ESET PROTECT On-Prem

Offline | Go online

ESET PROTECT On-Prem – Table of Contents

# Export logs to Syslog

Copy current article URL Share via email

ESET PROTECT On-Prem can export certain logs/events and send them to your Syslog server. Events from the following log categories are being exported to Syslog server: Detection, Firewall, HIPS, Audit and ESET Inspect. Events are generated on any managed client computer running an ESET application (for example, ESET Endpoint Security). These events can be processed by any Security Information and Event Management (SIEM) solution capable of importing events from a Syslog server. Events are written to the Syslog server by ESET PROTECT On-Prem.

1.To enable Syslog server, click More > Settings > Advanced Settings > Syslog server > Use Syslog server.

2.To enable exporting, click More > Settings > Advanced Settings > Logging > Export logs to Syslog.

|  | All exported logs are available to Syslog users without limitations. All audit log messages are exported to Syslog.

3.Choose one of the following formats for event messages:

•JSON (JavaScript Object Notation)

•LEEF (Log Event Extended Format)—format used by IBM's application QRadar.

•CEF (Common Event Format)

To filter the event logs sent to Syslog, create a log category notification with a defined filter.

˄˅