Unifi

Unifi: Manages network devices including routers, switches, and access points with centralized control.

To onboard such a source to Axoflow, complete the generic appliance onboarding steps.

Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label	Message field	value
vendor	meta.vendor	ubiquiti
product	meta.product	unifi
service	meta.service.name	crond, logread, kernel, mcad, switch, UDMPRO

You can use the labels as:

• Filter labels on the Analytics page,
• in the Filter By Label field during log tapping.

You can use the message fields

• in Flow Processing steps, for example, in the Query field of Select Messages steps,
• in AQL expressions in the search bars.

Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype	index
ubnt	netops
ubnt:cef	netops
ubnt:dhcp	netops
ubnt:dnsmasq	netops
ubnt:edgeswitch	netops
ubnt:hostapd	netops
ubnt:link	netops
ubnt:mcad	netops
ubnt:sudo	netops
ubnt:wireless	netops
ubnt:fw	netfw
ubnt:fw:cef	netfw

Sending data to Google SecOps

When sending the data collected from this source to a dynamic Google SecOps destination, Axoflow sets the following log type: UBIQUITI_SWITCH.