Firewalla MSP collector
Overview
Firewalla MSP is a Managed Security Portal designed for security and infosec professionals to easily manage multiple Firewalla boxes from anywhere.
Devo collector features
Feature | Details |
---|---|
Allow parallel downloading ( |
|
Running environments |
|
Populated Devo events |
|
Flattening preprocessing |
|
Data sources
Data source | Description | API endpoint | Collector service name | Devo table | Available from release |
Device | Get list of device |
|
|
|
|
Device detail | Get device details |
|
|
|
|
Flows | Get flows of the firewall MSP |
|
|
|
|
Alarm | Get list of alarm |
|
|
|
|
Alarm Detail | Get Alarm details |
|
|
|
|
Box | Get the list of boxes |
|
|
|
|
For more information on how the events are parsed, visit our page.
Flattening preprocessing
Data source | Collector service | Optional | Flattening details |
Device |
| yes | not required |
Device detail |
| yes | not required |
Flows |
| yes | not required |
Alarm |
| yes | not required |
Alarm Detail |
| yes | not required |
Box |
| yes | not required |
Device |
| yes | not required |
Accepted Authentication Methods
Authentication method |
|
|
---|---|---|
api_token |
|
|
msp_domain |
|
|
Minimum configuration required for basic pulling
Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.
Setting | Details |
api_token | The api_token for firewalla_msp API |
msp_domain | The msp_domain for firewalla_msp API. ex: |
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
Collector services detail
This section is intended to explain how to proceed with specific actions for services.
This collector can only make 30 requests per hour for each service.
Common Setup outpur for all services
Boxes
devices
flows
alarms
Restart the persistance
This collector uses persistent storage to download events in an orderly fashion and avoid duplicates. In case you want to re-ingest historical data or recreate the persistence, you can restart the persistence of this collector by following these steps:
Edit the configuration file.
Change the value of the
start_time_in_utc
parameter to a different one.Save the changes.
Restart the collector.
The collector will detect this change and will restart the persistence using the parameters of the configuration file or the default configuration in case it has not been provided.
Troubleshooting
This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the most common errors.
Note: If the error isFailed to establish a new connection: [Errno 110] Connection timed out
please check the credentials if they are provided correctly.
Error type | Error ID | Error message | Cause | Solution |
|
|
| param 'start_time_in_utc' is not in correct format | start_time_in_utc should be in correct format |
|
|
| param 'start_time_in_utc' is not in correct format | start_time_in_utc should be current time or in the past |
|
|
| param 'start_time_in_utc' is not defined | start_time_in_utc should be defined |
|
|
| Credentials error {unauthorized} or mismatch b/w credentials or firewalla_msp server error | Check the credentials or contact developer with required message |
|
|
| Error on the firewalla msp server. | Contact the developer with exact error message. |
|
|
| This error happens when the collector tries to fetch the data from API. | In this error you will find the HTTP error code as well as the summary and details. |
|
|
| Some exceptions occurred while making the API request. | Contact the developer with exact error message. |
|
|
| Error while fetching sender_ip_address data | Get the HTTP error code and contact the developer |
|
|
| Exception while making the API request sender_ip_address | In this error you will find the HTTP error code as well as the summary and details. |
|
|
| Error while fetching sender_data data | Contact the developer with required message |
|
|
| Some exceptions occurred while making the API request. | Contact the developer with required message |
Collector operations
This section is intended to explain how to proceed with specific operations of this collector.
Change log
Release | Released on | Release type | Details | Recommendations |
---|---|---|---|---|
| Jan 9, 2025 | NEW Feature |
|
|