Siemens SiPass (v1.0.5)

Siemens SiPass is an access control system that enables you to manage physical access such as doors, gates, barriers, and elevators at multiple sites.

Author: Cortex XSOAR
Support: xsoar
URL: https://www.paloaltonetworks.com/cortex
Categories: Analytics & SIEM

Modeling rules (1)

Siemens SiPass Modeling Rule

Parsing rules (1)

Siemens SiPass Parsing Rule

README

Siemens SiPass

<~XSIAM>

This pack includes Cortex XSIAM content.

Configuration on Server Side

The log forwarding of Siemens SiPass is configured using a file collection.

Important Notes

Details of the folder path on the network share containing the files that you want to monitor and upload to Cortex XSIAM.
Settings related to the list of files to monitor and upload to Cortex XSIAM, where the log format is either Raw (default), JSON, CSV, TSV, PSV, CEF, LEEF, Corelight, or Cisco.
Ensure that the user permissions for the network share include the ability to rename and delete files in the folder that you want to configure the collection.

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

To create or configure the Broker VM, use the information described here.

You can configure the specific vendor and product for this instance.

Navigate to Settings > Configuration > Data Broker > Broker VMs.
Go to the Apps column under the Brokers tab and add the Syslog Collector app for the relevant broker instance. If the app already exists, hover over it and click Configure.
Click Add New for adding a new syslog data source.

When configuring the new syslog data source, set the following values:

Parameter	Value
`Vendor`	Enter Siemens.
`Product`	Enter SiPass.

</~XSIAM>