Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Nkr
Participant

Forwarding specific logs to external syslog server

Jump to solution

Hi CheckMates!

 

We have a customer currently running R81.10 standalone deployment. They have several customers of their own, using their firewall.
Now my question is, how do we go about sending logs from specific rules to the relevant customers?

 

Things we have thought about as a solution:

User alert running a script forwarding the logs to their syslog server?

LEA Connector with filtering?

Log exporter with filtering?

 

(MDM is not an option)

 

Best Regards.

0 Kudos
1 Solution

Accepted Solutions
Nkr
Participant

I don't seem to be able to filter by rule_uid, only by either action, blade or origin. Looking through the documentation in sk122323 it doesn't mention the rule_uid option. Perhaps I'm missing something?

Log Exporter would solve the case though, if i can get it set up with rule_uid filtering.

 

UPDATE:

In $EXPORTERDIR/targets/<Name of Log Exporter Configuration>/conf/FilterConfiguration.xml

<filters>
  <filterGroup operator="and">
    <field name="action" operator="and">
    </field>
    <field name="origin" operator="and">
    </field>
    <field name="product" operator="and">
    </field>
    <field name="rule_uid" operator="and">
      <value operation="eq">[rule_uid]</value>
    </field>
  </filterGroup>
</filters>

 This seems to work in my case. Appreciate the assistance.

@CPRQ In your case, i think you can add "neq" (not equal) as the value operation, in order to negate one rule, and export the rest.

View solution in original post

0 Kudos
7 Replies
PhoneBoy
Admin
Admin

Log Exporter with filtering would probably be the best way to do this.

0 Kudos
CPRQ
Collaborator

Do Log Exporter support filtering on a specific rule? e.g do not send log of the specific rule to SIEM.

0 Kudos
PhoneBoy
Admin
Admin

You should be able to filter based on rule_uid.

0 Kudos
Nkr
Participant

I don't seem to be able to filter by rule_uid, only by either action, blade or origin. Looking through the documentation in sk122323 it doesn't mention the rule_uid option. Perhaps I'm missing something?

Log Exporter would solve the case though, if i can get it set up with rule_uid filtering.

 

UPDATE:

In $EXPORTERDIR/targets/<Name of Log Exporter Configuration>/conf/FilterConfiguration.xml

<filters>
  <filterGroup operator="and">
    <field name="action" operator="and">
    </field>
    <field name="origin" operator="and">
    </field>
    <field name="product" operator="and">
    </field>
    <field name="rule_uid" operator="and">
      <value operation="eq">[rule_uid]</value>
    </field>
  </filterGroup>
</filters>

 This seems to work in my case. Appreciate the assistance.

@CPRQ In your case, i think you can add "neq" (not equal) as the value operation, in order to negate one rule, and export the rest.

View solution in original post

0 Kudos
PhoneBoy
Admin
Admin

The documentation suggests you should be able to do that.
In which case, it's probably worth a TAC case.

0 Kudos
Cyber_Serge
Collaborator

How about choose not to log on the specific rule? Since it's wont log the event, there's nothing to be forwarded to SIEM.

0 Kudos
CPRQ
Collaborator

We want to log on CP log/mgmt server to see the log for troubleshooting purpose; but don't want to send that log to SIEM.

0 Kudos