Collect Pharos logs

Supported in:

Google SecOps SIEM

This document explains how to ingest Pharos logs to Google Security Operations using Bindplane.

Pharos is an on-premises print management platform for tracking, controlling, and auditing print activities across enterprise environments. Pharos Blueprint Enterprise stores print job data, user activity, and device events in a SQL Server database.

Before you begin

Make sure you have the following prerequisites:

A Google SecOps instance
Windows Server 2016 or later
Network connectivity between the Bindplane agent and the Pharos Blueprint server
If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
Administrative access to the Pharos Blueprint server
Access to the Pharos SQL Server database or the Blueprint Administrator reporting console

Get Google SecOps credentials for the Bindplane agent

To authenticate the Bindplane agent to Google SecOps, choose one of the following methods:

New deployments: Use the Chronicle API (Option 1).
Legacy deployments: Continue using the ingestion authentication file (Option 2) until the Ingestion API is discontinued on July 20, 2027.

Option 1: Create a service account for the Chronicle API (recommended)

Sign in to the Google Cloud console and select the Google Cloud project that is linked to your Google SecOps instance.
Go to IAM & Admin > Service Accounts.
Click Create service account.
Provide the following configuration details:
- Service account name: Enter a name for the account (for example, bindplane-ingest).
- Service account description: Enter a description (for example, Bindplane agent log ingestion).
Click Create and continue.
In the Grant this service account access to project section, click Select a role and select Chronicle Editor.
Click Continue, and then click Done.
Click the service account you created, and then go to the Keys tab.
Click Add key > Create new key.
Select JSON and click Create. The key file is downloaded to your computer.
Save the key file as ingestion-auth.json in the Bindplane collector directory (/opt/observiq-otel-collector/ingestion-auth.json on Linux or C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json on Windows), or update creds_file_path in config.yaml to match the path where you save it.
Go to IAM & Admin > Settings and copy the Project number. You'll need it for the exporter configuration.

Option 2: Download the ingestion authentication file (legacy)

Sign in to the Google SecOps console.
Go to SIEM Settings > Collection Agents.
Download the ingestion authentication file.
Save the file securely on the system where the Bindplane agent will be installed.

Get Google SecOps customer ID

Sign in to the Google SecOps console.
Go to SIEM Settings > Profile.
Copy and save the Customer ID from the Organization Details section.

Note: The customer ID is required for configuring the Bindplane agent exporter.

Install the Bindplane agent

Install the Bindplane agent on your Windows operating system according to the following instructions.

Windows installation

Open Command Prompt or PowerShell as an administrator.

Run the following command:

msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

Wait for the installation to complete.
Verify the installation by running:
```
sc query observiq-otel-collector
```

The service should show as RUNNING.

Additional installation resources

For additional installation options and troubleshooting, see Bindplane agent installation guide.

Configure the Bindplane agent to ingest logs and send to Google SecOps

Locate the configuration file

notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

Edit the configuration file

Replace the entire contents of config.yaml with the following configuration:

receivers:
  filelog:
    include:
      - 'C:\Pharos\Exports\*.csv'
    start_at: beginning
    poll_interval: 5s

exporters:
  chronicle/pharos:
    protocol: https
    # Region of your instance, for example us, europe, asia-southeast1
    location: <LOCATION>
    # Project number of the Google Cloud project linked to the instance
    project: '<PROJECT_NUMBER>'
    compression: gzip
    creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
    customer_id: '<customer_id>'
    endpoint: chronicle.googleapis.com
    log_type: PHAROS
    raw_log_field: body
    ingestion_labels:
      env: production

service:
  pipelines:
    logs/pharos_to_chronicle:
      receivers:
        - filelog
      exporters:
        - chronicle/pharos

Configuration parameters

Replace the following placeholders:

Receiver configuration:
- include: Paths to Pharos export files:
  - Windows: C:\Pharos\Exports\*.csv
  - Adjust the path based on where you export Pharos print activity reports
- start_at: Set to beginning to read existing logs, or end to read only new entries
- poll_interval: How often to check for new log data (default: 5s)
Exporter configuration:
- pharos: Descriptive name for the exporter
- creds_file_path: Full path to the service account JSON key file (Option 1):
  - Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
- <customer_id>: Customer ID from the previous step
- location: Replace <LOCATION> with the region of your Google SecOps instance (for example, us, europe, or asia-southeast1). The exporter prefixes chronicle.googleapis.com with this value. See Regional Endpoints for the complete list.
- project: Replace <PROJECT_NUMBER> with the project number from IAM & Admin > Settings.
- endpoint: Keep set to chronicle.googleapis.com.
- PHAROS: Log type exactly as it appears in Chronicle
- ingestion_labels: Optional labels in YAML format (for example, env: production)
Pipeline configuration:
- pharos_to_chronicle: Descriptive name for the pipeline

