- Open Collector is installed. If you have not already installed it, follow the instructions in the Open Collector Installation and User Guide, and then return to this topic.
- API URL (These are specific to audit and alert logs, and the version of these APIs depends on the users. For example, https://api.prismacloud.io/alert).
- Prisma Cloud Access Key ID (User-provided).
- Prisma Cloud Secret Key (User-provided).
The following port is open:
Outbound 443 HTTPS prismacloudbeat
Initialize the Beat
Confirm Open Collector is running:CODE
You should see the open_collector and metrics versions:
If Open Collector is not running correctly, see Troubleshoot the Open Collector in the Open Collector Installation and User Guide.
Start the beat:CODE
./lrctl prismacloudbeat start
Select New prismacloudbeat instance from the list and press Enter.
Enter a unique identifier for this Prisma Cloud Beat instance and press Enter.
Enter the Prisma Cloud Audit API URL and press Enter.
Create a new Prisma Cloud Beat instance with the Alert API URL to collect Prisma Cloud CSPM Alert logs simultaneously.
- Enter the Prisma Cloud Client ID (the Access Key ID obtained in the Configure Prisma Cloud topic), and press Enter.
Enter the Prisma Cloud Client Secret (the Secret Key obtained in the Configure Prisma Cloud topic), and press Enter.
For security purposes, the Client ID and Client Secret are stored in an encrypted format.
The prismacloudbeat service started message appears.
Check the status of the service by entering the following command:CODE
./lrctl prismacloudbeat status
Currently, the Prisma Cloud Beat doesn't support log parsing. All collected logs appear under the "Logrhythm - Open Collector" log source.