Vendors

Prerequisites

• You have administrative access to the source device or host.
• You have an AxoRouter deployed and configured with a Syslog connector that has parsing and classification enabled (by default, every AxoRouter has such connectors). This device is going to receive the data from the source device or host.

• You know the IP address the AxoRouter. To find it:

  1. Open the AxoConsole.
  2. Select the Routers or the Topology page.
  3. Select on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Onboard a vendor source

To onboard sources that are specifically supported by Axoflow, complete the following steps. Onboarding allows you to collect metrics about the host, and display the host on the Topology page.

1. Open the AxoConsole.

2. Select Topology.

3. Select Add Item > Source.

   

4. Add the source to AxoConsole using one of the following methods:

   • If the source is already sending logs to an AxoRouter instance that is registered in the AxoConsole, select Detected, then select the source.

     You can add multiple detected sources in a single step in bulk.

     

   • Otherwise, select the type of the source you want to onboard, and follow the on-screen instructions.

     

5. Connect the source to the destination or AxoRouter instance it’s sending logs to. If you’ve added the source from the Detected list, you can skip this step, as the path is created automatically.

   1. Select Topology > Add Item > Path.

      

   2. Select the target router or aggregator this source is sending its data to in the Target host field, for example, axorouter.

   3. Select the Target connector. The connector determines how the destination receives the data (for example, using which protocol or port).

   4. Select Add. The new path appears on the Topology page.

      

6. If you haven’t already done so, configure the source to send logs to an AxoRouter instance. For vendor-specific configuration steps, default metadata (labels), and SIEM-specific metadata, see the page for each source.

   Note

   Unless instructed otherwise, configure your source to send the logs to the Syslog connector of AxoRouter, using the appropriate port. Use RFC5424 if the source supports it.

   • 514 UDP and TCP for RFC3164 (BSD-syslog) and RFC5424 (IETF-syslog) formatted traffic. AxoRouter automatically recognizes and handles both formats.
   • 601 TCP for RFC5424 (IETF-syslog) and RFC3164 (BSD-syslog) formatted traffic. AxoRouter automatically recognizes and handles both formats.
   • 6514 TCP for TLS-encrypted syslog traffic.