VMware vCenter

<~XSIAM>

This pack includes

Data normalization capabilities

• Rules for VMware vCenter logs ingested via the Broker VM into Cortex XSIAM.
• Normalization to Virtualization Stories, available for usage from v1.0.15.

Configuration on Server Side

This section describes the configuration required on the VMware vCenter server to forward its event logs to Cortex XSIAM Broker VM via syslog.

1. Log in to the vCenter Server Management Interface as user root.
2. In the vCenter Server Management Interface, select Syslog.
3. In the Forwarding Configuration section -
   • If you have not yet configured any remote syslog hosts, click Configure.
   • If you configured hosts previously, click Edit.
4. From the Protocol drop-down menu, select the requested protocol for the syslog forwarding (for example UDP).
5. In the Port text box, enter the port number that would be used for communication with the target Cortex XSIAM Broker VM syslog server.
6. In the Create Forwarding Configuration pane, click Add to enter another remote syslog server.
7. Click Save.

For additional details, see Forward vCenter Server Log Files to Remote Syslog Server

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

You will need to use the information described here.
You can configure the specific vendor and product for this instance.

1. Navigate to Settings → Configuration → Data Broker → Broker VMs.
2. Right-click, and select Syslog Collector → Configure.

3. When configuring the Syslog Collector, set the following parameters:

   Parameter	Value
   Protocol	Should be aligned with the selected protocol value in the vCenter Server Management Interface syslog configuration, as described in the Configuration on Server Side section above.
   Port	Should be aligned with the port defined in the vCenter Server Management Interface syslog configuration as described in the Configuration on Server Side section above.
   Format	Select Auto-Detect.
   Vendor	Enter VMware.
   Product	Enter vCenter.

</~XSIAM>