topic Aptilo AC/SPA/MAS - Logging syslog Messages to SIEM in Security https://community.extremenetworks.com/t5/security/aptilo-ac-spa-mas-logging-syslog-messages-to-siem/m-p/28043#M97 Hi<BR /> We have implemented Aptilo platform and would like to get help on the settings for sending syslog to our SIEM:<BR /> <BR /> Aptilo AC<BR /> <BR /> Aptilo CORE 5 - Linux ac1.wificiutada.intra 2.6.18-274.12.1.el5 #1 SMP Tue Nov 29 13:37:35 EST 2011 i686 i686 i386 GNU/Linux<BR /> <BR /> Aptilo Access Controller Version 9.1 Build 2286<BR /> <BR /> <BR /> <BR /> From Aptilo send syslog to remote server SIEM. How we do it? The /etc/syslog.conf File<BR /> <BR /> #kern.* /dev/console<BR /> <BR /> *.info;mail.none;authpriv.none;cron.none -/var/log/messages<BR /> <BR /> local0.=debug -/var/log/apc_debug<BR /> <BR /> local0.=notice -/var/log/apc_notice<BR /> <BR /> local0.=info /var/log/apc_info<BR /> <BR /> local0.=warning /var/log/apc_warning<BR /> <BR /> local0.=err /var/log/apc_error<BR /> <BR /> local0.=crit /var/log/apc_critical<BR /> <BR /> authpriv.* /var/log/secure<BR /> <BR /> mail.* /var/log/maillog<BR /> <BR /> cron.* /var/log/cron<BR /> <BR /> *.emerg *<BR /> <BR /> uucp,news.crit /var/log/spooler<BR /> <BR /> local7.* /var/log/boot.log<BR /> <BR /> <BR /> <BR /> Security events. What?<BR /> <BR /> According to your experience and taking into account the issue of security. What are the events that contributed us something and we should see or monitor the Aptilo platform?<BR /> <BR /> Is there any protocol for this type of device or Log Source Type should use for correct settings? <BR /> <BR /> <BR /> <BR /> <BR /> Regards and thanks,<BR /> <BR /> <BR /> <BR /> <BR /> <BR /> <B>Diego C</B><BR /> <BR /> Tue, 01 Jul 2014 23:59:00 GMT cos 2014-07-01T23:59:00Z Aptilo AC/SPA/MAS - Logging syslog Messages to SIEM https://community.extremenetworks.com/t5/security/aptilo-ac-spa-mas-logging-syslog-messages-to-siem/m-p/28043#M97 Hi<BR /> We have implemented Aptilo platform and would like to get help on the settings for sending syslog to our SIEM:<BR /> <BR /> Aptilo AC<BR /> <BR /> Aptilo CORE 5 - Linux ac1.wificiutada.intra 2.6.18-274.12.1.el5 #1 SMP Tue Nov 29 13:37:35 EST 2011 i686 i686 i386 GNU/Linux<BR /> <BR /> Aptilo Access Controller Version 9.1 Build 2286<BR /> <BR /> <BR /> <BR /> From Aptilo send syslog to remote server SIEM. How we do it? The /etc/syslog.conf File<BR /> <BR /> #kern.* /dev/console<BR /> <BR /> *.info;mail.none;authpriv.none;cron.none -/var/log/messages<BR /> <BR /> local0.=debug -/var/log/apc_debug<BR /> <BR /> local0.=notice -/var/log/apc_notice<BR /> <BR /> local0.=info /var/log/apc_info<BR /> <BR /> local0.=warning /var/log/apc_warning<BR /> <BR /> local0.=err /var/log/apc_error<BR /> <BR /> local0.=crit /var/log/apc_critical<BR /> <BR /> authpriv.* /var/log/secure<BR /> <BR /> mail.* /var/log/maillog<BR /> <BR /> cron.* /var/log/cron<BR /> <BR /> *.emerg *<BR /> <BR /> uucp,news.crit /var/log/spooler<BR /> <BR /> local7.* /var/log/boot.log<BR /> <BR /> <BR /> <BR /> Security events. What?<BR /> <BR /> According to your experience and taking into account the issue of security. What are the events that contributed us something and we should see or monitor the Aptilo platform?<BR /> <BR /> Is there any protocol for this type of device or Log Source Type should use for correct settings? <BR /> <BR /> <BR /> <BR /> <BR /> Regards and thanks,<BR /> <BR /> <BR /> <BR /> <BR /> <BR /> <B>Diego C</B><BR /> <BR /> Tue, 01 Jul 2014 23:59:00 GMT https://community.extremenetworks.com/t5/security/aptilo-ac-spa-mas-logging-syslog-messages-to-siem/m-p/28043#M97 cos 2014-07-01T23:59:00Z