Views:

Share XDR data with your syslog server by configuring the generic syslog connector.

The syslog connector is a generic SIEM connector, which allows you to send XDR data to your on-premises syslog server. The connector supports multiple syslog server connections.
Note
Note
Each Service Gateway appliance supports configuration with one syslog server. To enable multiple syslog server connections, deploy multiple Service Gateway appliances. To add redundancy to one syslog server destination, select up to three Service Gateway appliances for that destination. The first appliance you select is initially active, while the others are on standby in the order they were selected. If the active appliance becomes unavailable, the Syslog Connector service automatically promotes the next healthy standby. If the original active appliance recovers, it does not automatically become active again. Existing single-appliance configurations continue to work without changes.
For syslog CEF mapping, see Syslog content mapping - CEF.
Category
Vendor
Associated Apps
SIEM
Not applicable
  • Workbench
  • Observed Attack Techniques
  • Audit Logs

Procedure

  1. Go to Agentic SIEM & XDR → Data Sources and Connectors.
  2. Locate and click the Syslog Connector (On-premises) card.
  3. In the Syslog Connector (On-premises) screen, enable Syslog Connector (On-premises) .
  4. Select the data to send to your syslog server(s).
    • Workbench alerts
    • Observed Attack Techniques
      If you select this data type, you can select one or more of the following event severity levels:
      • Critical
      • High
      • Medium
    • Audit logs
      If you select this data type, you can select one or more of the following log types:
      • Account
      • System
    Note
    Note
    You must select at least one data type.
  5. Click Connect Syslog Server.
  6. In the Syslog Server Connection panel, configure the following settings.
    Setting
    Description
    Server address
    Specify the IP address or FQDN for your syslog server.
    Syslog format
    Select the syslog format.
    Note
    Note
    Syslog Connector (On-premises) currently only supports Common Event Format (CEF).
    Protocol
    Select the connection protocol.
    Port
    Specify the port.
    Default port settings:
    • SSL/TLS: 6514
    • TCP: 601
    • UDP: 514
    Security Vendor
    (Optional) Specify the name of the SIEM vendor.
  7. (Optional) Select Use CA certificate to upload a CA certificate to use when connecting to the syslog server.
  8. (Optional) If your syslog server requires authenticated connections, select Server requires client authentication to upload the client certificate and specify the passphrase.
  9. (Optional) Select Include Company ID in each raw log.
  10. In Service Gateway, select up to three appliances.
    Note
    Note
    To configure multiple Service Gateway appliances so a standby can take over automatically if the active appliance becomes unavailable, the Syslog Connector service on each selected appliance must run version 2.x or later. Earlier versions of the service support only one Service Gateway per syslog destination.
  11. Click Test Connection to test Service Gateway appliances in the pool and verify their settings. Appliances must pass the test before you can save the connection. The results identify any appliance that fails.
  12. Click Connect to test and save your connection settings.
  13. In the Syslog Connector (On-premises) screen, click Save. The connection card shows whether each appliance is active or on standby. Failover events are recorded in the Audit Logs with the time, the previous active appliance, and the new active appliance.
Comments (0)