Syslog v1.2.0

About the connector

The Syslog connector sets up listeners for Syslog messages, supporting both TCP and UDP transmission, and when a message is received, it triggers the FortiSOAR™ playbooks for automated creation of alerts and other predefined response actions.

Version information

Connector Version: 1.2.0

FortiSOAR™ Version Tested on: 7.6.0-5012

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.2.0

Following enhancements have been made to the Syslog connector in version 1.2.0:

• Refactored the code for an optimized performance
• Added a new parameter RFC in the action Parse Message
• Added support for data ingestion

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-syslog

Prerequisites to configuring the connector

• The syslog rpm has a dependency on the lsof package. If you are installing the rpm offline, you must install the lsof rpm prior to configuring the Syslog connector on the FortiSOAR™ instance.
• You must open the ports in the firewall on the FortiSOAR™ instance on which you want the Syslog listeners to run. For example, if you are using the 1514 port with the UDP portocol, then you must open this port on the FortiSOAR™ VM's firewall using the following commands:
  firewall-cmd --zone=public --add-port=1514/udp --permanent
firewall-cmd --reload

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Syslog connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Parse Message

Input parameters

Note: The message complying with both the RFC 3164 and RFC 5424 specifications can be parsed.

Output

The output contains the following populated JSON schema:

{
    "header": "",
    "message": ""
}

operation: Start Listener

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "status": 0,
    "message": ""
}

operation: Stop Listener

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "status": 0,
    "message": ""
}

operation: Restart Listener

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "status": 0,
    "message": ""
}

Included playbooks

The Sample - Syslog - 1.2.0 playbook collection comes bundled with the Syslog connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Syslog connector.

• Parse RFC 3164 formatted message
• Parse RFC 5424 formatted message
• Stop Start Listener for a Configuration
• > Syslog> Fetch
• Syslog > Ingest

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.

Data Ingestion Support

Use the Data Ingestion Wizard to easily ingest data into FortiSOAR™ by pulling data from Syslog. Currently, data ingested from Syslog is mapped to Alerts in FortiSOAR™. For more information on the Data Ingestion Wizard, see the Connectors Guide in the FortiSOAR™ product documentation.

Configure Data Ingestion

You can configure data ingestion using the Data Ingestion Wizard to seamlessly map the incoming Syslog's data to FortiSOAR™'s Alerts.

The Data Ingestion Wizard helps you to configure the scheduled pulling of data from Syslog into FortiSOAR™. It also lets you pull some sample data from Syslog using which you can define the mapping of data between Syslog and FortiSOAR™. The mapping of common fields is generally already done by the Data Ingestion Wizard; users are mostly required to only map any custom fields that are added to the Syslog data.

1. To begin configuring data ingestion, click Configure Data Ingestion on the Syslog connector's Configurations page.

   Click Let's Start by fetching some data, to open the Fetch Data screen.

   

   Sample data is required to create a field mapping between Syslog data and FortiSOAR™. The sample data is pulled from connector actions or ingestion playbooks.

2. On the Fetch Data screen, provide the configurations required to fetch data from Syslog.

   The fetched data is used to create a mapping between the data from Syslog and FortiSOAR Alerts. Once you have completed specifying the configurations, click Fetch Data.

   

3. On the Field Mapping screen, map the fields of the ingested data Syslog to the fields of a Alerts present in FortiSOAR™.

   

   For more information on field mapping, see the Data Ingestion chapter in the Connectors Guide in the FortiSOAR™ product documentation. Once you have completed the mapping of fields, click Save Mapping & Continue.

4. The Summary screen displays a summary of the mapping done, and it also contains links to the Ingestion playbooks. Click Done to complete the data ingestion and exit the Data Ingestion Wizard.

   

Troubleshooting

FortiSOAR™ playbook is not triggered when a message is sent

This could be due to one of the following reasons:

1. The message does not reach the listener because the firewall blocks incoming requests on a port.
2. The API trigger specified in the playbook and the one specified in the configuration do not match.
3. The FortiSOAR™ credentials specified in the configuration are incorrect.

The listener logs are written to /var/log/cyops/cyops-integrations/syslog/listener.log. Check this log file for the exact reason for the failure.