| 1 | --- |
| 2 | title: SonicWall (syslog) |
| 3 | description: Forward SonicWall firewall logs to the SIEM via direct syslog or syslog-ng with TLS. |
| 4 | --- |
| 5 | |
| 6 | ## What this connector is |
| 7 | |
| 8 | This connector covers two approaches for forwarding **SonicWall** logs to your SIEM: |
| 9 | |
| 10 | 1) Direct syslog forwarding (UDP/TCP) |
| 11 | 2) Syslog-NG collector (local UDP) → TLS forwarding (recommended for production) |
| 12 | |
| 13 | Direct syslog guide: |
| 14 | - https://socfortress.supportbench.net/ar-1084/ |
| 15 | |
| 16 | --- |
| 17 | |
| 18 | ## Method 1: Direct syslog forwarding (UDP/TCP) |
| 19 | |
| 20 | 1) Log into SonicWall web management UI |
| 21 | 2) Go to **Log → Settings → Syslog** |
| 22 | 3) Enable syslog |
| 23 | 4) Configure syslog server: |
| 24 | - Host/IP |
| 25 | - Port |
| 26 | - Format (Syslog or CEF) |
| 27 | - Optional Syslog ID |
| 28 | 5) Select log categories (attacks, drops, user activity, etc.) |
| 29 | 6) Apply/Accept |
| 30 | |
| 31 | Validate logs arrive in the SIEM. |
| 32 | |
| 33 | --- |
| 34 | |
| 35 | ## Method 2: Syslog-NG collector (recommended) |
| 36 | |
| 37 | ### Architecture |
| 38 | |
| 39 | ``` |
| 40 | SonicWall (UDP) → Syslog-NG Collector (local) → TLS → SIEM Stack |
| 41 | ``` |
| 42 | |
| 43 | ### Steps (high level) |
| 44 | |
| 45 | 1) Deploy a local syslog-ng collector: |
| 46 | - https://socfortress.supportbench.net/article/local-log-collector-using-syslog-ng |
| 47 | |
| 48 | 2) Point SonicWall syslog destination to the **local collector IP** |
| 49 | |
| 50 | 3) Configure syslog-ng to forward via **TLS** to the SIEM |
| 51 | |
| 52 | 4) Verify end-to-end flow: |
| 53 | - collector receiving |
| 54 | - TLS connection established |
| 55 | - SIEM receiving and parsing |
| 56 | |
| 57 | --- |
| 58 | |
| 59 | ## Notes |
| 60 | |
| 61 | - If logs traverse the internet, prefer TLS forwarding. |
| 62 | - Keep NTP/time sync correct. |
| 63 | - Monitor log volume. |