topic Re: Forwarding specific logs to external syslog server in Firewall and Security Management

Forwarding specific logs to external syslog server

Nkr — Thu, 21 Oct 2021 11:27:46 GMT

Hi CheckMates!

We have a customer currently running R81.10 standalone deployment. They have several customers of their own, using their firewall.
Now my question is, how do we go about sending logs from specific rules to the relevant customers?

Things we have thought about as a solution:

User alert running a script forwarding the logs to their syslog server?

LEA Connector with filtering?

Log exporter with filtering?

(MDM is not an option)

Best Regards.

Re: Forwarding specific logs to external syslog server

PhoneBoy — Thu, 21 Oct 2021 15:15:23 GMT

Log Exporter with filtering would probably be the best way to do this.

Re: Forwarding specific logs to external syslog server

CPRQ — Thu, 21 Oct 2021 15:58:01 GMT

Do Log Exporter support filtering on a specific rule? e.g do not send log of the specific rule to SIEM.

Re: Forwarding specific logs to external syslog server

PhoneBoy — Thu, 21 Oct 2021 16:42:12 GMT

You should be able to filter based on rule_uid.

Re: Forwarding specific logs to external syslog server

Nkr — Fri, 22 Oct 2021 06:40:45 GMT

I don't seem to be able to filter by rule_uid, only by either action, blade or origin. Looking through the documentation in sk122323 it doesn't mention the rule_uid option. Perhaps I'm missing something?

Log Exporter would solve the case though, if i can get it set up with rule_uid filtering.

UPDATE:

In $EXPORTERDIR/targets/<Name of Log Exporter Configuration>/conf/FilterConfiguration.xml

<filters>
  <filterGroup operator="and">
    <field name="action" operator="and">
    </field>
    <field name="origin" operator="and">
    </field>
    <field name="product" operator="and">
    </field>
    <field name="rule_uid" operator="and">
      <value operation="eq">[rule_uid]</value>
    </field>
  </filterGroup>
</filters>

This seems to work in my case. Appreciate the assistance.

@CPRQ In your case, i think you can add "neq" (not equal) as the value operation, in order to negate one rule, and export the rest.

Re: Forwarding specific logs to external syslog server

PhoneBoy — Fri, 22 Oct 2021 17:47:49 GMT

The documentation suggests you should be able to do that.
In which case, it's probably worth a TAC case.

Re: Forwarding specific logs to external syslog server

Cyber_Serge — Sun, 24 Oct 2021 01:00:40 GMT

How about choose not to log on the specific rule? Since it's wont log the event, there's nothing to be forwarded to SIEM.

Re: Forwarding specific logs to external syslog server

CPRQ — Mon, 25 Oct 2021 13:16:52 GMT

We want to log on CP log/mgmt server to see the log for troubleshooting purpose; but don't want to send that log to SIEM.