Ingesting Syslog to Private/Internal Syslog

[odonaldadmin]

Hello,

My organization utilizes graylog, and we host it on prem. Is there a way to route/tunnel the XDR tenant into our internal network? I am aware of the BrokerVM, but I do not know if that plays a role. I know the BrokerVM has a syslog app, but that is only available for the "Cortex XDR Pro per TB" where as we utilize "Cortex XDR Pro per Endpoint". Would we need to purchase this license tier to get any kind of syslog forwarding?

[anlynch · Accepted solution]

Hi @odonaldadmin 

Thank you for reaching out on LIVEcommunity. 

It appears you have a couple of questions so I’ll try to break it down and answer them in order for clarity.

I’ll start with your last question as it’s probably the most important to the task at hand.  Yes, you would need a Cortex XDR Pro per TB to use the Syslog Collector applet in the Broker VM.

Next, the Syslog Collector Applet is a collector only.  It does not forward any syslog data.  Notifications via syslog for management logs, agent audit logs, and alerts, come from the XDR console and cannot (at the present time) be routed via Broker VM or any other means, they will always come from the console.

There is a Cortex XDR Event Forwarding license that’s available.  It comes in a per Endpoint and per GB option.  This allows you to take raw Cortex XDR Data and ingest into a solution like Graylog from a GCP (Google Cloud Platform) Bucket.

Here’s some information about Event Forwarding.  I think this may help determine if this is the route that will satisfy your use case.  If this is something that interests you as a solution to your use case I recommend reaching out to your account team for more details.

I hope you find this information helpful.   Have a great day!

[bbarmanroy]

Hi @odonaldadmin you can take a look at this link which describes how to configure Cortex XDR to forward to a syslog receiver. You can then use the same to forward logs to the syslog receiver as stated in this link.