Syslog v2

A Syslog server enables automatically opening incidents from Syslog clients. This integration supports filtering logs to convert to incidents, or alternatively converting all logs.

Analytics & SIEM · Syslog

Details

ID	`Syslog v2`
Provider	Open Source
Category	Analytics & SIEM
From Version	6.0.0
Docker Image	`demisto/syslog:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

A Syslog server enables opening incidents automatically from Syslog clients. This integration supports converting to incidents, filtered logs or all logs.

This integration is a long-running integration. For more information about long-running integrations, see the Cortex XSOAR 8 Cloud, Cortex XSOAR 8 On-prem or Cortex XSIAM documentation.

This integration was integrated and tested with RFC3164 and RFC5424 formats of Syslog.

Notes

Important: Supported log formats: RFC3164, RFC5424, RFC6587 (with RFC3164 or RFC5424)
Important: Do not use an engine group for this integration. It can cause the integration to run on a different engine, and the Syslog server may send logs to an IP for which Syslog is not configured.
The integration does not support encrypted private keys.

Configure Syslog v2 in Cortex

Parameter	Description	Required
Port mapping	The listening port to receive Syslog message on (`<port> or <host port>:<docker port>`). Port 6514 is the default when using TLS.	True
Certificate	Required for TLS	False
Private Key	Required for TLS	False
Message Regex Filter For Incidents Creation	Creates an incident in Cortex XSOAR for every received log message that matches this regex.	False

Troubleshooting

To receive incidents, the Syslog engine listens on a configured port that needs to be available for external in-coming traffic. There may be cases that docker is configured not to expose the port for external in-comming traffic. In this case, you can use host networking and not the docker based networking. Enable host networking usage by adding the following server configuration (Settings > About > Troubleshooting > Add Server Configuration):

Key: python.pass.extra.keys.demisto/syslog
Value: --network=host

If listening on a port less than 1024 and running with the Docker Hardening configuration, you may need to disable the “run with non-root internal user” setting for the Syslog integration to listen on the host networking on a lower port. From more information, see: Run Docker with Non Root Internal Users (Cortex XSOAR 6.13) or Docker hardening guide (Cortex XSOAR 6.13) or Docker hardening guide (Cortex XSOAR 8 Cloud) or Docker hardening guide (Cortex XSOAR 8.7 On-prem) You can disable this setting by adding the following server configuration:

Key: docker.run.internal.asuser.ignore
Value: demisto/syslog

If the integration is running via an engine, you need to add this setting to the engine configuration either via the d1.conf file or in the Server Settings->Engines-> Edit Configuration.

Configuration parameters

creds_certificate — Certificate
certificate — Certificate
private_key — Private Key
message_regex — Message Regex Filter For Incidents Creation.
longRunningPort — Port mapping (required)
longRunning — Long Running Instance

Commands (1)

get-mapping-fields
Returns the list of fields for an incident type. This command should be used for debugging.

Source

Syslogv2.py Syslogv2_test.py Syslogv2.yml Syslogv2_description.md

Download History Raw

category: Analytics & SIEM
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: Syslog v2
  version: -1
configuration:
- name: creds_certificate
  display: Certificate
  type: 9
  section: Connect
  displaypassword: Private Key
  required: false
- display: Certificate
  additionalinfo: Required for TLS
  name: certificate
  type: 12
  section: Connect
  hidden: true
  required: false
- display: Private Key
  name: private_key
  type: 14
  additionalinfo: Required for TLS
  section: Connect
  hidden: true
  required: false
- display: Message Regex Filter For Incidents Creation.
  additionalinfo: Creates an incident in Cortex XSOAR for every received log message that matches this regex.
  name: message_regex
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: "514"
  display: Port mapping
  name: longRunningPort
  required: true
  type: 0
  section: Connect
  additionalinfo: In the format <port> or <host port>:<docker port>. Port 6514 is the default when using TLS.
- defaultvalue: "true"
  display: Long Running Instance
  name: longRunning
  type: 8
  hidden: true
  section: Connect
  advanced: true
  required: false
description: A Syslog server enables automatically opening incidents from Syslog clients. This integration supports filtering logs to convert to incidents, or alternatively converting all logs.
display: Syslog v2
name: Syslog v2
script:
  commands:
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type. This command should be used for debugging.
  runonce: false
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/syslog:1.0.0.10133006
  longRunning: true
  longRunningPort: true
  isFetchSamples: true
  ismappable: true
fromversion: 6.0.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
triggers:
  - conditions:
      - name: engine
        operator: not_exists
      - name: isEngineGroup
        operator: not_exists
    effects:
      - name: longRunningPort
        action:
          hidden: true
          required: false