Vendors

• 1: Amazon
• 1.1: CloudWatch
• 2: Cisco
• 2.1: Adaptive Security Appliance (ASA)
• 2.2: Application Control Engine (ACE)
• 2.3: Cisco IOS
• 2.4: Digital Network Architecture (DNA)
• 2.5: Email Security Appliance (ESA)
• 2.6: Firepower
• 2.7: Firepower Threat Defence (FTD)
• 2.8: Firewall Services Module (FWSM)
• 2.9: HyperFlex (HX, UCSH)
• 2.10: Integrated Management Controller (IMC)
• 2.11: IOS XR
• 2.12: Meraki MX
• 2.13: Private Internet eXchange (PIX)
• 2.14: TelePresence Video Communication Server (VCS)
• 2.15: Unified Computing System Manager (UCSM)
• 2.16: Unified Communications Manager (UCM)
• 2.17: Viptela
• 3: Citrix
• 3.1: Netscaler
• 4: CyberArk
• 4.1: Privileged Threat Analytics (PTA)
• 4.2: Vault
• 5: F5 Networks
• 5.1: BIG-IP
• 6: FireEye
• 7: Fortinet
• 7.1: FortiGate firewalls
• 7.2: FortiMail
• 7.3: FortiWeb
• 8: Fortra
• 8.1: Powertech SIEM Agent for IBM i
• 9: Imperva
• 9.1: Incapsula
• 9.2: SecureSphere
• 10: Infoblox
• 10.1: NIOS
• 11: Ivanti
• 11.1: Connect secure
• 12: Juniper
• 12.1: Junos OS
• 13: Kaspersky
• 13.1: Endpoint Security
• 14: MicroFocus
• 15: Microsoft
• 15.1: Azure Event Hubs
• 15.2: Windows hosts
• 16: MikroTik
• 16.1: RouterOS
• 17: Netgate
• 17.1: pfSense
• 18: Netmotion
• 18.1: Netmotion
• 19: NETSCOUT
• 19.1: Arbor Edge Defense (AED)
• 20: OpenText
• 20.1: ArcSight
• 21: Palo Alto Networks
• 21.1: Cortex XSOAR
• 21.2: Palo Alto firewalls
• 22: Powertech
• 23: Riverbed
• 23.1: SteelConnect
• 23.2: SteelHead
• 24: rsyslog
• 25: SecureAuth
• 25.1: Identity Platform
• 26: SonicWall
• 26.1: SonicWall
• 27: syslog-ng
• 28: Thales
• 28.1: Vormetric Data Security Platform
• 29: Trellix
• 29.1: Central Management System (CMS)
• 29.2: Endpoint Security (HX)
• 29.3: ETP
• 29.4: MPS
• 30: Trend Micro
• 30.1: Deep Security Agent
• 31: Varonis
• 31.1: DatAdvantage
• 32: Vectra AI
• 32.1: X-Series
• 33: Zscaler appliances
• 33.1: Zscaler Nanolog Streaming Service
• 33.2: Zscaler Log Streaming Service

1 - Amazon

1.1 - CloudWatch

Axoflow can collect data from your Amazon CloudWatch. At a high level, the process looks like this:

• Deploy an Axoflow Cloud Connector that will collect the data from your CloudWatch. Axoflow Cloud Connector is a simple container that you can deploy into AWS, another cloud provider, or on-prem.
• The connector forwards the collected data to the OpenTelemetry connector of an AxoRouter instance. This AxoRouter can be deployed within AWS, another cloud provider, or on-prem.
• Configure a Flow on Axoflow Console that processes and routes the collected data to your destination (for example, Splunk or another SIEM).

Prerequisites

• An AWS account with an active subscription.
• A virtual machine or Kubernetes node running to deploy Axoflow Cloud Connector on.
• An AxoRouter instance that can receive data from the connector. Verify that it has an OpenTelemetry Connector (it’s enabled by default).

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.
• The Axoflow Cloud Connector must be able to access the AxoRouter on the port the OpenTelemetry Connector is listening on (by default, port 4317). Depending on where the Axoflow Cloud Connector and AxoRouter are deployed, you might need to adjust firewall and ingress/egress rules in your environment.
• Depending on how you want to authenticate Axoflow Cloud Connector, you’ll need an AWS_PROFILE or AWS access keys.

Steps

To collect data from AWS CloudWatch, complete the following steps.

