Learn how to set up and activate the Syslog Collector applet on a Broker VM within your network.
To receive Syslog data from an external source, you must first set up the Syslog Collector applet on a Broker VM within your network. The Syslog Collector supports a log ingestion rate of 90,000 logs per second (lps) with the recommended Broker VM setup.
The Syslog collector supports TCP/Secure TCP/UDP. The RFC 6587 standard, which specifies the transmission of syslog messages over TCP, is supported by the Syslog collector. When syslog messages are transmitted over TCP, there are two options:
Octet Framing
Non-Transparent-Framing
This is the most commonly used option. The Syslog collector supports the newline character
\n(Hex 0x0A) as the end-of-line delimiter for syslog messages.
To increase the log ingestion rate, you can add additional CPUs to the Broker VM. The Syslog Collector listens for logs on specific ports and from any or specific IP addresses. A Syslog Collector configuration supports up to 100 ports.
Prerequisite
Perform the following procedures in the order listed below.
Right-click the 514/UDP PORT/PROTOCOL, and select Edit.
Configure these Optional Settings:
Field
Description
Format
Select the Syslog format you want to send to the UDP 514 protocol and port on the Syslog Collector: Auto-Detect (default), CEF, LEEF, CISCO, or RAW.
Note
The Vendor and Product defaults to Auto-Detect when the Log Format is set to CEF or LEEF.
For a Log Format set to CEF or LEEF, Cortex XSIAM reads events row by row to look for the Vendor and Product configured in the logs. When the values are populated in the event log row, Cortex XSIAM uses these values even if you specified a value in the Vendor and Product fields in the Syslog Collector settings. Yet, when the values are blank in the event log row, Cortex XSIAM uses the Vendor and Product that you specified in the Syslog Collector settings. If you did not specify a Vendor or Product in the Syslog Collector settings and the values are blank in the event log row, the values for both fields are set to unknown.
CORELIGHT is not available for a UDP protocol.
Vendor and Product
Specify a particular vendor and product for the Syslog format defined or leave the default Auto-Detect setting.
Source Network
Specify the IP address or Classless Inter-Domain Routing (CIDR). If you leave this blank, Cortex XSIAM will allow receipt of logs from any source IP address or CIDR that transmits over the specified protocol and port. When you specify overlapping addresses in the Source Network field in multiple rows, such as 10.0.0.10 in the first row and 10.0.0.0/24 in the second row, the order of the addresses matter. In this example, the IP address 10.0.0.10 is only captured from the first row definition. For more information on prioritizing the order of the syslog formats, see Task 5.
After each configuration, select
to save the changes and then Done to update the Syslog Collector with your settings.
Select Add New.
Configure these mandatory General settings:
Configure these Optional Settings:
Field
Description
Format
Select the Syslog format you want to send to the protocol and port on the Syslog Collector: Auto-Detect (default), CEF, LEEF, CISCO, CORELIGHT, or RAW.
Note
CORELIGHT is not available for a UDP protocol.
Vendor and Product
Enter a particular vendor and product for the Syslog format defined or leave the default Auto-Detect setting.
Source Network
Specify the IP address or Classless Inter-Domain Routing (CIDR). If you leave this blank, Cortex XSIAM will allow receipt of logs from any source IP address or CIDR that transmits over the specified protocol and port. When you specify overlapping addresses in the Source Network field in multiple rows, such as 10.0.0.10 in the first row and 10.0.0.0/24 in the second row, the order of the addresses matter. In this example, the IP address 10.0.0.10 is only captured from the first row definition. For more information on prioritizing the order of the syslog formats, see Task 5.
After each configuration, select
to save the changes and then Done to update the Syslog Collector with your settings.