diff --git a/docs/assets/instructions/sonicwall_sma/settings.png b/docs/assets/instructions/sonicwall_sma/settings.png new file mode 100644 index 0000000000..b1805188c3 Binary files /dev/null and b/docs/assets/instructions/sonicwall_sma/settings.png differ diff --git a/docs/xdr/features/collect/integrations/network/sonicwall_sma.md b/docs/xdr/features/collect/integrations/network/sonicwall_sma.md new file mode 100644 index 0000000000..328a3492af --- /dev/null +++ b/docs/xdr/features/collect/integrations/network/sonicwall_sma.md @@ -0,0 +1,41 @@ +uuid: 622999fe-d383-4d41-9f2d-eed5013fe463 +name: SonicWall SMA +type: intake + +## Overview + +SonicWall Secure Mobile Access offers secure and seamless remote access to corporate resources, applications, and data, enhancing workforce mobility while maintaining robust security and compliance measures. + +!!! warning + Important note - This format is currently in beta. We highly value your feedback to improve its performance. + +{!_shared_content/operations_center/detection/generated/suggested_rules_622999fe-d383-4d41-9f2d-eed5013fe463_do_not_edit_manually.md!} + +{!_shared_content/operations_center/integrations/generated/622999fe-d383-4d41-9f2d-eed5013fe463.md!} + +## Configure + +This setup guide will show you how to forward your SonicWall SMA logs to Sekoia.io by means of a syslog transport channel. + +### Prerequisites + +- Have an internal log concentrator (Rsyslog) + +### Enable Syslog forwarding for SonicWall SMA + +1. Log in to the SonicWall SMA appliance’s management interface +2. Go to `Log > Settings` +3. In the Log & Alert levels section, define the severity level of log messages. +4. In the syslog settings, type the ip address and the port of your log concentrator as Primary syslog server. + + ![SonicWall SMA settings](/assets/instructions/sonicwall_sma/settings.png) + +5. Click Accept to save your configuration settings + +### Create the intake + +Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format SonicWall SMA. + +### Forward logs to Sekoia.io + +Please consult the [Syslog Forwarding](../../../ingestion_methods/sekoiaio_forwarder/) documentation to forward these logs to Sekoia.io. diff --git a/mkdocs.yml b/mkdocs.yml index 5b77d60c3c..618755fc28 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -207,6 +207,7 @@ nav: - Pulse / Ivanti Secure Connect: xdr/features/collect/integrations/network/pulse.md - Rubycat PROVE IT: xdr/features/collect/integrations/network/rubycat_prove_it.md - SonicWall Firewall: xdr/features/collect/integrations/network/sonicwall_fw.md + - SonicWall SMA: xdr/features/collect/integrations/network/sonicwall_sma.md - Squid: xdr/features/collect/integrations/network/squid.md - Stormshield SNS: xdr/features/collect/integrations/network/stormshield_network_security.md - Suricata: xdr/features/collect/integrations/network/suricata.md