHost">BINDPLANE_AGENT_IP</Property>
    <Property name="SiemSyslogPort">6514</Property>
    <Property name="SiemSyslogProtocol">UDP</Property>
</Properties>
    • SiemSyslogHost: Enter the IP address or hostname of the Bindplane agent host
    • SiemSyslogPort: Enter 6514 (or the port configured in your Bindplane agent)
    • SiemSyslogProtocol: Enter UDP or TCP (must match Bindplane receiver configuration)

  3. Save the file.

Start the Nyansa SIEM syslog agent

  1. Start the agent using the provided script:

    ./VoyanceSiemSyslogAgent.sh start

  2. Verify the agent is running:

    ./VoyanceSiemSyslogAgent.sh status

  3. Monitor the agent logs for errors:

    tail -f logs/voyance-agent.log

Common agent commands

  • Start the agent:

    ./VoyanceSiemSyslogAgent.sh start

  • Stop the agent:

    ./VoyanceSiemSyslogAgent.sh stop

  • Restart the agent:

    ./VoyanceSiemSyslogAgent.sh restart

  • Check agent status:

    ./VoyanceSiemSyslogAgent.sh status

  • Reset database and API fetch progress:

    ./VoyanceSiemSyslogAgent.sh db_reset

  • Validate configuration:

    ./VoyanceSiemSyslogAgent.sh validate

  • Show available API fetch IDs:

    ./VoyanceSiemSyslogAgent.sh show_apis

Verify log ingestion

  1. Wait a few minutes for the Nyansa SIEM syslog agent to poll the Voyance API and forward events to the Bindplane agent.

  2. Check the Bindplane agent logs to verify syslog messages are being received:

    Linux:

    sudo journalctl -u observiq-otel-collector -f | grep -i nyansa

    Windows:

    type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log" | findstr /i nyansa

  3. Sign in to the Google SecOps console.

  4. Go to SIEM Settings > Feeds and verify the feed status shows as Active.

  5. Search for Nyansa events in the Google SecOps search interface using the ingestion label NYANSA_EVENTS.

Troubleshooting

Nyansa SIEM syslog agent errors

  • Missing API URL or token: Verify voyance.dev.api.url and voyance.dev.api.token are correctly configured in config/config.properties.
  • API authentication failures: Verify the API token is valid and has not expired. Generate a new token if needed.
  • Network connectivity issues: Verify the agent can reach the Voyance API URL. Check firewall rules and proxy settings.
  • Syslog connection failures: Verify the Bindplane agent IP address and port are correct in config/log4j2.xml. Ensure the Bindplane agent is running and listening on the configured port.

Bindplane agent errors

  • Configuration syntax errors: Validate YAML syntax in config.yaml. Ensure proper indentation (2 spaces, not tabs).
  • Authentication failures: Verify the ingestion authentication file path is correct and the file is readable.
  • Network connectivity issues: Verify the Bindplane agent can reach the Chronicle regional endpoint. Check firewall rules for outbound HTTPS (TCP 443) to the endpoint.
  • No logs received: Verify the Nyansa SIEM syslog agent is running and configured to send to the correct Bindplane agent IP and port.

UDM mapping table

Log Field UDM Mapping Logic
auth_method extensions.auth.type Type of authentication (e.g., USER, MACHINE)
host intermediary.hostname Hostname of the intermediary device
host intermediary.ip IP address of the intermediary device
collected_timestamp metadata.collected_timestamp Timestamp when the event was collected
timestamp metadata.event_timestamp Timestamp when the event occurred
user_name metadata.event_type Type of event (e.g., USER_LOGIN, NETWORK_CONNECTION)
nas_ip metadata.event_type
event_type metadata.product_event_type Product-specific event type
session_id network.session_id Unique identifier for the network session
service_name principal.application Application name associated with the principal
nas_ip principal.ip IP address of the principal
end_host_id principal.mac MAC address of the principal
nas_port principal.port Port number of the principal
user_name principal.user.userid User ID of the principal
auth_method security_result.detection_fields Additional detection fields from security analysis
auth_source security_result.detection_fields
error_code security_result.detection_fields
request_status security_result.detection_fields
request_id security_result.detection_fields
additional.label security_result.detection_fields
additional.value security_result.detection_fields
metadata.product_name metadata.product_name Product name
metadata.vendor_name metadata.vendor_name Vendor name

Need more help? Get answers from Community members and Google SecOps professionals.