Legacy ingestion API exporter

If you use the ingestion authentication file from Option 2, replace the exporters block with the following. Set creds_file_path to the path to the ingestion authentication file, and if your instance is outside the US, replace malachiteingestion-pa.googleapis.com with your regional endpoint (for example, europe-malachiteingestion-pa.googleapis.com).

exporters:
  chronicle/pharos:
    compression: gzip
    creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
    customer_id: '<customer_id>'
    endpoint: malachiteingestion-pa.googleapis.com
    log_type: PHAROS
    raw_log_field: body
    ingestion_labels:
      env: production

Save the configuration file

After editing, save the file:
- Windows: Click File > Save

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Windows:

Choose one of the following options:
- Command Prompt or PowerShell as administrator:
```
net stop observiq-otel-collector && net start observiq-otel-collector
```
- Services console:
  1. Press Win+R, type services.msc, and press Enter.
  2. Locate observIQ OpenTelemetry Collector.
  3. Right-click and select Restart.
Verify the service is running:
```
sc query observiq-otel-collector
```

Check logs for errors:

type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Export Pharos print activity logs

Pharos Blueprint Enterprise stores print job data in a SQL Server database. You must export the data to CSV files that the Bindplane agent can read.

Export print activity data from the Pharos SQL database

On the Pharos Blueprint server, connect to the Pharos SQL database using SQL Server Management Studio or a command-line tool.
Export print activity records using a SQL query:
```
sqlcmd -S <sql_server> -d Pharos -Q "SELECT * FROM PrintJobLog WHERE JobDate >= DATEADD(day, -1, GETDATE())" -o "C:\Pharos\Exports\pharos_print_jobs.csv" -s "," -W
```
Note: Replace <sql_server> with your SQL Server hostname. Adjust the query and table names based on your Pharos database schema.
Schedule this command to run at regular intervals (for example, every hour) using Windows Task Scheduler so the Bindplane agent continuously picks up new export files.

Alternative: Export reports from the Blueprint Administrator console

Open the Pharos Blueprint Administrator console.
Navigate to Insights > Reports.
Select the desired report type (for example, Print Activity, User Activity, Device Activity).
Configure the date range and filters.
Export the report as a CSV file to the export directory (for example, `C:\Pharos\Exports`).

Note: Pharos Cloud customers can access print activity data through the Pharos Cloud dashboard under Insights > Reports and download reports for the desired time period.

UDM mapping table

Log Field	UDM Mapping	Logic
msg.Building, msg.DataSource, msg.FactSubType, msg.FactType, msg.JobId, msg.JobName, msg.JobTimeutc, msg.PostalCode, msg.VpnConnected, mtd.customer, mtd.slt.node, mtd.slt.pipeline, mtd.source.database, mtd.timestamp.producer_process	additional.fields	Merged with Building_label if msg.Building not empty, datasource_label if msg.DataSource not empty, factsubtype_label if msg.FactSubType not empty, facttype_label if msg.FactType not empty, jobid_label if msg.JobId not empty, jobname_label if msg.JobName not empty, jobtimeutc_label if msg.JobTimeutc not empty, postalcode_label if msg.PostalCode not in ["", "Unknown"], vpnconnected_label if msg.VpnConnected not empty, customer_label if mtd.customer not empty, node_label if mtd.slt.node not empty, pipeline_label if mtd.slt.pipeline not empty, database_label if mtd.source.database not empty, producer_process_label if mtd.timestamp.producer_process not empty
	metadata.event_type	Set to "STATUS_UPDATE" if has_principal is true, else "GENERIC_EVENT"
msg.Application	principal.application	Value copied directly if not empty
msg.HostName	principal.asset.hostname	Value copied directly if not empty
msg.IPAddress	principal.asset.ip	Value copied directly if not in ["", "Unknown"]
msg.City	principal.location.city	Value copied directly if not in ["", "Unknown"]
msg.Country	principal.location.country_or_region	Value copied directly if not in ["", "Unknown"]
msg.State	principal.location.state	Value copied directly if not in ["", "Unknown"]
msg.HostName	principal.hostname	Value copied directly if not empty
msg.IPAddress	principal.ip	Value copied directly if not in ["", "Unknown"]
msg.UserDisplayName	principal.user.user_display_name	Value copied directly if not empty
mtd.source.host	src.hostname	Value copied directly if not empty
mtd.source.port	src.port	Value copied directly if not in ["", "n/a"]
mtd.source.type	src.resource.attribute.labels	Merged with sourcetype_label if not empty
	metadata.product_name	Set to "PHAROS"
	metadata.vendor_name	Set to "PHAROS"

Need more help? Get answers from Community members and Google SecOps professionals.