Fortinet black logo

Syslog v1.0.0

Copy Link
Copy Doc ID 2ec51165-7573-4e23-bdd0-5a849005aaa1:1

About the connector

The Syslog connector sets up listeners for syslog messages, supporting both TCP and UDP transmission, and when a message is received, triggers the FortiSOAR™ playbooks for automated creation of alerts and other predefined response actions.

Version information

Connector Version: 1.0.0

FortiSOAR™ Version Tested on: 4.9.0.0-708 and later

Authored By: Fortinet

Certified: Yes

Installing the connector

All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:

yum install cyops-connector-syslog

Prerequisites to configuring the connector

  • The syslog rpm has a dependency on lsof package. If you are installing the rpm offline, you must install the lsof rpm prior configuring the syslog connector on the CyOps instance.
  • You must open the ports in the firewall on the FortiSOAR™ instance on which you want the Syslog listeners to run.

Configuring the connector

Configuration parameters

In FortiSOAR™, on the Connectors page, select the Syslog connector and click Configure to configure the following parameters:

Parameter Description
Listener Protocol Protocol of the listener protocol. Specify either TCP or UDP.
Listener Port Port on which the listener starts. Since the listener is started as a non-root user, ensure that you provide a port higher than 1024.
CyberSponse Endpoint (/api/triggers/1/ will be prepended) API Trigger URL for the playbook to be triggered when a Syslog message is received.
CyberSponse Username Username required for authentication to forward the Syslog message to FortiSOAR™.
CyberSponse Password Password required for authentication to forward the Syslog message to FortiSOAR™.

Actions supported by the connector

The following automated operations can be included in playbooks:

  • Parse Message: Parses a Syslog message that follows the specifications provided in RFC 3164 or in RFC 5424.
  • Start Listener: Starts the listener for a specified configuration.
  • Stop Listener: Stops the listener for a specified configuration.
  • Restart Listener: Restarts the listener for a specified configuration.

Note: You can also restart listeners for all configurations by Deactivating and Activating the connector on the Connectors page in FortiSOAR™ (Automation > Connectors).

operation: Parse Event

Input parameters

Parameter Description
Message Format Specify whether the message to be parsed is in the RFC 3164 or RFC 5424 format.

Note: The message complying to both the RFC 3164 or RFC 5424 specifications can be parsed.

Output

This function parses the Syslog message and returns a JSON with the message fields.

Following image displays a sample output, when the message format is RFC 3164 :

Sample output of the Parse Event operation

Following image displays a sample output, when the message format is RFC 5424 :

Sample output of the Parse Event operation

operation: Start Listener

Input parameters

None.

Use this function to start the listener for a given configuration. Note that the listener for a configuration is started by default as soon as the configuration is added, or if connector is activated.

Output

The JSON output contains the status code and a message.

Following image displays a sample output:

Sample output of the Start Listener operation

operation: Stop Listener

Input parameters

None.

Use this function to stop the listener for a given configuration. Note that the listener for a configuration is started by default as soon as the configuration is deleted, or if connector is deactivated.

Output

The JSON output contains the status code and a message.

Following image displays a sample output:

Sample output of the Stop Listener operation

operation: Restart Listener

Input parameters

None.

Use this function to restart the listener for a given configuration.

Output

The JSON output contains the status code and a message.

Following image displays a sample output:

Sample output of the Restart Listener operation

Included playbooks

The Sample - Syslog - 1.0.0 playbook collection comes bundled with the Syslog connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Syslog connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.

Troubleshooting

FortiSOAR™ playbook is not triggered when a message is sent

This could be due to one of the following reasons:

  1. The message does not reach the listener because firewall blocks incoming requests on a port.
  2. The API trigger specified in the playbook and the one specified in the configuration do not match.
  3. The FortiSOAR™ credentials specified in the configuration are incorrect.

The listener logs are written to /var/opt/cyops-integrations/syslog/listener.log. Check this log file for the exact reason for the failure.

All configurations are in Disconnected state when the FortiSOAR™ instance is rebooted, or the uwsgi service is restarted

This happens because listeners are not configured to come up automatically after a service restart. You must Deactivate and Activate the connector to start all listeners again.

Previous
Next

About the connector

The Syslog connector sets up listeners for syslog messages, supporting both TCP and UDP transmission, and when a message is received, triggers the FortiSOAR™ playbooks for automated creation of alerts and other predefined response actions.

Version information

Connector Version: 1.0.0

FortiSOAR™ Version Tested on: 4.9.0.0-708 and later

Authored By: Fortinet

Certified: Yes

Installing the connector

All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:

yum install cyops-connector-syslog

Prerequisites to configuring the connector

Configuring the connector

Configuration parameters

In FortiSOAR™, on the Connectors page, select the Syslog connector and click Configure to configure the following parameters:

Parameter Description
Listener Protocol Protocol of the listener protocol. Specify either TCP or UDP.
Listener Port Port on which the listener starts. Since the listener is started as a non-root user, ensure that you provide a port higher than 1024.
CyberSponse Endpoint (/api/triggers/1/ will be prepended) API Trigger URL for the playbook to be triggered when a Syslog message is received.
CyberSponse Username Username required for authentication to forward the Syslog message to FortiSOAR™.
CyberSponse Password Password required for authentication to forward the Syslog message to FortiSOAR™.

Actions supported by the connector

The following automated operations can be included in playbooks:

Note: You can also restart listeners for all configurations by Deactivating and Activating the connector on the Connectors page in FortiSOAR™ (Automation > Connectors).

operation: Parse Event

Input parameters

Parameter Description
Message Format Specify whether the message to be parsed is in the RFC 3164 or RFC 5424 format.

Note: The message complying to both the RFC 3164 or RFC 5424 specifications can be parsed.

Output

This function parses the Syslog message and returns a JSON with the message fields.

Following image displays a sample output, when the message format is RFC 3164 :

Sample output of the Parse Event operation

Following image displays a sample output, when the message format is RFC 5424 :

Sample output of the Parse Event operation

operation: Start Listener

Input parameters

None.

Use this function to start the listener for a given configuration. Note that the listener for a configuration is started by default as soon as the configuration is added, or if connector is activated.

Output

The JSON output contains the status code and a message.

Following image displays a sample output:

Sample output of the Start Listener operation

operation: Stop Listener

Input parameters

None.

Use this function to stop the listener for a given configuration. Note that the listener for a configuration is started by default as soon as the configuration is deleted, or if connector is deactivated.

Output

The JSON output contains the status code and a message.

Following image displays a sample output:

Sample output of the Stop Listener operation

operation: Restart Listener

Input parameters

None.

Use this function to restart the listener for a given configuration.

Output

The JSON output contains the status code and a message.

Following image displays a sample output:

Sample output of the Restart Listener operation

Included playbooks

The Sample - Syslog - 1.0.0 playbook collection comes bundled with the Syslog connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Syslog connector.

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.

Troubleshooting

FortiSOAR™ playbook is not triggered when a message is sent

This could be due to one of the following reasons:

  1. The message does not reach the listener because firewall blocks incoming requests on a port.
  2. The API trigger specified in the playbook and the one specified in the configuration do not match.
  3. The FortiSOAR™ credentials specified in the configuration are incorrect.

The listener logs are written to /var/opt/cyops-integrations/syslog/listener.log. Check this log file for the exact reason for the failure.

All configurations are in Disconnected state when the FortiSOAR™ instance is rebooted, or the uwsgi service is restarted

This happens because listeners are not configured to come up automatically after a service restart. You must Deactivate and Activate the connector to start all listeners again.

Previous
Next