main
mdx 47 lines 1.64 KB
Raw
1 ---
2 title: Network connectors (syslog)
3 description: Vendor-by-vendor syslog ingestion patterns and validation steps.
4 ---
5
6 Network connectors ingest **syslog events** from firewalls and network devices (and some syslog-forwarding services).
7
8 ## Data path (how it flows)
9
10 **Typical flow:**
11
12 1. Network device → **syslog sender** (UDP/TCP)
13 2. Syslog collector/ingestion → **Graylog** (inputs/streams/pipelines)
14 3. Routed/normalized events → **Wazuh Indexer / OpenSearch-backed storage** (tenant-aware)
15 4. Graylog alert definitions → `gl-events*` → **CoPilot Incident Management → Alerts**
16 5. Operator workflow → **Cases**
17
18 > The key requirement in multi-tenant setups is **tenant-aware routing**.
19
20 ## Vendor/device guides
21
22 - [Fortinet FortiGate](/integrations/network-connectors/fortigate)
23 - [Palo Alto Networks](/integrations/network-connectors/palo-alto)
24 - [Cisco ASA](/integrations/network-connectors/cisco-asa)
25
26 ## Success criteria
27
28 - [ ] Syslog events are arriving
29 - [ ] You can identify the device/source
30 - [ ] Events are routed/tagged to the correct customer
31 - [ ] You can build at least one alert on top of the data (optional)
32
33 ## Starter alerts (generic)
34
35 These are useful across most firewall/device syslog sources:
36
37 - Excessive denies/drops from a single source IP
38 - Inbound connections to sensitive ports (RDP/SSH/VPN admin)
39 - New admin login or configuration change event
40 - Threat/UTM events (if your device emits them)
41
42 ## Troubleshooting
43
44 - Validate the device is sending to the correct IP/port
45 - Confirm the collector is listening and receiving
46 - Confirm parsing/extraction fields exist (vendor format)
47 - Confirm routing rules / customer association