Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  Log Forwarding to Syslog(Google chronicle)

    Posted 09-29-2025 01:43
    Edited by Mohammad Musaib Rather 10-12-2025 05:43

    Our SOC team has raised an issue that they need to see raw and parsed query message when we are forwarding logs to syslog, i have added below message format under syslog configuration:

    Can you please confirm if this is correct cef format or can you share the correct one!

    Inc.|SecureSphere|${SecureSphereVersion}|${Event.eventType}|#cefEscapeMessage(${Event.message})|${Event.severity.displayName}|suser=#cefEscapeExtension(${Event.username}) rt=#ISO8601Date(${Event.createTime}) cat=SystemEvent session=#cefEscapeExtension(${Event.sessionIdentifier}) requestIP=#cefEscapeExtension(${Event.requestIP}) cs20Label=ErrorMessage cs20=#cefEscapeExtension(${Event.errorMessage}) cs15Label=RawQuery cs15=#cefEscapeExtension(${Event.rawQuery}) cs16Label=NormalizedQuery cs16=#cefEscapeExtension(${Event.normalizedQuery})


    #DatabaseActivityMonitoring

    ------------------------------
    Mohammad Musaib Rather

    ------------------------------



  • 2.  RE: Log Forwarding to Syslog(Google chronicle)

    Posted 09-29-2025 05:45
    Edited by Mohammad Musaib Rather 10-12-2025 05:43

    can you please confirm using cef format can we forward normalised query and raw query to syslog, i have used number to options still failing,



    ------------------------------
    Mohammad Musaib Rather

    ------------------------------

    Original Message


  • 3.  RE: Log Forwarding to Syslog(Google chronicle)

    Posted 09-30-2025 09:04

    Yes, in case of Security Events like Alerts, using syslog one can forward both parsed and raw queries to SIEM.



    ------------------------------
    SBISOC 4430
    Manager
    Mumbai
    ------------------------------

    Original Message


  • 4.  RE: Log Forwarding to Syslog(Google chronicle)

    Posted 09-30-2025 09:02

    Hi Musaib,

    Please refer to the link to understand various available placeholders and construct syslog format accordingly.

    https://docs-cybersec.thalesgroup.com/bundle/v14.19-dam-user-guide/page/11274.htm

    csX=#jsonEscaper(${Event.struct.query.parsedQuery}) csXLabel=ParsedQuery csX=#jsonEscaper($!{Event.struct.rawData.rawData}) csXLabel=RawQuery csX=${Event.struct.application.application} csXLabel=SourceApplicationName csX=#jsonEscaper($!{Event.struct.complete.errorMessage}) csXLabel=ErrorMsgByDatabase 

    Regards,



    ------------------------------
    SBISOC 4430
    Manager
    Mumbai
    ------------------------------

    Original Message