To configure a Syslog Server, as your external log server, to send logs from Web Isolation to your SIEM solution, it's really important to first ensure there are components of your SIEM solution that can integrate as a syslog server.
What is Syslog Server?
Although it could imply it’s a physical server, the term syslog server is widely used for a software that is able to receive syslog messages, amongst other uses. The ability to collect logs from network devices is especially important in networks with more than just a few routers, switches or servers, as these devices can produce million messages per hour. It would be almost impossible to make sense of all these messages if they are not stored and organized in one place – a syslog server.
What is SIEM?
SIEM stands for Security and Information Event Management and consists of two practices:
Security Information Management (SIM) involves collecting, correlating, and analyzing log data from various sources (network devices, firewalls, servers, anti-virus software and other applications or databases) in the network.
Security Event Management (SEM) involves analyzing collected event data for threat detection to improve security of the IT environment.
Software solutions combining both SIM and SEM are called SIEM tools. The main purpose of these tools is to improve security of an organization and, at the same time, demonstrate compliance with regulatory frameworks, as missing the mark on their requirements could negatively impact overall business of an organization.
Although there are some common similarities between syslog and SIEM, such as collection of logs from network devices or regulatory compliance, there are several key differences due to a different purpose each of these solutions is built for. Syslog server is designed to centralize all syslog messages from network devices, while SIEM solution is primarily focused on increasing security of your IT environment, by not only keeping track of incidents and events but by being able to respond to them by blocking or allowing actions as appropriate, as well as perform troubleshooting and remediation tactics.
Release : 1
To create a Syslog Server in Fireglass, please begin from "Log Forwarding". Refer to the snippet below, for guidance.
To simulate if this works, you may test with "rsyslog". See the details below.
Installing and configure rsyslo
Install rsyslog:
sudo apt-get update
sudo apt-get install rsyslog
configure rsyslog:
sudo vim /etc/rsyslog.conf
uncheck the comment (“#”) from the following lines:
$ModLoad imtcp
$InputTCPServerRun 514
You should see the marked lines:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 1435/0
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 2188/rsyslogd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1087/sshd
tcp6 0 0 ::1:6010 :::* LISTEN 1435/0
tcp6 0 0 :::514 :::* LISTEN 2188/rsyslogd
tcp6 0 0 :::22 :::* LISTEN 1087/sshd
udp 0 0 0.0.0.0:61357 0.0.0.0:* 690/dhclient
udp 0 0 0.0.0.0:68 0.0.0.0:* 690/dhclient
udp6 0 0 :::59860 :::* 690/dhclient
On fireglass Management:
Fill the following details:
Test it works:
Note: In the "Connection" settings, in the Syslog Server configuration, you can use either the IP Address or FQDN for your on-premise Syslog Server (SIEM). Ensure your network allows fireglass to talk to the on-premise Syslog Server on port 514.
