Darktrace Syslog Configuration:

Configure Syslog Forwarding in Darktrace

Before InsightIDR can start ingesting data from Darktrace, a Darktrace administrator with UI access must configure Darktrace to send syslog to the InsightIDR Collector.

To configure syslog forwarding in Darktrace:

1. Log in to the Darktrace interface.

2. Within the Threat Visualizer, navigate to Admin > System Config.

3. From the left-hand menu, select Modules and choose Syslog from the available Workflow Integrations.

4. In the configuration window, select the relevant form of Syslog - here, it's Syslog JSON - and click New to open the configuration settings.

5. Set the JSON Syslog Alerts field to true.

6. In the JSON Syslog Server field, specify the IP address of the InsightIDR Collector.

7. In the JSON Syslog Server Port field, specify a unique port over 1024 that you will use with the InsightIDR event source.

8. Set the JSON Syslog TCP Alerts field to true.

Darktrace will automatically save your changes.