Sources

• 1: Generic tips
• 2: OpenTelemetry
• 3: Syslog
• 4: Syslog (autodetect and classify)
• 5: Webhook
• 6: Windows Event Collector (WEC)
• 7: Vendors
• 7.1: Amazon
• 7.1.1: CloudWatch
• 7.2: Cisco
• 7.2.1: Adaptive Security Appliance (ASA)
• 7.2.2: Application Control Engine (ACE)
• 7.2.3: Cisco IOS
• 7.2.4: Digital Network Architecture (DNA)
• 7.2.5: Email Security Appliance (ESA)
• 7.2.6: Firepower
• 7.2.7: Firepower Threat Defence (FTD)
• 7.2.8: Firewall Services Module (FWSM)
• 7.2.9: HyperFlex (HX, UCSH)
• 7.2.10: Integrated Management Controller (IMC)
• 7.2.11: IOS XR
• 7.2.12: Meraki MX
• 7.2.13: Private Internet eXchange (PIX)
• 7.2.14: TelePresence Video Communication Server (VCS)
• 7.2.15: Unified Computing System Manager (UCSM)
• 7.2.16: Unified Communications Manager (UCM)
• 7.2.17: Viptela
• 7.3: Citrix
• 7.3.1: Netscaler
• 7.4: CyberArk
• 7.4.1: Privileged Threat Analytics (PTA)
• 7.4.2: Vault
• 7.5: F5 Networks
• 7.5.1: BIG-IP
• 7.6: FireEye
• 7.7: Fortinet
• 7.7.1: FortiGate firewalls
• 7.7.2: FortiMail
• 7.7.3: FortiWeb
• 7.8: Fortra
• 7.8.1: Powertech SIEM Agent for IBM i
• 7.9: Imperva
• 7.9.1: Incapsula
• 7.9.2: SecureSphere
• 7.10: Infoblox
• 7.10.1: NIOS
• 7.11: Ivanti
• 7.11.1: Connect secure
• 7.12: Juniper
• 7.12.1: Junos OS
• 7.13: Kaspersky
• 7.13.1: Endpoint Security
• 7.14: MicroFocus
• 7.15: Microsoft
• 7.15.1: Azure Event Hubs
• 7.15.2: Windows hosts
• 7.16: MikroTik
• 7.16.1: RouterOS
• 7.17: Netgate
• 7.17.1: pfSense
• 7.18: Netmotion
• 7.18.1: Netmotion
• 7.19: NETSCOUT
• 7.19.1: Arbor Edge Defense (AED)
• 7.20: OpenText
• 7.20.1: ArcSight
• 7.21: Palo Alto Networks
• 7.21.1: Cortex XSOAR
• 7.21.2: Palo Alto firewalls
• 7.22: Powertech
• 7.23: Riverbed
• 7.23.1: SteelConnect
• 7.23.2: SteelHead
• 7.24: rsyslog
• 7.25: SecureAuth
• 7.25.1: Identity Platform
• 7.26: SonicWall
• 7.26.1: SonicWall
• 7.27: syslog-ng
• 7.28: Thales
• 7.28.1: Vormetric Data Security Platform
• 7.29: Trellix
• 7.29.1: Central Management System (CMS)
• 7.29.2: Endpoint Security (HX)
• 7.29.3: ETP
• 7.29.4: MPS
• 7.30: Trend Micro
• 7.30.1: Deep Security Agent
• 7.31: Varonis
• 7.31.1: DatAdvantage
• 7.32: Vectra AI
• 7.32.1: X-Series
• 7.33: Zscaler appliances
• 7.33.1: Zscaler Nanolog Streaming Service
• 7.33.2: Zscaler Log Streaming Service
• 8: Cloud sources
• 8.1: A10 Networks
• 8.1.1: vThunder
• 8.2: Imperva
• 8.2.1: Incapsula
• 8.3: Microsoft
• 8.3.1: Cloud App Security (MCAS)

1 - Generic tips

The following section gives you a generic overview on how to configure a source to send its log data to Axoflow. If there is a specific section for your source, follow that instead of the generic procedure. For details, see the documentation of your source.

Default connectors

By default, an AxoRouter deployment has the following connectors configured:

• OpenTelemetry
• Syslog (autodetect and classify)

Open ports

By default, AxoRouter accepts data on the following ports:

• 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
• 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
• 6514 TCP for TLS-encrypted syslog traffic.

• 4317 TCP for OpenTelemetry log data.

To receive data on other ports or other protocols, configure the source connectors of the AxoRouter host.

Make sure to enable the ports you’re using on the firewall of your host.

Prerequisites

To configure a source to send data to Axoflow, make sure that:

• You have administrative access to the device or host.
• The date, time, and time zone are correctly set on the source.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the source.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps

1. Log in to your device. You need administrator privileges to perform the configuration.

2. If needed, enable syslog forwarding on the device.

3. Set AxoRouter as the syslog server. Typically, you can configure the following parameters:

   • Name or IP Address of the syslog server: Set the address of your AxoRouter.

   • Protocol: If possible, set TCP or TLS.

   • Syslog Format: If possible, set RFC5424 (or equivalent), otherwise leave the default.

   • Port: Set a port appropriate for the protocol and syslog format you have configured.

     By default, AxoRouter accepts data on the following ports:

     • 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
     • 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
     • 6514 TCP for TLS-encrypted syslog traffic.
     • 4317 TCP for OpenTelemetry log data.

     To receive data on other ports or other protocols, configure the source connectors of the AxoRouter host.

     Make sure to enable the ports you’re using on the firewall of your host.

4. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

2 - OpenTelemetry

Receive logs, metrics, and traces from OpenTelemetry clients over the OpenTelemetry Protocol (OTLP/gRPC).

Add new OpenTelemetry connector

To add a new connector to an AxoRouter host, complete the following steps:

1. Create a new connector.

   1. Find the host.

   2. Select Connectors. The list of connectors available on the host is displayed.

      

   3. Select add , then select the type of connector you want to create.

      

   4. Enter a Name for the connector. This name must be unique on the host.

      

   5. (Optional) Add custom labels to the connector.

      You can also modify the product and vendor labels of the connector. In that case, Axoflow will treat the incoming messages as it was received and classified as data from the specified product. This is useful if you want to send data from a specific product to a dedicated port.

      These labels and other parameters of the connector will be available under the meta.connector key as metadata for the messages received via the connector, and can be used in routing decisions and processing steps. You can check the metadata of the messages using log tapping.

      

2. If needed, configure the port number where you want to receive data.

3. Select Create.

4. Make sure to enable the ports you’ve configured in the connector on the firewall of the AxoRouter host, and on other firewalls between the AxoRouter host and your data sources.

Labels

3 - Syslog

The Syslog connector can receive all kinds of syslog messages. You can configure it to receive data on specific ports, but it doesn’t apply classification and enrichment to the messages (apart from standard syslog parsing).

Add new syslog connector

To add a new connector to an AxoRouter host, complete the following steps:

1. Create a new connector.

   1. Find the host.

   2. Select Connectors. The list of connectors available on the host is displayed.

      

   3. Select add , then select the type of connector you want to create.

      

   4. Select the template to use one of the standard syslog ports and networking protocols, for example, UDP 514 for the RFC3164 syslog protocol.

      To configure a different port, or to specify the protocol elements manually, select Custom.

      

   5. Enter a Name for the connector. This name must be unique on the host.

      

   6. (Optional) Add custom labels to the connector.

   7. Select the protocol to use for receiving syslog data: TCP, UDP, or TLS.

      When using TLS, set the paths for the certificates and keys used for the TLS-encrypted communication with the clients.

      You can use absolute paths (for example, /etc/axorouter/user-config/tls-key.pem). The key and the certificate must be in PEM format. You must manually copy these files to their place on the AxoRouter host, currently you can’t distribute them from Axoflow Console.

      • CA certificate path: The CA certificate that AxoRouter uses to authenticate the clients.
      • Server certificate path: The certificate that AxoRouter shows to the clients.
      • Server private key path: The private key of the server certificate.

   8. (Optional) If explicitly needed for your use case, you can configure *Framing manually. Otherwise, leave it on Auto. Enable framing (On) if the payload contains the length of the message as specified in RFC6587 3.4.1. Disable (Off) for non-transparent-framing RFC6587 3.4.2.

   9. Set the Port of the connector. The port number must be unique on the AxoRouter host.

   10. (Optional) If needed for your environment, set protocol-specific connector options as needed.

       You can also modify the product and vendor labels of the connector. In that case, Axoflow will treat the incoming messages as it was received and classified as data from the specified product. This is useful if you want to send data from a specific product to a dedicated port.

       These labels and other parameters of the connector will be available under the meta.connector key as metadata for the messages received via the connector, and can be used in routing decisions and processing steps. You can check the metadata of the messages using log tapping.

       

2. Select Create.

3. Make sure to enable the ports you’ve configured in the connector on the firewall of the AxoRouter host, and on other firewalls between the AxoRouter host and your data sources.

Protocol-specific connector options

• Encoding: The character set of the messages, for example, UTF-8.
• Maximum connections: The maximum number of simultaneous connections the connector can receive.
• Socket buffer size: The size of the socket buffer (in bytes).

TCP options

• TCP Keepalive Time Interval: The interval (number of seconds) between subsequential keepalive probes, regardless of the traffic exchanged in the connection.
• TCP Keepalive Probes: The number of unacknowledged probes to send before considering the connection dead.
• TCP Keepalive Time: The interval (in seconds) between the last data packet sent and the first keepalive probe.

TLS options

For TLS, you can use the TCP-specific options, and also the following:

• Require MTLS: If enabled, the clients sending data to the connector must have a TLS certificate, otherwise AxoRouter will reject the connection.
• Verify client certificate: If enabled, AxoRouter verifies certificate of the client, and rejects connections with invalid certificates.

Labels

The AxoRouter syslog connector adds the following meta labels:

4 - Syslog (autodetect and classify)

The Syslog (autodetect and classify) connector receives all kinds of syslog data, automatically recognizing the type and format (RFC3164, RFC5424) of the protocol used. It also automatically parses and classifies the incoming messages, recognizing and enriching over 100 data sources.

The Syslog (autodetect and classify) connector receives data on the following ports:

• 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
• 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
• 6514 TCP for TLS-encrypted syslog traffic.

Add new syslog connector

To add a new connector to an AxoRouter host, complete the following steps:

1. Create a new connector.

   1. Find the host.

   2. Select Connectors. The list of connectors available on the host is displayed.

      

   3. Select add , then select the type of connector you want to create.

      

   4. Enter a Name for the connector. This name must be unique on the host.

      

   5. (Optional) Add custom labels to the connector.

      You can also modify the product and vendor labels of the connector. In that case, Axoflow will treat the incoming messages as it was received and classified as data from the specified product. This is useful if you want to send data from a specific product to a dedicated port.

      These labels and other parameters of the connector will be available under the meta.connector key as metadata for the messages received via the connector, and can be used in routing decisions and processing steps. You can check the metadata of the messages using log tapping.

      

2. (Optional) If you’re creating a multi-level AxoRouter architecture and you want to forward the data received to this connector to another AxoRouter, set the Address Override option to the address of the AxoRouter.

3. Select Create.

4. Make sure to enable the ports you’ve configured in the connector on the firewall of the AxoRouter host, and on other firewalls between the AxoRouter host and your data sources.

Labels

The Syslog (autodetect and classify) connector adds the following meta labels:

5 - Webhook

Webhook connectors of AxoRouter can be used to receive log events through HTTP(S) POST requests.

You can specify static and dynamic URLs to receive the data. AxoRouter automatically parses the JSON payload of the request, and adds it to the log.body field of the message as a JSON object. Other types of payload (including invalid JSON objects) is added to the log.body field as a string. Note that you can add further parsing to the body using processing steps in Flows, for example, using FilterX or Regex processing steps.

Prerequisites

To receive data via HTTPS, you’ll need a key and a certificate that the connector will show to the clients.

• Key: The key file must contain an unencrypted private key in PEM or DER format, suitable as a TLS key. The Axoflow application uses this private key and the matching certificate to encrypt the communication with the client.
• Certificate: The file must contain an X.509 certificate (or a certificate chain) in PEM or DER format, suitable as a TLS certificate, matching the private key set in the Key option. If the file contains a certificate chain, the file must begin with the certificate of the AxoRouter host, followed by the CA certificate that signed the certificate of the host, and any other signing CAs in order.

Add new webhook connector

To add a new connector to an AxoRouter host, complete the following steps:

1. Create a new connector.

   1. Find the host.

   2. Select Connectors. The list of connectors available on the host is displayed.

      

   3. Select add , then select the type of connector you want to create.

      

   4. Enter a Name for the connector. This name must be unique on the host.

      

   5. (Optional) Add custom labels to the connector.

      You can also modify the product and vendor labels of the connector. In that case, Axoflow will treat the incoming messages as it was received and classified as data from the specified product. This is useful if you want to send data from a specific product to a dedicated port.

      These labels and other parameters of the connector will be available under the meta.connector key as metadata for the messages received via the connector, and can be used in routing decisions and processing steps. You can check the metadata of the messages using log tapping.

      

2. Select the protocol you want to use: HTTPS or HTTP.

3. Set the port number where the webhook will receive the POST requests, for example, 8080.

4. Set the endpoints where the webhook will receive data in the Paths field. You can use static paths, or regular expressions. In regular expressions you can use named capture groups to automatically set macro values in AxoRouter. For example, the /events/(?P<HOST>.*) path sets the hostname for the data received in the request based on the second part of the URL: a request to the /events/my-example-host URL sets the host field of that message to my-example-host.

   By default, the /events and /events/(?P<HOST>.*) paths are active.

5. For HTTPS endpoints, set the path to the Key and the Certificate files. AxoRouter uses these to encrypt the TLS channel. You can use absolute paths (for example, /etc/axorouter/user-config/tls-key.pem). The key and the certificate must be in PEM format.

   You must manually copy these files to their place, currently you can’t distribute them from Axoflow.

6. Select Create.

7. Make sure to enable the ports you’ve configured in the connector on the firewall of the AxoRouter host, and on other firewalls between the AxoRouter host and your data sources.

8. Send a test request to the webhook.

   1. Open the Overview tab of the AxoRouter host where you’ve created the webhook connector and check the IP address or FQDN of the host.

   2. Open a terminal on your computer and send a POST request to the path you’ve configured in the webhook.

      curl -X POST -H 'Content-Type: application/json' --data '{"host":"myhost", "body": "sample webhook message" }' <;router-IP-address>:<webhook-port-number>/<webhook-path>/
      

      For example, if you’ve used the default values of the webhook connector you can use:

      curl -X POST -H 'Content-Type: application/json' --data '{"host":"myhost", "body": "sample webhook message" }' <;router-IP-address>/events/
      

      Expected output:

      {"status": "received"}
      

Note You can also use Log tapping on the AxoRouter host to see the incoming messages.

6 - Windows Event Collector (WEC)

The AxoRouter Windows Events connector can receive Windows Event Logs by running a Windows Event Collector (WEC) server. After enabling the Windows Events connector, you can configure your Microsoft Windows hosts to forward their event logs to AxoRouter using Windows Event Forwarding (WEF).

Windows Event Forwarding (WEF) reads any operational or administrative event logged on a Windows host and forwards the events you choose to a Windows Event Collector (WEC) server - in this case, AxoRouter.

Prerequisites

When using TLS authentication, you’ll need a

• CA certificate (in PEM format) that AxoRouter uses to authenticate the clients.
• A certificate and the matching private key (in PEM format) that AxoRouter shows to the clients.

These files must be available on the AxoRouter host, and readable by the axorouter service for the connector to work.

Add new Windows Event Log connector

To add a new connector to an AxoRouter host, complete the following steps.

1. Create a new connector.

   1. Find the host.

   2. Select Connectors. The list of connectors available on the host is displayed.

      

   3. Select add , then select the type of connector you want to create.

      

   4. Enter a Name for the connector. This name must be unique on the host.

      

   5. (Optional) Add custom labels to the connector.

      You can also modify the product and vendor labels of the connector. In that case, Axoflow will treat the incoming messages as it was received and classified as data from the specified product. This is useful if you want to send data from a specific product to a dedicated port.

      These labels and other parameters of the connector will be available under the meta.connector key as metadata for the messages received via the connector, and can be used in routing decisions and processing steps. You can check the metadata of the messages using log tapping.

      

2. Configure the protocol-level settings of the connector.

   

   1. Set the Hostname field. The clients will address this hostname. Note that:

      • The Common Name of the server’s certificate (set in the following steps) must contain this hostname, otherwise the clients will reject the connection.
      • You’ll have to use this hostname when configuring the Subscription Manager address in the Group Policy Editor.

   2. (Optional) If for some reason don’t want to run the connection on the default port (5986), adjust the Port field.

   3. Set the paths for the certificates and keys used for the TLS-encrypted communication with the clients.

      Use absolute paths (for example, /etc/axorouter/user-config/tls-key.pem). The key and the certificate must be in PEM format. You have to make sure that these files are available on the AxoRouter host, currently you can’t distribute them from Axoflow Console.

      • CA certificate path: The CA certificate that AxoRouter uses to authenticate the clients. If you want to limit which clients are accepted, set the More options > Certificate subject filter field.
      • Server certificate path: The certificate that AxoRouter shows to the clients.
      • Server private key path: The private key of the server certificate.

3. Configure the subscriptions of the connector.

   

   1. Select Add new Subscription.

   2. (Optional) Set a name for the subscription. If you leave it empty, Axoflow Console automatically generates a name.

   3. Enter the event filter query into the Query field. This query specifies which events are collected by the subscription. For details on the query syntax, see the Microsoft documentation.

      A single query can retrieve events from a maximum of 256 different channels.

      For example, the following example queries every event from the Security, System, Application, and Setup channels.

      <Query Id="0">
          <Select Path="Application">*</Select>
          <Select Path="Security">*</Select>
          <Select Path="Setup">*</Select>
          <Select Path="System">*</Select>
      </Query>
      

   4. (Optional) If needed, you can configure other low-level options in the More options section. For details, see Additional options.

4. Select Create.

5. Make sure to enable the ports you’ve configured in the connector on the firewall of the AxoRouter host, and on other firewalls between the AxoRouter host and your data sources.

6. Configure Windows Event Forwarding (WEF) on your clients to forward their events to the AxoRouter WEC connector.

   When configuring the Subscription Manager address in the Group Policy Editor, use the hostname you’ve set in the connector

   

Additional options

You can set the following options of the WEC connector under Subscriptions > More options.

• Certificate subject filter: A simple string to filter the clients based on the Common Name of their certificate. You can use the * and ? wildcard characters.

• UUID: A unique ID for the subscription. If empty, Axoflow Console automatically generates it.

• Heartbeat interval: The number of seconds, before the client will send a heartbeat message. The client sends heartbeat messages if it has no new events to send. Default value: 3600s

• Connection retry interval: Time between reconnection attempts. Default value: 60s

• Connection retry count: Number of times the client will attempt to reconnect if AxoRouter is unreachable. Default value: 10

• Max time: The maximum number of seconds the client aggregates new events before sending them in a batch. Default value: 30s

• Max elements: The maximum number of events that the client aggregates before sending them in a batch. By default it’s empty, meaning that only the Max time and Max envelope size options limit the aggregation. Default value: empty

• Max envelope size: The maximum number of bytes in the SOAP envelope used to deliver the events. Default value: 512000 bytes

• Locale: The language in which rendering information is expected, for example, en-US. Default value: Client choose

• Data locale: The language in which numerical data is expected to be formatted, for example, en-US. Default value: Client choose

• Read existing events: If enabled (Yes), the event source sends:

  • all existing events that match the filter, and
  • any events that subsequently occur for that event source.

  If disabled (No), existing events will be ignored.

  Default value: No

• Ignore channel error: Subscription queries that result in errors will terminate the processing of the clients. Enable this option to ignore such errors. Default value: Yes

• Content format: Determines whether to include rendering information (RenderedText) with events or not (Raw). Default value: Raw

Metadata fields

The AxoRouter Windows Events connector adds the following fields to the meta variable:

7 - Vendors

To onboard a source that is specifically supported by Axoflow, complete the following steps. Onboarding allows you to collect metrics about the host, and display the host on the Topology page.

1. Open the Axoflow Console.

2. Select Topology.

3. Select + > Source.

   

4. If the source is already sending logs to an AxoRouter instance that is registered in the Axoflow Console, select Detected, then select the source.

   Otherwise, select the type of the source you want to onboard, and follow the on-screen instructions.

   

5. Connect the source to the destination or AxoRouter instance it’s sending logs to.

   1. Select Topology > + > Path.

      

   2. Select your data source in the Source host field.

      

   3. Select the target router or aggregator this source is sending its data to in the Target host field, for example, axorouter.

   4. Select the Target connector. The connector determines how the destination receives the data (for example, using which protocol or port).

   5. Select Create. The new path appears on the Topology page.

      

6. Configure the appliance to send logs to an AxoRouter instance. Specific instructions regarding individual vendors are listed below, along with default metadata (labels) and specific metadata for Splunk.

   Note

   Unless instructed otherwise, configure your appliance to send the logs to the Syslog (autodetect and classify) connector of AxoRouter, using the appropriate port. Use RFC5424 if the appliance supports it.

   • 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
   • 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
   • 6514 TCP for TLS-encrypted syslog traffic.

7.1 - Amazon

7.1.1 - CloudWatch

Axoflow can collect data from your Amazon CloudWatch. At a high level, the process looks like this:

• Deploy an Axoflow Cloud Connector that will collect the data from your CloudWatch. Axoflow Cloud Connector is a simple container that you can deploy into AWS, another cloud provider, or on-prem.
• The connector forwards the collected data to the OpenTelemetry connector of an AxoRouter instance. This AxoRouter can be deployed within AWS, another cloud provider, or on-prem.
• Configure a Flow on Axoflow Console that processes and routes the collected data to your destination (for example, Splunk or another SIEM).

Prerequisites

• An AWS account with an active subscription.
• A virtual machine or Kubernetes node running to deploy Axoflow Cloud Connector on.
• An AxoRouter instance that can receive data from the connector. Verify that it has an OpenTelemetry Connector (it’s enabled by default).

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.
• The Axoflow Cloud Connector must be able to access the AxoRouter on the port the OpenTelemetry Connector is listening on (by default, port 4317). Depending on where the Axoflow Cloud Connector and AxoRouter are deployed, you might need to adjust firewall and ingress/egress rules in your environment.
• Depending on how you want to authenticate Axoflow Cloud Connector, you’ll need an AWS_PROFILE or AWS access keys.

Steps

To collect data from AWS CloudWatch, complete the following steps.

1. Deploy an Axoflow Cloud Connector.

   1. Access the Kubernetes node or virtual machine where you want to deploy Axoflow Cloud Connector.

   2. Set the following environment variable to the IP address of the AxoRouter where you want to forward the data from CloudWatch. This IP address must be accessible from the connector. You can find the IP address of AxoRouter on the Hosts > AxoRouter > Overview page.

      export AXOROUTER_ENDPOINT=<AxoRouter-IP-address>
      

   3. (Optional) By default, the connector stores positional and other persistence-related data in the /etc/axoflow-otel-collector/storage directory. In case you want to use a different directory, set the STORAGE_DIRECTORY environment variable.

   4. Configure the authentication that the Axoflow Cloud Connector will use to access CloudWatch. Set the environment variables for the authentication method you want to use.

      • AWS Profile with a configuration file: Set the region and the AWS_PROFILE

        export AWS_PROFILE=""
        export AWS_REGION=""
        

      • AWS Credentials: To use AWS access keys, set an access key and a matching secret.

        export AWS_ACCESS_KEY_ID=""
        export AWS_SECRET_ACCESS_KEY=""
        export AWS_REGION=""
        

      • EC2 instance profile:

        export AWS_REGION=""
        

   5. Deploy the Axoflow Cloud Connector. The exact command depends on the authentication method:

      • AWS Profile with a configuration file: Set the region and the AWS_PROFILE

        docker run --rm \
        -e AWS_PROFILE="${AWS_PROFILE}" \
        -e AWS_REGION="${AWS_REGION}" \
        -e AWS_SDK_LOAD_CONFIG=1 \
        -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
        -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
        -v "${HOME}/.aws:/cloudconnectors/.aws:ro" \
        ghcr.io/axoflow/axocloudconnectors:latest
        

      • AWS Credentials: To use AWS access keys, set an access key and a matching secret.

        docker run --rm \
        -e AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}" \
        -e AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}" \
        -e AWS_REGION="${AWS_REGION}" \
        -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
        -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
        ghcr.io/axoflow/axocloudconnectors:latest
        

      • EC2 instance profile:

        docker run --rm \
        -e AWS_REGION="${AWS_REGION}" \
        -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
        -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
        ghcr.io/axoflow/axocloudconnectors:latest
        

      The Axoflow Cloud Connector starts forwarding logs to the AxoRouter instance.

2. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select AWS CloudWatch.
   4. Enter the IP address and the FQDN of the Axoflow Cloud Connector instance.
   5. Select Create.

3. Create a Flow to route the data from the AxoRouter instance to a destination. You can use the Labels of this source to select messages from this source.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2 - Cisco

7.2.1 - Adaptive Security Appliance (ASA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.2 - Application Control Engine (ACE)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.3 - Cisco IOS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.4 - Digital Network Architecture (DNA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.5 - Email Security Appliance (ESA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Note that the device can be configured to send plain syslog text or CEF-formatted output.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, index, and source settings:

Tested with: Splunk Add-on for Cisco ESA

7.2.6 - Firepower

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.7 - Firepower Threat Defence (FTD)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.8 - Firewall Services Module (FWSM)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.9 - HyperFlex (HX, UCSH)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.10 - Integrated Management Controller (IMC)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.11 - IOS XR

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.12 - Meraki MX

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: TA-meraki

7.2.13 - Private Internet eXchange (PIX)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.14 - TelePresence Video Communication Server (VCS)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.15 - Unified Computing System Manager (UCSM)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.16 - Unified Communications Manager (UCM)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.2.17 - Viptela

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.3 - Citrix

7.3.1 - Netscaler

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.4 - CyberArk

7.4.1 - Privileged Threat Analytics (PTA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.4.2 - Vault

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.5 - F5 Networks

7.5.1 - BIG-IP

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Note that the device can be configured to send plain syslog text, JSON, or key-value pairs.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Splunk Add-on for F5 BIG-IP

7.6 - FireEye

7.7 - Fortinet

7.7.1 - FortiGate firewalls

The following sections show you how to configure FortiGate Next-Generation Firewall (NGFW) to send their log data to Axoflow.

Prerequisites

• You have administrative access to the firewall.
• The date, time, and time zone are correctly set on the firewall.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the firewall.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps

Note: The steps involving the FortiGate user interface are just for your convenience, for details, see the official FortiGate documentation.

1. Log in to your FortiGate device. You need administrator privileges to perform the configuration.

2. Register the address of your AxoRouter as an Address Object.

   1. Select Log & Report > Log Settings > Global Settings.

   2. Configure the following settings:

      • Event Logging: Click All.
      • Local traffic logging: Click All.
      • Syslog logging: Enable this option.
      • IP address/FQDN: Enter the address of your AxoRouter: %axorouter-ip%

   3. Click Apply.

3. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Fortinet FortiGate Add-On for Splunk technical add-on

7.7.2 - FortiMail

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: FortiMail Add-on for Splunk technical add-on

7.7.3 - FortiWeb

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Fortinet FortiWeb Add-0n for Splunk technical add-on

7.8 - Fortra

7.8.1 - Powertech SIEM Agent for IBM i

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

Powertech Interact

7.9 - Imperva

7.9.1 - Incapsula

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

7.9.2 - SecureSphere

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

7.10 - Infoblox

7.10.1 - NIOS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Splunk Add-on for Infoblox

7.11 - Ivanti

7.11.1 - Connect secure

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

Pulse Connect Secure

7.12 - Juniper

7.12.1 - Junos OS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Splunk Add-on for Juniper

7.13 - Kaspersky

7.13.1 - Endpoint Security

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Note that the device can be configured to send plain syslog text, LEEF, or CEF-formatted output.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.14 - MicroFocus

7.15 - Microsoft

7.15.1 - Azure Event Hubs

Axoflow can collect data from your Azure Event Hubs. At a high level, the process looks like this:

• Deploy an Axoflow Cloud Connector that will collect the data from your Event Hub. Axoflow Cloud Connector is a simple container that you can deploy into Azure, another cloud provider, or on-prem.
• The connector forwards the collected data to the OpenTelemetry connector of an AxoRouter instance. This AxoRouter can be deployed within Azure, another cloud provider, or on-prem.
• Configure a Flow on Axoflow Console that processes and routes the collected data to your destination (for example, Splunk or another SIEM).

Prerequisites

• An Azure account with an active subscription.
• A virtual machine or Kubernetes node running to deploy Axoflow Cloud Connector on.
• An AxoRouter instance that can receive data from the connector. Verify that it has an OpenTelemetry Connector (it’s enabled by default).

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.
• The Axoflow Cloud Connector must be able to access the AxoRouter on the port the OpenTelemetry Connector is listening on (by default, port 4317). Depending on where the Axoflow Cloud Connector and AxoRouter are deployed, you might need to adjust firewall and ingress/egress rules in your environment.
• An Event Hubs connection string.

Steps

To collect data from Azure Event Hubs, complete the following steps.

1. Deploy an Axoflow Cloud Connector into Azure.

   1. Access the Kubernetes node or virtual machine.

   2. Set the following environment variable to the IP address of the AxoRouter where you want to forward the data from Event Hubs. This IP address must be accessible from the connector. You can find the IP address of AxoRouter on the Hosts > AxoRouter > Overview page.

      export AXOROUTER_ENDPOINT=<AxoRouter-IP-address>
      

   3. (Optional) By default, the connector stores positional and other persistence-related data in the /etc/axoflow-otel-collector/storage directory. In case you want to use a different directory, set the STORAGE_DIRECTORY environment variable.

   4. Set the AZURE_EVENTHUB_CONNECTION_STRING environment variable.

      export AZURE_EVENTHUB_CONNECTION_STRING="Endpoint=sb://<NamespaceName>.servicebus.windows.net/;SharedAccessKeyName=<KeyName>;SharedAccessKey=<KeyValue>;EntityPath=<EventHubName>"
      

   5. Deploy the Axoflow Cloud Connector by running:

      docker run --rm \
      -v "${STORAGE_DIRECTORY}":"${STORAGE_DIRECTORY}" \
      -e AZURE_EVENTHUB_CONNECTION_STRING="${AZURE_EVENTHUB_CONNECTION_STRING}" \
      -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
      -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
      ghcr.io/axoflow/axocloudconnectors:latest
      

      The Axoflow Cloud Connector starts forwarding logs to the AxoRouter instance.

2. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select Azure Event Hubs.
   4. Enter the IP address and the FQDN of the Axoflow Cloud Connector instance.
   5. Select Create.

3. Create a Flow to route the data from the AxoRouter instance to a destination. You can use the Labels of this source to select messages from this source.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Event Hubs Audit logs labels

Event Hubs Provisioning logs labels

Event Hubs Signin logs labels

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.15.2 - Windows hosts

To collect event logs from Microsoft Windows hosts, Axoflow supports both agent-based and agentless methods.

• For a collector agent, we recommend using the Axoflow OpenTelemetry Collector distribution. For details, see Windows host - agent based solution.
• To use an agentless solution, see Windows Event Collector (WEC).

Labels

Labels assigned to data received from Windows hosts depend on how AxoRouter receives the data. For details, see Windows host - agent based solution and Windows Event Collector (WEC).

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.16 - MikroTik

7.16.1 - RouterOS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.17 - Netgate

7.17.1 - pfSense

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

The pfsense:<program> variant is simply a generic linux event that is generated by the underlying OS on the appliance.

Tested with: TA-pfsense

7.18 - Netmotion

7.18.1 - Netmotion

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.19 - NETSCOUT

7.19.1 - Arbor Edge Defense (AED)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

7.20 - OpenText

7.20.1 - ArcSight

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

MicroFocus ArcSight

7.21 - Palo Alto Networks

7.21.1 - Cortex XSOAR

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

Threat Intelligence Management (TIM)

7.21.2 - Palo Alto firewalls

The following sections show you how to configure Palo Alto Networks Next-Generation Firewall devices to send their log data to Axoflow.

Prerequisites

• You have administrative access to the firewall.
• The date, time, and time zone are correctly set on the firewall.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the firewall.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps

Note: The steps involving the Palo Alto Networks Next-Generation Firewall user interface are just for your convenience, for details, see the official PAN-OS® documentation.

1. Log in to your firewall device. You need administrator privileges to perform the configuration.

2. Configure a Syslog server profile.

   1. Select Device > Server Profiles > Syslog.

   2. Click Add and enter a Name for the profile, for example, axorouter.

   3. Configure the following settings:

      • Syslog Server: Enter the IP address of your AxoRouter: %axorouter-ip%
      • Transport: Select TCP or TLS.
      • Port: Set the port to 601. (This is needed for the recommended IETF log format. If for some reason you need to use the BSD format, set the port to 514.)
      • Format: Select IETF.
      • Syslog logging: Enable this option.

   4. Click OK.

3. Configure syslog forwarding for Traffic, Threat, and WildFire Submission logs. For details, see Configure Log Forwarding the official PAN-OS® documentation.

   1. Select Objects > Log Forwarding.
   2. Click Add.
   3. Enter a Name for the profile, for example, axoflow.
   4. For each log type, severity level, or WildFire verdict, select the Syslog server profile.
   5. Click OK.
   6. Assign the log forwarding profile to a security policy to trigger log generation and forwarding.
   7. Select Policies > Security and select a policy rule.
   8. Select Actions, then select the Log Forwarding profile you created (for example, axoflow).
   9. For Traffic logs, select one or both of the Log at Session Start and Log At Session End options.
   10. Click OK.

4. Configure syslog forwarding for System, Config, HIP Match, and Correlation logs.

   1. Select Device > Log Settings.
   2. For System and Correlation logs, select each Severity level, select the Syslog server profile, and click OK.
   3. For Config, HIP Match, and Correlation logs, edit the section, select the Syslog server profile, and click OK.

5. Click Commit.

6. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Palo Alto Networks Add-on for Splunk technical add-on

7.22 - Powertech

7.23 - Riverbed

7.23.1 - SteelConnect

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.23.2 - SteelHead

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.24 - rsyslog

Axoflow treats rsyslog sources as a generic syslog source. To send data from rsyslog to Axoflow, just configure rsyslog to send data to an AxoRouter instance using the syslog protocol.

