External loggers configuration

For SIEM integration such as Splunk, on MetaDefender Storage Security side, enable syslog to send to Splunk syslog server via specific protocol (TCP/UDP) and port. Then on that syslog server, configure to listen all incoming messages over the protocol and port.

In order to add an external logger configuration:

  1. Navigate to Settings -> External Loggers
  2. Click on Add New Server button

Integrate a Syslog (UDP) external logger

In order to visualize MetaDefender Storage Security audit logs in a centralized dashboard, integration with a Syslog (UDP) server is possible.

Currently we support Syslog (UDP) using the RFC5424 Output format as external logger configuration.

For adding a new Syslog configuration, you will need to enter the following details on the Add External Logger Configuration window:

  • Server address - Ipv4, Ipv6 and Host Name formats are supported
  • Port
  • Syslog Facility
  • Output format - RFC5424 format is supported

Up to 5 different external loggers configurations of each type are supported.

Syslog message format

We support format RFC5424. You can find more details about this format here.

log format example
Copy
Prefix Field (click for more info)Description
PRIPriority value
VERSIONThe version of the syslog protocol specification.
TIMESTAMPA formalized timestamp
HOSTNAMEThe machine that originally sent the syslog message
APP-NAMEThe device or application that originated the message
PROCIDProcess name or ID associated with a syslog system
MSGIDType of the message
STRUCTURED-DATAA mechanism to express information in an easily parseable and interpretable data format
MSGFree-form message that provides information about the event
log example
Copy
Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Next to read:
Single Sign On
On This Page
External loggers configurationIntegrate a Syslog (UDP) external loggerSyslog message format