Duplicate events for the SIEM server via Smart Event

[lucasfn]

Hello community, I have an environment where the export logs in Smart Event are configured for a server in Syslog format.

However, the SIEM team informed me that the collection server is receiving 2 formats, CEF and Syslog. The CEF event is sending the same information as the other event that is in syslog format, but with a messed up header, whereas the correct information should be in each column within the SIEM tool.

I would like to understand why the collection server is receiving in CEF format if the export is configured to be in Syslog format.

The SIEM team performed a traffic capture and is only receiving traffic from Smart Event.

I consulted management and it is also exporting to the same SIEM server and in Syslog format. Does anyone have any idea why this CEF log is being sent? Is this normal behavior?

[the_rock]

Can you send output of cp_log_export show?

Also, check out below file to make sure there is nothing unusual there.

From my lab, but you get an idea.

Andy

[Expert@CP-MANAGEMENT:0]# pwd
/opt/CPrt-R82/log_exporter/targets/test-log
[Expert@CP-MANAGEMENT:0]# ls
CPMICache fieldsMapping.xml log_indexer_custom_settings.conf
conf log targetConfiguration.xml
data log_exporter tmp
[Expert@CP-MANAGEMENT:0]# more targetConfiguration.xml

[the_rock]

@lucasfn 

I meant below lines specifically.

Andy

<format type="splunk"> <!--syslog | cef | rsa | leef | generic | splunk | this parameter may differ from the type of destination, for example, destination type = files/format type = CEF -->

[lucasfn]

I got the following feedback. I see that there is another configuration in the CEF format within Smart Event. However, the only server that is configured is this LogExporter_Test_1.

[the_rock]

That would most likely explain the issue.

[the_rock]

Can you delete the first entry and try?

Andy

[lucasfn]

I will delete it and validate it with the SIEM team. I will be back soon to tell you the result. In the meantime, I appreciate your support.

[the_rock]

Im positive that will work.

Andy