Note that even if rsyslog is acting as a relay (receiving data from other clients and forwarding them to AxoRouter), on the Topology page it will be displayed as a data source.

Prerequisites

• You have administrative access to the device running rsyslog.
• The date, time, and time zone are correctly set on the appliance.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the appliance.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

7.25 - SecureAuth

7.25.1 - Identity Platform

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: SecureAuth IdP Splunk App

7.26 - SonicWall

7.26.1 - SonicWall

The following sections show you how to configure SonicWall firewalls to send their log data to Axoflow.

Prerequisites

• You have administrative access to the firewall.
• The date, time, and time zone are correctly set on the firewall.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the firewall.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps for SonicOS 7.x

Note: The steps involving the SonicWall user interface are just for your convenience, for details, see the official SonicWall documentation.

1. Log in to your SonicWall device. You need administrator privileges to perform the configuration.

2. Register the address of your AxoRouter as an Address Object.

   1. Select MENU > OBJECT.

   2. Select Match Objects > Addresses > Address objects.

   3. Click Add Address.

   4. Configure the following settings:

      • Name: Enter a name for the AxoRouter, for example, AxoRouter.
      • Zone Assignment: Select the correct zone.
      • Type: Select Host.
      • IP Address: Enter the IP address of your AxoRouter: %axorouter-ip%

   5. Click Save.

3. Set your AxoRouter as a syslog server.

   1. Navigate to Device > Log > Syslog.

   2. Select the Syslog Servers tab.

   3. Click Add.

   4. Configure the following options:

      • Name or IP Address: Select the Address Object of AxoRouter.
      • Server Type: Select Syslog Server.
      • Syslog Format: Select Enhanced.

      If your Syslog server does not use default port 514, type the port number in the Port field.

      By default, AxoRouter accepts data on the following ports:

      • 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
      • 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
      • 6514 TCP for TLS-encrypted syslog traffic.
      • 4317 TCP for OpenTelemetry log data.

      To receive data on other ports or other protocols, configure the source connectors of the AxoRouter host.

      Make sure to enable the ports you’re using on the firewall of your host.

      

4. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Steps for SonicOS 6.x

Note: The steps involving the SonicWall user interface are just for your convenience, for details, see the official SonicWall documentation.

1. Log in to your SonicWall device. You need administrator privileges to perform the configuration.

2. Register the address of your AxoRouter as an Address Object.

   1. Select MANAGE > Policies > Objects > Address Objects.

   2. Click Add.

   3. Configure the following settings:

      • Name: Enter a name for the AxoRouter, for example, AxoRouter.
      • Zone Assignment: Select the correct zone.
      • Type: Select Host.
      • IP Address: Enter the IP address of your AxoRouter: %axorouter-ip%

   4. Click Add.

3. Set your AxoRouter as a syslog server.

   1. Navigate to MANAGE > Log Settings > SYSLOG.

   2. Click ADD.

   3. Configure the following options:

      • Syslog ID: Enter an ID for the firewall. This ID will be used as the hostname in the log messages.
      • Name or IP Address: Select the Address Object of AxoRouter.
      • Server Type: Select Syslog Server.
      • Enable the Enhanced Syslog Fields Settings.

   4. Click OK.

4. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Dell SonicWall Add-on for Splunk technical add-on

7.27 - syslog-ng

By default, Axoflow treats syslog-ng sources as a generic syslog source.

• The easiest way to send data from syslog-ng to Axoflow is to configure it to send data to an AxoRouter instance using the syslog protocol.
• If you’re using syslog-ng Open Source Edition version 4.4 or newer, use the syslog-ng-otlp() driver to send data to AxoRouter using the OpenTelemetry Protocol.

Note that even if syslog-ng is acting as a relay (receiving data from other clients and forwarding them to AxoRouter), on the Topology page it will be displayed as a data source.

Prerequisites

• You have administrative access to the device running syslog-ng.
• The date, time, and time zone are correctly set on the appliance.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the appliance.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

7.28 - Thales

7.28.1 - Vormetric Data Security Platform

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.29 - Trellix

7.29.1 - Central Management System (CMS)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.29.2 - Endpoint Security (HX)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: FireEye Add-on for Splunk Enterprise

Earlier name/vendor

FireEye Endpoint Security (HX)

7.29.3 - ETP

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.29.4 - MPS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.30 - Trend Micro

7.30.1 - Deep Security Agent

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.31 - Varonis

7.31.1 - DatAdvantage

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.32 - Vectra AI

Earlier name/vendor

Vectra Cognito

7.32.1 - X-Series

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

7.33 - Zscaler appliances

7.33.1 - Zscaler Nanolog Streaming Service

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Zscaler Technical Add-On for Splunk

7.33.2 - Zscaler Log Streaming Service

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Zscaler Technical Add-On for Splunk

8 - Cloud sources

8.1 - A10 Networks

8.1.1 - vThunder

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

8.2 - Imperva

8.2.1 - Incapsula

8.3 - Microsoft

8.3.1 - Cloud App Security (MCAS)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings: