Sending Additional Information Using Syslog

SecureChange Requester This topic is intended for TOS Administrators.

Overview

To get full accountability details (who made policy changes and when) and to utilize rule and object usage reporting, you must get your monitored devices to send syslogs to TOS Aurora.

These monitored devices can be set up to send additional information to TOS Aurora, such as:

  • Rule and object usage information that can be seen in SecureTrack, such as the rules that were invoked or 'hit'

  • Accountability information that can be seen in SecureTrack, such as the users who made policy changes and the computer used to make the change

  • Details of the applications that pass traffic through the device - can be seen in SecureApp

  • Notifications to TOS Aurora that a security configuration change has occurred, enabling TOS Aurora to fetch the updated policy (revision) from the device immediately, rather than wait for the periodic polling

To get this additional information, you must configure your devices to send syslogs to TOS Aurora either directly or by using a log forwarder.

Certain devices can also use syslogs to collect traffic information that you can use for the Automatic Policy Generator (APG).

Syslog Traffic Destination

The TOS Aurora destination you configure on your devices for syslog traffic will vary according to your TOS Aurora deployment platform and the protocol you want to use. If you have remote clusters, you must send to the cluster that monitors the device.

  • AWS, Azure, and GCP deployments: Send to the IP or domain name of your external load balancer. Syslogs can be sent as unencrypted TCP (port 32514), TLS encrypted TCP (port 31514), or UDP (port 30514). With GCP, UDP syslogs cannot be sent to the load balancer and should instead be sent directly to the node.

    For more information, see:

  • On-premises deployments: Send to a Syslog VIP. Syslogs can be sent as UDP (port 514), unencrypted TCP (port 601), or TLS encrypted TCP (port 6514). All ports are defaults and can be changed.

The firewalls in the organization must be configured to allow the relevant traffic.

Use a Log Forwarder

You can send syslogs directly from the devices themselves or from an incident management tool such as ArcSight, Splunk or QRADAR. These tools are sometimes referred to as log forwarder/log aggregator tools or SEM (Security Event Management)/SIEM (Security Incident and Event management) systems. The syslogs must be sent to the TOS cluster in exactly the same format as they would be sent from the original device, including the IP address of the firewall device if specified.

Vendor-Specific Instructions

For more information on sending syslogs for supported devices, see the following related topics: