Stormshield firewall logs identified as Unix OS - SC4S

corti77 — Tue, 12 Sep 2023 14:49:31 GMT

Hi,

I just deployed the latest version 2 of SC4S and I sent syslog events from our firewall Stormshield. I checked and I didn't see a specific source for this firewall brand

The box is capable of sending logs in the format RFC5424, UDP/514.

I did not configure a custom filter for it and the logs are automatically recognized as UNIX OS syslog events which is wrong, they are indexed in the osnix instead of netfw.

I would like to create a filter based on the source host but I don't find any examples in the official github documentation.

for version 1 there is some but I am not sure if it applies to version 2.

https://splunk.github.io/splunk-connect-for-syslog/1.110.1/configuration/#override-index-or-metadata-based-on-host-ip-or-subnet-compliance-overrides

any suggestion?

many thanks

topic Stormshield firewall logs identified as Unix OS - SC4S in Getting Data In

Stormshield firewall logs identified as Unix OS - SC4S