Understanding HPE Morpheus Audit Log Sources

HPE Morpheus Enterprise generates audit trails via two distinct internal loggers. To achieve a comprehensive audit feed for your Security Information and Event Management (SIEM) system, you must leverage both. This guide details a configuration that reliably produces these logs and forwards them to a SIEM in Common Event Format (CEF) over syslog, crucially without requiring any custom plugins, scheduled jobs, or API polling.

This setup has been tested on Morpheus versions 9.0.x and 8.1.x, running on Red Hat Enterprise Linux 8, and configured to forward logs to IBM QRadar. The documented CEF export functionality provides a solid starting point for your audit feed, utilizing the com.morpheus.AuditLogService logger.

Configuring the Primary Audit Logger

The core of the audit log export relies on configuring the com.morpheus.AuditLogService logger. This logger is responsible for capturing a significant portion of user actions and system events within Morpheus. The configuration involves defining a logger with the specified name and level, and directing its output to an appender named AUDIT. This appender is typically pre-configured within Morpheus to handle audit-related log events.

The XML snippet below illustrates the basic logger configuration:

<logger name="com.morpheus.AuditLogService" level="INFO" additivity="false">
    <appender-ref ref="AUDIT" />
</logger>

The level="INFO" setting ensures that all informational messages, including audit events, are captured. additivity="false" prevents duplicate logging if this logger were to inherit from a parent logger that also outputs to the console or other appenders. The reference to the AUDIT appender is critical, as it defines where the log messages are actually sent.

Leveraging the Secondary Logger for Deeper Insights

While the com.morpheus.AuditLogService covers many critical events, a second logger, com.morpheus.audit.service.AuditServiceImpl, provides additional, often more granular, audit details. This logger is essential for a complete picture of system activity. Unlike the primary logger, this secondary logger may require a specific appender configuration to ensure its output is captured and formatted correctly for export.

The configuration for this secondary logger looks like this:

<logger name="com.morpheus.audit.service.AuditServiceImpl" level="INFO" additivity="false">
    <appender-ref ref="AUDIT" />
</logger>

Similar to the first logger, setting the level to INFO captures the necessary events. The key here is that both loggers point to the same AUDIT appender. This consolidation simplifies the process, ensuring that all audit-related messages are processed by the same output mechanism.

Configuring the AUDIT Appender for CEF Export

The AUDIT appender is where the magic happens for CEF formatting and syslog forwarding. This appender needs to be configured to write log events in a structured format suitable for SIEM ingestion, specifically CEF, and then transmit them via syslog. The appender configuration dictates the pattern used for log messages, ensuring that fields like timestamp, source IP, username, action, and event details are correctly parsed by your SIEM.

A sample appender configuration for CEF export might look like this:

<appender name="AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
    <file>/var/log/morpheus/morpheus.audit.log</file>
    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
        <fileNamePattern>/var/log/morpheus/morpheus.audit.log.%d{yyyy-MM-dd}.gz</fileNamePattern>
        <maxHistory>30</maxHistory>
    </rollingPolicy>
    <encoder class="ch.qos.logback.classic.PatternLayoutEncoder">
        <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        <outputPattern>CEF:0|HPE|Morpheus|9.0|%level|%msg|%level%n</outputPattern>
    </encoder>
</appender>

The RollingFileAppender ensures that log files are managed, preventing them from growing indefinitely. The TimeBasedRollingPolicy creates daily archives, compressed with gzip. The PatternLayoutEncoder defines the overall log message format, while the outputPattern specifically targets the CEF format. Note that the exact CEF fields (%level, %msg, etc.) might need adjustment based on your specific SIEM's parsing requirements and the available data within Morpheus logs.

Syslog Forwarding Setup

Once the logs are generated and formatted by the AUDIT appender, the next step is to forward them to your SIEM via syslog. This typically involves a separate syslog daemon or a log shipping agent running on the Morpheus server or a dedicated log collector. On RHEL 8, rsyslog is the standard service for this purpose.

You need to configure rsyslog to monitor the Morpheus audit log file (e.g., /var/log/morpheus/morpheus.audit.log) and forward its contents to your SIEM's syslog listener on the appropriate port (usually UDP 514 or TCP 6514).

An example rsyslog configuration snippet (e.g., in /etc/rsyslog.d/morpheus.conf) would look like this:

# Forward Morpheus audit logs to QRadar
*.* @your_siem_ip:514

Replace your_siem_ip with the actual IP address or hostname of your SIEM and adjust the port if necessary. For QRadar, ensuring the incoming logs are tagged correctly or that the parser is configured to expect CEF format is crucial for successful ingestion and analysis.

The surprising detail here is not the complexity of the logging configuration itself, but the fact that it can be achieved with native Morpheus logging capabilities and standard syslog forwarding, without resorting to external tools or custom scripting. This approach offers a robust and maintainable solution for enterprises focused on security and compliance.

Conclusion and Next Steps

By configuring both the com.morpheus.AuditLogService and com.morpheus.audit.service.AuditServiceImpl loggers to use the AUDIT appender, and ensuring this appender is set up for CEF output and syslog forwarding, you can achieve seamless integration of HPE Morpheus audit logs into your SIEM. This method provides a reliable, plugin-free, and efficient way to enhance your security monitoring capabilities.

If you run a security operations center that relies on comprehensive audit trails from your cloud management platform, you should consider implementing this configuration to ensure all critical events are captured and analyzed.