configure – SGBox Next Generation SIEM & SOAR https://www.sgbox.eu Next Generation SIEM & SOAR Tue, 05 Nov 2024 11:36:24 +0000 en-US hourly 1 https://wordpress.org/?v=6.7.1 https://www.sgbox.eu/wp-content/uploads/2020/09/cropped-Logo-SGBox-Trasparente-NO-SCRITTA-150x150.webp configure – SGBox Next Generation SIEM & SOAR https://www.sgbox.eu 32 32 Syslog configuration on MikroTik Firewalls https://www.sgbox.eu/en/knowledge-base/configure-mikrotik-firewalls/ Wed, 24 Jul 2024 13:25:34 +0000 https://www.sgbox.eu/?post_type=epkb_post_type_1&p=26698

Syslog configuration on MikroTik Firewalls

Configure MikroTik Firewalls
  1. Connect the Mikrotik device UI.
  2. Navigate to System > Logging page.
  3. Enter the IP address of SGBox in Remote Address field.
  4. Enter 514 in Remote Port field.
  5. Select the BSD Syslog.
  6. Select local0 in Syslog Facility.
  7. Select Info in Syslog Severity.
Syslog configuration on MikroTik Firewalls
NOTE: You must select BSD Syslog to get the syslog with timestamp value.
]]>
Configure Oracle App https://www.sgbox.eu/en/knowledge-base/configure-oracle-app/ Tue, 03 Jan 2023 10:41:46 +0000 http://10.253.1.91/?post_type=epkb_post_type_1&p=8013 Download and Configure Microsoft SQL App

This articles explain how to configure Oracle App in order to retrieve logs from a specified database table.
Requirements:

  • SGBox version 4.2.5

Go to the application lists from SGBox go to SCM > Applications
Configure Oracle App

Select Vendors Integrations and download the application Log from Oracle. Click on INSTALL. Once Installed click on EDIT icon

Configure Oracle App Configure Oracle App

You need to configure the application as follow:
Configure Oracle App

Host: Database IP
SID: Oracle SID
Port: DB port
Username: Oracle user used to login
Password: Oracle user's password
Star Date: Initial date to retrieve logs
Timestamp field: The Column name that contain the timestamp
Timestamp table: The table that contain the timestamp
Separate field: Character used to separate information once retrieved
Query: query used to extract information

IT’S VERY IMPORTANT TO NOT PUT ANY TIMESTAMP CONDITION OR * IN THE SELECT FIELD

After configured you need to schedule the application to be executed. See this section to know how to schedule an application.

The first time the application has been run some components are added and if everything is ok you can see in LM > Analysis> Historical Search the results
Configure Oracle App

Once executed you’ll see your logs LM > Analysis > Historical Search
Configure Oracle App

If yuo have more databases or more SQL Server you can clone it and configure a new one.
Configure Oracle App

]]>
Configure SNMP service on Windows https://www.sgbox.eu/en/knowledge-base/configure-snmp-service-on-windows/ Tue, 17 Dec 2019 11:42:32 +0000 http://10.253.1.91/?post_type=epkb_post_type_1&p=2781 The Simple Network Management Protocol (SNMP)

This section explain how to configure SNMP service on Windows systems in order to monitoring and collect detailed information about the server.

Requirements:

  • The SNMP service must be installed.

If you want to check or install the SNMP service you can follow this steps:
Clink on Windows > Administrative Tools > Server Manager.
Select Manage > Add Roles and Functions and install the SNMP.

snmpWindows1

Clink on Windows > Administrative Tools > Services.
Right-click SNMP Service and select Properties.
Swtich on Security tab.
Choose the community name and specify the SGBox IP address in the accepted hosts.

snmpWindows2

Click on Apply.

]]>
Configure SNMP Service on Linux https://www.sgbox.eu/en/knowledge-base/configure-snmp-service-on-linux/ Tue, 17 Dec 2019 10:49:45 +0000 http://10.253.1.91/?post_type=epkb_post_type_1&p=2776 The Simple Network Management Protocol (SNMP)

This section explain how to configure SNMP service on Linux systems in order to monitoring and collect detailed information about the server.

Requirements:

  • Check that SNMP service is installed.

The command to install SNMP changes depending on distribution; Debian, RedHat, Centos, Solaris, for this reason we recommend to search the Internet for the correct command to install the service.

Debian/Ubuntu:

apt-get -y install snmpd

RedHad/Centos/Fedora:

yum -y install net-snmp net-snmp-utils

Once the installation is complete, make a copy of your original file and proceed with the configuration.

vim /etc/snmp/snmpd.conf

Specify the listening interface of server for the snmp service.

snmpLinux1

Enter the community name and SGBox ip address.

snmpLinux2

Save changes and restart the SNMP service.

Debian/Ubuntu:

service snmpd restart

RedHad/Centos/Fedora:

service snmpd restart

]]>