Versions Compared

Old Version 3

changes.mady.by.user Customer Success & Engineering

Saved on

compared with

New Version 4

changes.mady.by.user Customer Success & Engineering

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents

Overview: Configure Syslog Forwarding in Darktrace

Before CCE can start ingesting data from Darktrace, a Darktrace administrator with UI access must configure Darktrace to send syslog to the CCE(Collector).

Configuration Process: To configure syslog forwarding in Darktrace:

  1. Log in to Darktrace interface;

  2. Expand top left menu and select Admin, a second menu appears;

  3. Select System Config page

...

  1. In Alerting section, click on Verify Alert Settings

  2. In JSON Syslog Alerts, set field to True

  3. Set syslog server to CCE Server’s IP address

  4. Set a port 514 UDP to use with the CQ event source

  5. Set JSON Syslog TCP Alerts to True

...

Verification: Check the logs flow collection status/system alert tab on the APE to make sure we getting the logs.

Ref link: https://docs.rapid7.com/insightidr/darktrace/