Configure Syslog Forwarding in Darktrace
Before InsightIDR can start ingesting data from Darktrace, a Darktrace administrator with UI access must configure Darktrace to send syslog to the InsightIDR Collector.
To configure syslog forwarding in Darktrace:
Log in to the Darktrace interface.
Within the Threat Visualizer, navigate to Admin > System Config.
From the left-hand menu, select Modules and choose Syslog from the available Workflow Integrations.
In the configuration window, select the relevant form of Syslog - here, it's Syslog JSON - and click New to open the configuration settings.
Set the JSON Syslog Alerts field to true.
In the JSON Syslog Server field, specify the IP address of the InsightIDR Collector.
In the JSON Syslog Server Port field, specify a unique port over 1024 that you will use with the InsightIDR event source.
Set the JSON Syslog TCP Alerts field to true.
...
| Table of Contents |
|---|
Overview
We are providing you with the steps to integrate your Darktrace with Seceon SIEM so One can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ). In this document, we are guiding you through the steps for Log forwarding.
Steps Of Configuration
Log in to Darktrace interface;
Expand top left menu and select Admin, a second menu appears;
Select System Config page
...
In Alerting section, click on Verify Alert Settings
In JSON Syslog Alerts, set field to True
Set syslog server to CCE Server’s IP address
Set a port 514 UDP to use with the CQ event source
Set JSON Syslog TCP Alerts to True
...
Ref link: https://docs.rapid7.com/insightidr/darktrace/
Verification Of Configuration
Verification can be done either from CCE Server or from UI.
Verification On the Seceon UI
Step 1: Log in to UI with Administrative Rights & Navigate to System>> Log/Flow Collection Status Option.
...
Steps 2: Inside Source Device IP, the IP Address of the Device will reflect including the no. of logs sent to the Seceon Servers.
...
Using CCE Server
“sudo tcpdump -i any host 514 and host <IP address> -AAA” command should be running on the CCE server to check whether or not we are getting logs.