Configure Syslog Logging in Nebula

In addition to the built-in reports available in Nebula, you can send threat-related events to your SIEM solution for security insights, compliance, and visibility. This article provides the steps required to set up Syslog Logging in Nebula.

Events flow

The diagram below represents the Nebula events flow. The flow follows this order:

1. Endpoints report threat detection events to Nebula.
2. The Syslog Communication Endpoint pulls events from Nebula. This data is temporarily stored on the endpoint.
3. The Syslog Communication Endpoint forwards events to the Syslog server in CEF format. The data is then removed from the communication device.

Requirements

• Active subscription or trial for a Nebula platform product:
  • Endpoint Detection and Response
  • Endpoint Protection
  • Incident Response
• Super Admin user access for Nebula.
• A Windows endpoint promoted as the Syslog communication endpoint.
• Network access between your Syslog communication endpoints and SIEM or Syslog server. TCP over port 514 is used by default.

Configuration

Configure the syslog settings and promote a Windows endpoint to be the communication endpoint.

1. Go to Configure > Syslog Logging.
2. In the top-right corner, click Syslog Logging.
3. Fill in the following information, then click Save.
   • IP Address/Host: IP or hostname of your Syslog server.
   • Port: Port you have specified on your Syslog server.
   • Protocol: Select either TCP or UDP protocol.
   • Severity: Choose a Severity from the list. This determines the Severity of all Nebula events sent to Syslog.
   • Communication Interval (Minutes): Determines how often the communication endpoint gathers Syslog data from the Nebula server. If the endpoint is unable to contact Nebula, it buffers data from the last 24 hours. Data older than 24 hours is not sent to Syslog.
     
4. Click Add syslog endpoint.
5. Select a Windows endpoint to promote as the communication endpoint, then click Assign.
6. On the left navigation menu, go to Manage > Endpoints. Click on the Syslog communication endpoint you assigned in Step 5.
7. In the endpoint Agent and plugins section, the SIEM version number displays. This confirms the SIEM plugin has activated on the endpoint.

The endpoint transfers data to Syslog without further configuration.

Change Syslog settings

If you need to change your Syslog communication endpoint, perform the following:

1. Go to Configure > Syslog Logging.
2. Click Remove syslog endpoint to demote the existing endpoint.
3. Click Add syslog endpoint to promote a new endpoint. See the steps above in the Configuration section.

You may temporarily demote a communication endpoint using the On/Off toggle on this screen. Temporarily demoting a communication endpoint can be useful when troubleshooting your Syslog settings.

Example Syslog entry

The following is an example of a Syslog entry generated by Nebula in raw CEF format. The tables below detail the Syslog prefix values, CEF headers, and extensions used in the example.

2018-04-13T21:06:05Z MININT-16Tjdoe CEF:0|Malwarebytes|Malwarebytes Endpoint Protection|Endpoint Protection 1.2.0.719|Detection|Website blocked|1|deviceExternalId=e150291a2b2513b9fd67941ab1135afa41111111 dvchost=MININT-16Tjdoe deviceDnsDomain=jdoeTest.local dvcmac=00:0C:29:33:C6:6A dvc=192.168.2.100 rt=Apr 13 2018 21:05:56 Z fileType=OutboundConnection cat=Website act=blocked msg=Website blocked\\nProcess name: C:\\Users\\vmadmin\\Desktop\\test.exe filePath=drivinfosproduits.info(81.171.14.67:49846) cs1Label=Detection name cs1=Malicious Websites