Syslog Forwarder
If you have a Syslog server running in your network, you can export logs to Syslog to receive certain events (Detection Event, Firewall Aggregated Event, HIPS Aggregated Event, etc.) from client computers running ESET Endpoint Security.
You can create multiple Syslog configurations and assign them to specific customers.
|
To view and edit Syslog Forwarder you need granted functionality to Settings or to Integrations and Marketplace. |
On the Marketplace, find Syslog Forwarder and click Connect. Specify the following general settings:
1.In General settings, specify the following fields:
•Select company—Select the company for which you configure the integration. The field appears only for MSP users.
|
Audit logs are available only if you select MSP customers > All. |
•Name—Type a configuration name.
•Description—Type a description.
•Format of payload:—Select JSON, LEEF or CEF.
•Format of envelope of the log— select BSD (specification), Syslog (specification).
•Minimal log level—Information, Warning, Error, Critical or 6514.
•Destination IP or FQDN of TLS-compatible syslog server—Type IPv4 public address or hostname of the destination for Syslog messages.
•Port—Select a port for Syslog messages.
•Octet-counted framing—selected by default. Disable the toggle only if it is not supported by your syslog system.
2.Click Continue.
3.In Log Settings and Certificate, specify:
•Event types to log—Select the type of logs you want to include (Antivirus, HIPS, Firewall, Web protection, Audit Log, Blocked files, ESET Inspect alerts, Incidents).
•Validate CA Root certificates of TLS connections—Click the toggle to enable the certificate validation for the connection between your Syslog server and ESET PROTECT. After enabling the validation, a new text field will be displayed where you can copy and paste the required certificate chain. The server certificate must meet the following requirements:
oThe whole certificate chain in PEM format is uploaded and saved in the Syslog export configuration (this includes root CA, as there are no built-in trusted certificates)
oYour Syslog server's certificate provides a Subject Alternative Name extension (DNS=/IP=), in which at least one record corresponds to the FQDN/IP hostname configuration.
|
You need the certification authority version 3 (and later) with the Basic Constraints certificate extension to pass the validation. The validation of TLS connections applies only to the certificates. Disabling the validation does not affect the TLS settings of ESET PROTECT. |
4.Click Continue.
5.Review the Summary. After making the applicable changes:
•either click Test Log to run the test log before completing to verify the configuration has been set up properly
•or click Finish.
The configuration becomes effective in 10 minutes.
|
The regular application log file is constantly being written to. Syslog only serves as a medium to export certain asynchronous events, such as notifications or various client computer events. |