Syslog v2

A Syslog server enables automatically opening incidents from Syslog clients. This integration supports filtering logs to convert to incidents, or alternatively converting all logs.

Analytics & SIEM · Syslog

Details

ID	`Syslog v2`
Provider	Open Source
Category	Analytics & SIEM
From Version	6.0.0
Docker Image	`demisto/syslog:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

A Syslog server enables opening incidents automatically from Syslog clients. This integration supports converting to incidents, filtered logs or all logs.

This integration is a long-running integration. For more information about long-running integrations, see the Cortex XSOAR 8 Cloud, Cortex XSOAR 8 On-prem or Cortex XSIAM documentation.

This integration was integrated and tested with RFC3164 and RFC5424 formats of Syslog.

Notes

Important: Supported log formats: RFC3164, RFC5424, RFC6587 (with RFC3164 or RFC5424)
Important: Do not use an engine group for this integration. It can cause the integration to run on a different engine, and the Syslog server may send logs to an IP for which Syslog is not configured.
The integration does not support encrypted private keys.

Configure Syslog v2 in Cortex

Parameter	Description	Required
Port mapping	The listening port to receive Syslog message on (`<port> or <host port>:<docker port>`). Port 6514 is the default when using TLS.	True
Certificate	Required for TLS	False
Private Key	Required for TLS	False
Message Regex Filter For Incidents Creation	Creates an incident in Cortex XSOAR for every received log message that matches this regex.	False

Troubleshooting

To receive incidents, the Syslog engine listens on a configured port that needs to be available for external in-coming traffic. There may be cases that docker is configured not to expose the port for external in-comming traffic. In this case, you can use host networking and not the docker based networking. Enable host networking usage by adding the following server configuration (Settings > About > Troubleshooting > Add Server Configuration):

Key: python.pass.extra.keys.demisto/syslog
Value: --network=host

If listening on a port less than 1024 and running with the Docker Hardening configuration, you may need to disable the “run with non-root internal user” setting for the Syslog integration to listen on the host networking on a lower port. From more information, see: Run Docker with Non Root Internal Users (Cortex XSOAR 6.13) or Docker hardening guide (Cortex XSOAR 6.13) or Docker hardening guide (Cortex XSOAR 8 Cloud) or Docker hardening guide (Cortex XSOAR 8.7 On-prem) You can disable this setting by adding the following server configuration:

Key: docker.run.internal.asuser.ignore
Value: demisto/syslog

If the integration is running via an engine, you need to add this setting to the engine configuration either via the d1.conf file or in the Server Settings->Engines-> Edit Configuration.

Configuration parameters

creds_certificate — Certificate
certificate — Certificate
private_key — Private Key
message_regex — Message Regex Filter For Incidents Creation.
longRunningPort — Port mapping (required)
longRunning — Long Running Instance

Commands (1)

get-mapping-fields
Returns the list of fields for an incident type. This command should be used for debugging.

Source

Syslogv2.py Syslogv2_test.py Syslogv2.yml Syslogv2_description.md

Download History Raw

## Configure Syslog in Cortex XSOAR
- Configure a Syslog server to send its logs to the Cortex XSOAR machine running the Syslog v2 integration.
- To create incidents from specific messages, use the **Message Regex** parameter to create incidents only for logs matching the given regex. If no message regex is specified, an incident is created for each received Syslog message.
## Notes
- **Important**: Do not use an engine group for this integration. It can cause the integration to run on a different engine, and the Syslog server may send logs to an IP for which Syslog is not configured.
- **Important**: Only TCP/TLS is supported. UDP is not supported.
- **Important**: Supported log formats: RFC3164, RFC5424, RFC6587 (with RFC3164 or RFC5424)
- The integration **does not support** encrypted private keys.

For more information about long-running integrations, check out the <~XSIAM>[Forward requests to long-running integrations](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Forward-Requests-to-Long-Running-Integrations) article.</~XSIAM> <~XSOAR_SAAS>Forward Requests to Long-Running Integrations article: [Cortex XSOAR 8 Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Forward-Requests-to-Long-Running-Integrations) or [Cortex XSOAR 8 On-prem](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Integration-commands-in-the-CLI) documentation.</~XSOAR_SAAS>