unix – SGBox Next Generation SIEM & SOAR https://www.sgbox.eu Next Generation SIEM & SOAR Mon, 10 Mar 2025 09:41:55 +0000 en-US hourly 1 https://wordpress.org/?v=6.8 https://www.sgbox.eu/wp-content/uploads/2025/02/cropped-SGBox-symbol-png-32x32.webp unix – SGBox Next Generation SIEM & SOAR https://www.sgbox.eu 32 32 Syslog configuration on Sentinel https://www.sgbox.eu/en/knowledge-base/syslog-configuration-on-sentinel/ Fri, 07 Feb 2025 14:49:56 +0000 https://www.sgbox.eu/?post_type=epkb_post_type_1&p=29453

Configure Sentinel to send logs to SGBox

Open the SentinelOne Admin Console. Configure SentinelOne to send logs to your Syslog server.

  1. Select your site.
  2.  In the left side menu, click the slider icon [⊶] to open the Settings menu.
  3. Open the INTEGRATIONS tab, and fill in the details: ( 3.1 ): Under Types, select SYSLOG ( 3.2 ): Toggle the button to enable SYSLOG: ( 3.3 ): Host – Enter your public SYSLOG server IP address and port. ( 3.4 ): Formatting – Select CEF. ( 3.5 ): Save your changes.
 
Syslog configuration on Sentinel

If TLS is selected you will need to upload certificates.

Syslog configuration on Sentinel
]]> Syslog configuration on ForcePoint https://www.sgbox.eu/en/knowledge-base/syslog-configuration-on-forcepoint/ Fri, 07 Feb 2025 09:21:07 +0000 https://www.sgbox.eu/?post_type=epkb_post_type_1&p=29415 ForcePoint

To send logs to SGBox:

Toggle the Enable SIEM logging switch to ON.

Syslog configuration on ForcePoint
  

  1. Enter the IP address or hostname and communication Port for your SGbox server.
  2. Select a Transport protocol (TCP or UDP).
  3. Configure which logs to send by selecting one or more Threat levels. By default, malicious and suspicious incident logs are forwarded.
  4. Select an SIEM format to use (the default is syslog/CEF).

  5. Click Apply to save your changes.

For further information visit this link: https://www.websense.com/content/support/library/riskvision/v21/system_mgmt/system_logging.aspx 

]]> Syslog configuration on Bitdefender GravityZone https://www.sgbox.eu/en/knowledge-base/syslog-configuration-on-bitdefender-gravityzone/ Fri, 28 Jun 2019 14:37:11 +0000 https://10.253.1.90/sgbox/EN/?post_type=epkb_post_type_1&p=1664 How to configurate Syslog on Bitdefender GravityZone

This guide provides instructions to configure Bitdefender GravityZone to forward Bitdefender GravityZone
logs via syslog. The configurations detailed in this guide are consistent with Bitdefender GravityZone (on-prem) v6.5 to 7.0.

Requirements:

  • Admin access to Bitdefender GravityZone (on-prem) console. If you have cloud console you need to follow this guide.

Note: Bitdefender GravityZone supports the syslog option from v6.50 to 7.0. 

Following are the steps to configure Bitdefender Gravityzone ( On-premises) to send logs to SGBox.

Log in to GravityZone Control center.
Click on Configuration > Miscellaneous.
Put the flag on Enable Syslog and write the IP of your SGBox.
Enter SGBox port (514) and select protocol UDP.

Syslog configuration on Bitdefender GravityZone

Click on configuration button ( the rowel ) in the top-right corner

Syslog configuration on Bitdefender GravityZone

Define the events you want send to SGBox

Syslog configuration on Bitdefender GravityZone

 

After data source appears in SGBox you need to install following package from SCM > Application > Pacakges:


Syslog configuration on Bitdefender GravityZone

 

 

 

]]>