Darktrace Syslog Configuration:

Overview: Configure Syslog Forwarding in Darktrace

Before CCE can start ingesting data from Darktrace, a Darktrace administrator with UI access must configure Darktrace to send syslog to the CCE(Collector).

Configuration Process: To configure syslog forwarding in Darktrace:

1. Log in to Darktrace interface;

2. Expand top left menu and select Admin, a second menu appears;

3. Select System Config page

1. In Alerting section, click on Verify Alert Settings

2. In JSON Syslog Alerts, set field to True

3. Set syslog server to CCE Server’s IP address

4. Set a port 514 UDP to use with the CQ event source

5. Set JSON Syslog TCP Alerts to True

Verification: Check the logs flow collection status/system alert tab on the APE to make sure we getting the logs.

Ref link: https://docs.rapid7.com/insightidr/darktrace/