Hi Pratik,
Enter a
name for the action set, such as "To SIEM".
For
Apply to event type, select
Security Violations - All.
From the list of
Available Action Interfaces, look for
Server System Log > Log security event to System Log (syslog) using the CEF standard and click the blue arrow to move the entry up into the
Selected Actions field.
Pay close attention to the wording as there are several entries that look similar.
Figure 1
In Figure 2 below, enter a name in the
Name field. (such as To SIEM)
Enter the syslog host in the
Syslog Host field.
Place a check in the box for
Run on Every Event and click
Save at the top right,
Figure 2
The action set is now available for use, however, the existing policies must be configured to leverage the action set.
Access
Main > Policies > Security
You will now see 6 pages of policies by default.
For each policy violation that you would like to be sent to the SIEM, right click that entry and select
Set Followed Action.
Select
To SIEM and click
Save.
------------------------------
Jaired Anderson
Principal Consultant
Imperva
Tulsa OK
------------------------------
Original Message:
Sent: 02-26-2020 05:00
From: Pratik Wagle
Subject: How to forward Securesphere security audit logs to syslog?
Hello,
Thanks for your insights on the matter. When I create a new Action Set though, I can't see the "Audit" option.
------------------------------
Pratik Wagle
NTT Netmagic
Original Message:
Sent: 02-24-2020 03:51
From: Sabajete Elezaj
Subject: How to forward Securesphere security audit logs to syslog?
Hello,
I am not familiar with version 11.5, but I believe is the same procedure as higher versions. You should create an Action Set and enable it as followed action to the audit policy needed. Below are explained Action Sets and Followed Actions. https://docs.imperva.com/bundle/v13.5-web-application-firewall-user-guide/page/2399.htm
When you create the Action Set make sure to select the "Audit" event type.
As for implications, try to enable it in light audit policies because too many events can overwhelm your syslog server.
------------------------------
Sabajete Elezaj
SNT Albania
Original Message:
Sent: 02-22-2020 12:52
From: Pratik Wagle
Subject: How to forward Securesphere security audit logs to syslog?
How to forward Imperva Securesphere security audit logs to syslog and what are its implications? I'm currently running on v11.5.
#On-PremisesWAF(formerlySecuresphere)
------------------------------
Pratik Wagle
------------------------------