Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
sanchez
Participant
Jump to solution

Field default_device_message not being helpful

ssss.pngWhile working with a siem, the use of logs exporter has been a good upgrade from opsec lea. But as you can see in the screenshot; all the important messages are being reported in the default_device_message section. Hence to normalize and take important bits of information; like HTTP login; user= admin ; it is required to extract these fields. Hence for a wide range of syslog messages; a number of signatures need to be added. 
Is there any provision of important fields within default_device_message being extracted within log as  in case of source address :: src=...........?

Help would be much appreciated.

0 Kudos
1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin

Gaia (the underlying OS based on Linux) generates its own logs independent of Access Control and Threat Prevention.
Normally, these logs are kept entirely separate, but can be sent to the same logs that get exported via Log Exporter.
This does not happen by default. 
You can set/change that here from the WebUI on the relevant device(s):

Screen Shot 2020-03-05 at 10.22.12 AM.png

Most of the OS logs have completely different context from the things we log with Access Control and Threat Prevention.
As such, all the information from the OS logs is generally put into a single log field.
You can verify this by reviewing the actual log entries in SmartConsole/SmartView. 
When those logs are exported via Log Exporter, they likewise end up in a single log field.

In other words, this is working as expected.
If you export syslog directly from the devices themselves to the SIEM, it's possible the information might be parsed differently.

View solution in original post

0 Kudos
4 Replies
PhoneBoy
Admin
Admin
That doesn't look like a message from Log Exporter but from the Gaia OS.
0 Kudos
sanchez
Participant

I do have other logs too ... but they are of the similar structure with most of the message within the default_message field. What would be the issue with the exporter? How can this issue be solved?

 

0 Kudos
PhoneBoy
Admin
Admin

Gaia (the underlying OS based on Linux) generates its own logs independent of Access Control and Threat Prevention.
Normally, these logs are kept entirely separate, but can be sent to the same logs that get exported via Log Exporter.
This does not happen by default. 
You can set/change that here from the WebUI on the relevant device(s):

Screen Shot 2020-03-05 at 10.22.12 AM.png

Most of the OS logs have completely different context from the things we log with Access Control and Threat Prevention.
As such, all the information from the OS logs is generally put into a single log field.
You can verify this by reviewing the actual log entries in SmartConsole/SmartView. 
When those logs are exported via Log Exporter, they likewise end up in a single log field.

In other words, this is working as expected.
If you export syslog directly from the devices themselves to the SIEM, it's possible the information might be parsed differently.

0 Kudos
sanchez
Participant

thanks !!! you cleared the doubt...

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events