Log360 MSSP Edition Overview

    Last updated on:

    In this page

    Overview

    This document provides a detailed walkthrough for converting the standalone edition of EventLog Analyzer and Log360 into MSSP edition.

    What is MSSP deployment: The MSSP deployment allows centralized management of multiple customer instances deployed in various geographical locations. It supports customer and technician management, secure multi-tenant views, and license allocation. The guide also explains necessary prerequisites, port requirements, and best practices to ensure a successful deployment.

    Reference glossary

    1. Distributed environment
      • Admin server: Acts as the central server in a distributed environment, coordinating data and configurations across all managed servers.
      • Managed server: Refers to the servers deployed at different locations in a distributed environment, which report to the admin server.
    2. MSSP environment
      • MSSP server: Functions as the central server in an MSSP environment, enabling service providers to manage multiple customer servers from one console.
      • Customer server: Refers to the servers deployed at different customer locations in an MSSP environment, which are integrated with the MSSP server.

    Key features

    • Supports multiple customers across different geographical locations.
    • Supports customer management, technician management, and customers' license management.
    • Exclusive segmented and secured view for various customers of the MSSP in a single console.

    NOTE Log360 MSSP edition will have the distributed architecture only for its core component, the log management system -- EventLog Analyzer. Please note that you cannot integrate the identity threat detection and response (ITDR) component -- ADAudit Plus, or the data security component -- DataSecurity Plus, with your MSSP deployment. If you need more assistance on the deployment, contact our technical support team.

    Pre-requisites for converting to the MSSP edition

    Here are a few of the prerequisites which need to be taken care of before converting a standalone setup to the MSSP edition:

    Port requirements

    If you want to convert your existing standalone EventLog Analyzer or Log360 to MSSP edition, ensure that the following ports to be free for web server and PostgreSQL communication.

    • 33335 (TCP): This is the port used for connecting to the bundled PostgreSQL database in Log360.
    • 8095 (Web server port): This is the default web server port used by the solutions EventLog Analyzer and Log360. This port is used for connecting to a web browser. You can change this port during conversion.

    Default communication protocols (HTTP/HTTPS)

    By default, the customer's server and the MSSP server communicate using HTTP (port number 8095). There is also an option to convert the mode of communication to HTTPS.

    Verify port availability to ensure it is unoccupied by concurrent local applications. This is crucial because for the product communication, the customer's server will send a request to port 8095 of the MSSP server and vice versa.

    Best practices for MSSP server deployment

    • We always recommend the conversion of a new server (EventLog Analyzer and Log360) to MSSP server to avoid data loss. You can follow the steps given here to convert the standalone instance into an MSSP server.
    • Both the MSSP server and the customer server should be in the same build. If they are not in the same build, follow the steps mentioned in this page to download and apply the latest service packs.
    NOTE
    • If both the admin and customer servers are not in the same build number, it can lead to sync issues.
    • One MSSP server is designed to manage up to 100 customer servers.

    Converting standalone EventLog Analyzer and Log360 instance to MSSP Server

    NOTE Converting the standalone instance into an MSSP server will result in the deletion of data present in the standard edition. You need to back up the existing data if any to prevent data loss.

    You can follow the steps given below to convert the standard edition of Log360 into an MSSP server:

    1. Shut down Log360 or EventLog Analyzer.
    2. Open the command prompt with administrative privilege and execute the Convert to MSSPServer.bat/sh file located in <product_home>/troubleshooting/ConvertToMSSPServer.bat/sh.
    3. A warning message about the deletion of data of your existing installation will be displayed. Press y and click on the Enter key to continue.
      Log360 MSSP Edition Overview
    4. If you want to configure a proxy server, enter y for the next query and enter the proxy server details.
    5. You will see a success message if the standalone instance has been converted from the standalone edition into an MSSP server.
      Log360 MSSP Edition Overview

    What happens after the conversion?

    After conversion, the Log360 console initiates the application of the pre-existing MSSP-specific configurations and eventually switches to the MSSP version. During the conversion, all the existing Log360 data in the database will be erased and replaced by the MSSP configurations.

    After the successful conversion, the functionalities of integration, license management, and more will be enabled in that server thereby acting as the MSSP server.

    Read also

    This document explained how to set up and convert Log360 to the MSSP edition, including its capabilities, default communication protocols, and post-conversion behavior. For more advanced deployment options and customer-specific configurations, refer to: