Configure Suricata to send alerts to LogSentinel SIEM¶
To send alerts to LogSentinel SIEM, you must first configure a syslog integration.
You must have access to the Suricata device and have the permissions to write to configuration files and to restart services.
Ensure that rsyslog is installed on the system where Suricata is running.
- Log in to the Suricata device.
- Open the Suricata configuration file
suricata.yaml, found in the Suricata installation directory.
- Update the eve-log entry under the outputs header. Use the following example:
outputs: - eve-log: enabled: yes filetype: syslog identity: “suricata” facility: local0 types: - alert:
/etc/rsyslog.confand add a forwarding rule to send the alerts to LogSentinel SIEM. Use the following example:
local0.* @@<LogSentinel IP/hostname>:<port>
- Restart the Suricata and rsyslog services.
Make sure that all firewalls (including the firewall on the collector machine) allow connections to the collector port