Ingesting Syslog to Private/Internal Syslog

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Ingesting Syslog to Private/Internal Syslog

L0 Member

Hello,

 

My organization utilizes graylog, and we host it on prem. Is there a way to route/tunnel the XDR tenant into our internal network? I am aware of the BrokerVM, but I do not know if that plays a role. I know the BrokerVM has a syslog app, but that is only available for the "Cortex XDR Pro per TB" where as we utilize "Cortex XDR Pro per Endpoint". Would we need to purchase this license tier to get any kind of syslog forwarding?

 

 

Jr. Security Administrator
1 accepted solution

Accepted Solutions

L4 Transporter

Hi @odonaldadmin 

 

Thank you for reaching out on LIVEcommunity. 

 

It appears you have a couple of questions so I’ll try to break it down and answer them in order for clarity.

 

I’ll start with your last question as it’s probably the most important to the task at hand.  Yes, you would need a Cortex XDR Pro per TB to use the Syslog Collector applet in the Broker VM.

 

Next, the Syslog Collector Applet is a collector only.  It does not forward any syslog data.  Notifications via syslog for management logs, agent audit logs, and alerts, come from the XDR console and cannot (at the present time) be routed via Broker VM or any other means, they will always come from the console.

 

There is a Cortex XDR Event Forwarding license that’s available.  It comes in a per Endpoint and per GB option.  This allows you to take raw Cortex XDR Data and ingest into a solution like Graylog from a GCP (Google Cloud Platform) Bucket.

anlynch_0-1679583752933.png

 

 

Here’s some information about Event Forwarding.  I think this may help determine if this is the route that will satisfy your use case.  If this is something that interests you as a solution to your use case I recommend reaching out to your account team for more details.

 

I hope you find this information helpful.   Have a great day!

View solution in original post

2 REPLIES 2

L4 Transporter

Hi @odonaldadmin 

 

Thank you for reaching out on LIVEcommunity. 

 

It appears you have a couple of questions so I’ll try to break it down and answer them in order for clarity.

 

I’ll start with your last question as it’s probably the most important to the task at hand.  Yes, you would need a Cortex XDR Pro per TB to use the Syslog Collector applet in the Broker VM.

 

Next, the Syslog Collector Applet is a collector only.  It does not forward any syslog data.  Notifications via syslog for management logs, agent audit logs, and alerts, come from the XDR console and cannot (at the present time) be routed via Broker VM or any other means, they will always come from the console.

 

There is a Cortex XDR Event Forwarding license that’s available.  It comes in a per Endpoint and per GB option.  This allows you to take raw Cortex XDR Data and ingest into a solution like Graylog from a GCP (Google Cloud Platform) Bucket.

anlynch_0-1679583752933.png

 

 

Here’s some information about Event Forwarding.  I think this may help determine if this is the route that will satisfy your use case.  If this is something that interests you as a solution to your use case I recommend reaching out to your account team for more details.

 

I hope you find this information helpful.   Have a great day!

L5 Sessionator

Hi @odonaldadmin you can take a look at this link which describes how to configure Cortex XDR to forward to a syslog receiver. You can then use the same to forward logs to the syslog receiver as stated in this link.

  • 1 accepted solution
  • 1402 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!