1. Deploy an Axoflow Cloud Connector.

   1. Access the Kubernetes node or virtual machine where you want to deploy Axoflow Cloud Connector.

   2. Set the following environment variable to the IP address of the AxoRouter where you want to forward the data from CloudWatch. This IP address must be accessible from the connector. You can find the IP address of AxoRouter on the Hosts > AxoRouter > Overview page.

      export AXOROUTER_ENDPOINT=<AxoRouter-IP-address>
      

   3. (Optional) By default, the connector stores positional and other persistence-related data in the /etc/axoflow-otel-collector/storage directory. In case you want to use a different directory, set the STORAGE_DIRECTORY environment variable.

   4. Configure the authentication that the Axoflow Cloud Connector will use to access CloudWatch. Set the environment variables for the authentication method you want to use.

      • AWS Profile with a configuration file: Set the region and the AWS_PROFILE

        export AWS_PROFILE=""
        export AWS_REGION=""
        

      • AWS Credentials: To use AWS access keys, set an access key and a matching secret.

        export AWS_ACCESS_KEY_ID=""
        export AWS_SECRET_ACCESS_KEY=""
        export AWS_REGION=""
        

      • EC2 instance profile:

        export AWS_REGION=""
        

   5. Deploy the Axoflow Cloud Connector. The exact command depends on the authentication method:

      • AWS Profile with a configuration file: Set the region and the AWS_PROFILE

        docker run --rm \
        -e AWS_PROFILE="${AWS_PROFILE}" \
        -e AWS_REGION="${AWS_REGION}" \
        -e AWS_SDK_LOAD_CONFIG=1 \
        -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
        -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
        -v "${HOME}/.aws:/cloudconnectors/.aws:ro" \
        ghcr.io/axoflow/axocloudconnectors:latest
        

      • AWS Credentials: To use AWS access keys, set an access key and a matching secret.

        docker run --rm \
        -e AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}" \
        -e AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}" \
        -e AWS_REGION="${AWS_REGION}" \
        -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
        -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
        ghcr.io/axoflow/axocloudconnectors:latest
        

      • EC2 instance profile:

        docker run --rm \
        -e AWS_REGION="${AWS_REGION}" \
        -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
        -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
        ghcr.io/axoflow/axocloudconnectors:latest
        

      The Axoflow Cloud Connector starts forwarding logs to the AxoRouter instance.

2. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select AWS CloudWatch.
   4. Enter the IP address and the FQDN of the Axoflow Cloud Connector instance.
   5. Select Create.

3. Create a Flow to route the data from the AxoRouter instance to a destination. You can use the Labels of this source to select messages from this source.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2 - Cisco

2.1 - Adaptive Security Appliance (ASA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.2 - Application Control Engine (ACE)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.3 - Cisco IOS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.4 - Digital Network Architecture (DNA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.5 - Email Security Appliance (ESA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Note that the device can be configured to send plain syslog text or CEF-formatted output.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, index, and source settings:

Tested with: Splunk Add-on for Cisco ESA

2.6 - Firepower

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.7 - Firepower Threat Defence (FTD)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.8 - Firewall Services Module (FWSM)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.9 - HyperFlex (HX, UCSH)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.10 - Integrated Management Controller (IMC)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.11 - IOS XR

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.12 - Meraki MX

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: TA-meraki

2.13 - Private Internet eXchange (PIX)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.14 - TelePresence Video Communication Server (VCS)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.15 - Unified Computing System Manager (UCSM)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.16 - Unified Communications Manager (UCM)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

2.17 - Viptela

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

3 - Citrix

3.1 - Netscaler

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

4 - CyberArk

4.1 - Privileged Threat Analytics (PTA)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

4.2 - Vault

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

5 - F5 Networks

5.1 - BIG-IP

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Note that the device can be configured to send plain syslog text, JSON, or key-value pairs.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Splunk Add-on for F5 BIG-IP

6 - FireEye

7 - Fortinet

7.1 - FortiGate firewalls

The following sections show you how to configure FortiGate Next-Generation Firewall (NGFW) to send their log data to Axoflow.

Prerequisites

• You have administrative access to the firewall.
• The date, time, and time zone are correctly set on the firewall.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the firewall.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps

Note: The steps involving the FortiGate user interface are just for your convenience, for details, see the official FortiGate documentation.

1. Log in to your FortiGate device. You need administrator privileges to perform the configuration.

2. Register the address of your AxoRouter as an Address Object.

   1. Select Log & Report > Log Settings > Global Settings.

   2. Configure the following settings:

      • Event Logging: Click All.
      • Local traffic logging: Click All.
      • Syslog logging: Enable this option.
      • IP address/FQDN: Enter the address of your AxoRouter: %axorouter-ip%

   3. Click Apply.

3. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Fortinet FortiGate Add-On for Splunk technical add-on

7.2 - FortiMail

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: FortiMail Add-on for Splunk technical add-on

7.3 - FortiWeb

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Fortinet FortiWeb Add-0n for Splunk technical add-on

8 - Fortra

8.1 - Powertech SIEM Agent for IBM i

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

Powertech Interact

9 - Imperva

9.1 - Incapsula

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

9.2 - SecureSphere

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

10 - Infoblox

10.1 - NIOS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Splunk Add-on for Infoblox

11 - Ivanti

11.1 - Connect secure

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

Pulse Connect Secure

12 - Juniper

12.1 - Junos OS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Splunk Add-on for Juniper

13 - Kaspersky

13.1 - Endpoint Security

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Note that the device can be configured to send plain syslog text, LEEF, or CEF-formatted output.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

14 - MicroFocus

15 - Microsoft

15.1 - Azure Event Hubs

Axoflow can collect data from your Azure Event Hubs. At a high level, the process looks like this:

• Deploy an Axoflow Cloud Connector that will collect the data from your Event Hub. Axoflow Cloud Connector is a simple container that you can deploy into Azure, another cloud provider, or on-prem.
• The connector forwards the collected data to the OpenTelemetry connector of an AxoRouter instance. This AxoRouter can be deployed within Azure, another cloud provider, or on-prem.
• Configure a Flow on Axoflow Console that processes and routes the collected data to your destination (for example, Splunk or another SIEM).

Prerequisites

• An Azure account with an active subscription.
• A virtual machine or Kubernetes node running to deploy Axoflow Cloud Connector on.
• An AxoRouter instance that can receive data from the connector. Verify that it has an OpenTelemetry Connector (it’s enabled by default).

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.
• The Axoflow Cloud Connector must be able to access the AxoRouter on the port the OpenTelemetry Connector is listening on (by default, port 4317). Depending on where the Axoflow Cloud Connector and AxoRouter are deployed, you might need to adjust firewall and ingress/egress rules in your environment.
• An Event Hubs connection string.

Steps

To collect data from Azure Event Hubs, complete the following steps.

1. Deploy an Axoflow Cloud Connector into Azure.

   1. Access the Kubernetes node or virtual machine.

   2. Set the following environment variable to the IP address of the AxoRouter where you want to forward the data from Event Hubs. This IP address must be accessible from the connector. You can find the IP address of AxoRouter on the Hosts > AxoRouter > Overview page.

      export AXOROUTER_ENDPOINT=<AxoRouter-IP-address>
      

   3. (Optional) By default, the connector stores positional and other persistence-related data in the /etc/axoflow-otel-collector/storage directory. In case you want to use a different directory, set the STORAGE_DIRECTORY environment variable.

   4. Set the AZURE_EVENTHUB_CONNECTION_STRING environment variable.

      export AZURE_EVENTHUB_CONNECTION_STRING="Endpoint=sb://<NamespaceName>.servicebus.windows.net/;SharedAccessKeyName=<KeyName>;SharedAccessKey=<KeyValue>;EntityPath=<EventHubName>"
      

   5. Deploy the Axoflow Cloud Connector by running:

      docker run --rm \
      -v "${STORAGE_DIRECTORY}":"${STORAGE_DIRECTORY}" \
      -e AZURE_EVENTHUB_CONNECTION_STRING="${AZURE_EVENTHUB_CONNECTION_STRING}" \
      -e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
      -e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
      ghcr.io/axoflow/axocloudconnectors:latest
      

      The Axoflow Cloud Connector starts forwarding logs to the AxoRouter instance.

2. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select Azure Event Hubs.
   4. Enter the IP address and the FQDN of the Axoflow Cloud Connector instance.
   5. Select Create.

3. Create a Flow to route the data from the AxoRouter instance to a destination. You can use the Labels of this source to select messages from this source.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Event Hubs Audit logs labels

Event Hubs Provisioning logs labels

Event Hubs Signin logs labels

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

15.2 - Windows hosts

To collect event logs from Microsoft Windows hosts, Axoflow supports both agent-based and agentless methods.

• For a collector agent, we recommend using the Axoflow OpenTelemetry Collector distribution. For details, see Windows host - agent based solution.
• To use an agentless solution, see Windows Event Collector (WEC).

Labels

Labels assigned to data received from Windows hosts depend on how AxoRouter receives the data. For details, see Windows host - agent based solution and Windows Event Collector (WEC).

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

16 - MikroTik

16.1 - RouterOS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

17 - Netgate

17.1 - pfSense

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

The pfsense:<program> variant is simply a generic linux event that is generated by the underlying OS on the appliance.

Tested with: TA-pfsense

18 - Netmotion

18.1 - Netmotion

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

19 - NETSCOUT

19.1 - Arbor Edge Defense (AED)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

20 - OpenText

20.1 - ArcSight

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

MicroFocus ArcSight

21 - Palo Alto Networks

21.1 - Cortex XSOAR

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, source, and index settings:

Earlier name/vendor

Threat Intelligence Management (TIM)

21.2 - Palo Alto firewalls

The following sections show you how to configure Palo Alto Networks Next-Generation Firewall devices to send their log data to Axoflow.

Prerequisites

• You have administrative access to the firewall.
• The date, time, and time zone are correctly set on the firewall.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the firewall.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps

Note: The steps involving the Palo Alto Networks Next-Generation Firewall user interface are just for your convenience, for details, see the official PAN-OS® documentation.

1. Log in to your firewall device. You need administrator privileges to perform the configuration.

2. Configure a Syslog server profile.

   1. Select Device > Server Profiles > Syslog.

   2. Click Add and enter a Name for the profile, for example, axorouter.

   3. Configure the following settings:

      • Syslog Server: Enter the IP address of your AxoRouter: %axorouter-ip%
      • Transport: Select TCP or TLS.
      • Port: Set the port to 601. (This is needed for the recommended IETF log format. If for some reason you need to use the BSD format, set the port to 514.)
      • Format: Select IETF.
      • Syslog logging: Enable this option.

   4. Click OK.

3. Configure syslog forwarding for Traffic, Threat, and WildFire Submission logs. For details, see Configure Log Forwarding the official PAN-OS® documentation.

   1. Select Objects > Log Forwarding.
   2. Click Add.
   3. Enter a Name for the profile, for example, axoflow.
   4. For each log type, severity level, or WildFire verdict, select the Syslog server profile.
   5. Click OK.
   6. Assign the log forwarding profile to a security policy to trigger log generation and forwarding.
   7. Select Policies > Security and select a policy rule.
   8. Select Actions, then select the Log Forwarding profile you created (for example, axoflow).
   9. For Traffic logs, select one or both of the Log at Session Start and Log At Session End options.
   10. Click OK.

4. Configure syslog forwarding for System, Config, HIP Match, and Correlation logs.

   1. Select Device > Log Settings.
   2. For System and Correlation logs, select each Severity level, select the Syslog server profile, and click OK.
   3. For Config, HIP Match, and Correlation logs, edit the section, select the Syslog server profile, and click OK.

5. Click Commit.

6. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Palo Alto Networks Add-on for Splunk technical add-on

22 - Powertech

23 - Riverbed

23.1 - SteelConnect

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

23.2 - SteelHead

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

24 - rsyslog

Axoflow treats rsyslog sources as a generic syslog source. To send data from rsyslog to Axoflow, just configure rsyslog to send data to an AxoRouter instance using the syslog protocol.

Note that even if rsyslog is acting as a relay (receiving data from other clients and forwarding them to AxoRouter), on the Topology page it will be displayed as a data source.

Prerequisites

• You have administrative access to the device running rsyslog.
• The date, time, and time zone are correctly set on the appliance.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the appliance.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

25 - SecureAuth

25.1 - Identity Platform

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: SecureAuth IdP Splunk App

26 - SonicWall

26.1 - SonicWall

The following sections show you how to configure SonicWall firewalls to send their log data to Axoflow.

Prerequisites

• You have administrative access to the firewall.
• The date, time, and time zone are correctly set on the firewall.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the firewall.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

Steps for SonicOS 7.x

Note: The steps involving the SonicWall user interface are just for your convenience, for details, see the official SonicWall documentation.

1. Log in to your SonicWall device. You need administrator privileges to perform the configuration.

2. Register the address of your AxoRouter as an Address Object.

   1. Select MENU > OBJECT.

   2. Select Match Objects > Addresses > Address objects.

   3. Click Add Address.

   4. Configure the following settings:

      • Name: Enter a name for the AxoRouter, for example, AxoRouter.
      • Zone Assignment: Select the correct zone.
      • Type: Select Host.
      • IP Address: Enter the IP address of your AxoRouter: %axorouter-ip%

   5. Click Save.

3. Set your AxoRouter as a syslog server.

   1. Navigate to Device > Log > Syslog.

   2. Select the Syslog Servers tab.

   3. Click Add.

   4. Configure the following options:

      • Name or IP Address: Select the Address Object of AxoRouter.
      • Server Type: Select Syslog Server.
      • Syslog Format: Select Enhanced.

      If your Syslog server does not use default port 514, type the port number in the Port field.

      By default, AxoRouter accepts data on the following ports:

      • 514 TCP and UDP for RFC3164 (BSD-syslog) formatted traffic.
      • 601 TCP for RFC5424 (IETF-syslog) formatted traffic.
      • 6514 TCP for TLS-encrypted syslog traffic.
      • 4317 TCP for OpenTelemetry log data.

      To receive data on other ports or other protocols, configure the source connectors of the AxoRouter host.

      Make sure to enable the ports you’re using on the firewall of your host.

      

4. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Steps for SonicOS 6.x

Note: The steps involving the SonicWall user interface are just for your convenience, for details, see the official SonicWall documentation.

1. Log in to your SonicWall device. You need administrator privileges to perform the configuration.

2. Register the address of your AxoRouter as an Address Object.

   1. Select MANAGE > Policies > Objects > Address Objects.

   2. Click Add.

   3. Configure the following settings:

      • Name: Enter a name for the AxoRouter, for example, AxoRouter.
      • Zone Assignment: Select the correct zone.
      • Type: Select Host.
      • IP Address: Enter the IP address of your AxoRouter: %axorouter-ip%

   4. Click Add.

3. Set your AxoRouter as a syslog server.

   1. Navigate to MANAGE > Log Settings > SYSLOG.

   2. Click ADD.

   3. Configure the following options:

      • Syslog ID: Enter an ID for the firewall. This ID will be used as the hostname in the log messages.
      • Name or IP Address: Select the Address Object of AxoRouter.
      • Server Type: Select Syslog Server.
      • Enable the Enhanced Syslog Fields Settings.

   4. Click OK.

4. Add the appliance to Axoflow Console.

   1. Open the Axoflow Console and select Topology.
   2. Select + > Source.
   3. Select your source.
   4. Enter the parameters of the source, like IP address and FQDN.
   5. Select Create.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Dell SonicWall Add-on for Splunk technical add-on

27 - syslog-ng

By default, Axoflow treats syslog-ng sources as a generic syslog source.

• The easiest way to send data from syslog-ng to Axoflow is to configure it to send data to an AxoRouter instance using the syslog protocol.
• If you’re using syslog-ng Open Source Edition version 4.4 or newer, use the syslog-ng-otlp() driver to send data to AxoRouter using the OpenTelemetry Protocol.

Note that even if syslog-ng is acting as a relay (receiving data from other clients and forwarding them to AxoRouter), on the Topology page it will be displayed as a data source.

Prerequisites

• You have administrative access to the device running syslog-ng.
• The date, time, and time zone are correctly set on the appliance.
• You have an AxoRouter deployed and configured. This device is going to receive the logs from the appliance.

• You know the IP address the AxoRouter. To find it:

  1. Open the Axoflow Console.
  2. Select the Hosts or the Topology page.
  3. Click on AxoRouter instance that is going to receive the logs.
  4. Check the Networks > Address field.

28 - Thales

28.1 - Vormetric Data Security Platform

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

29 - Trellix

29.1 - Central Management System (CMS)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

29.2 - Endpoint Security (HX)

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: FireEye Add-on for Splunk Enterprise

Earlier name/vendor

FireEye Endpoint Security (HX)

29.3 - ETP

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

29.4 - MPS

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

30 - Trend Micro

30.1 - Deep Security Agent

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

31 - Varonis

31.1 - DatAdvantage

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

32 - Vectra AI

Earlier name/vendor

Vectra Cognito

32.1 - X-Series

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

33 - Zscaler appliances

33.1 - Zscaler Nanolog Streaming Service

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Zscaler Technical Add-On for Splunk

33.2 - Zscaler Log Streaming Service

To onboard such an appliance to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

Tested with: Zscaler Technical Add-On for Splunk