...

Overview

We are providing you with the steps to integrate your Bitdefender GravityZone with Seceon SIEM so One can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ). In this document, we are guiding you through the steps for Log forwarding.

Steps of Configuration

Step 1.Log in into GravityZone:

Step 2.Click on Configuration > Miscellaneous
Step3.Put the flag on Enable Syslog and write the IP of CCE

Step 4.Click on configuration button ( the rowel ) in the top-right corner

Step 5.Define the events you want send to CCE.

VERIFICATION OF CONFIGURATION

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Log in to UI >> SYSTEM

...

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS.

...

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

...

Using CCE SERVER

Login to the CCE server as Seceon User and run the below command

“sudo tcpdump -i any host 514 and host <IP address> -AAA” command should be running on the CCE server to check whether or not we are getting logs.