Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SonicWall SMA docs #1389

Merged
merged 4 commits into from
Oct 23, 2023
Merged

SonicWall SMA docs #1389

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6894238
SonicWall SMA docs
vladyslav-huriev Oct 18, 2023
e0e5737
Update docs/xdr/features/collect/integrations/network/sonicwall_sma.md
vg-svitla Oct 19, 2023
bc2ab03
Add screenshot and update instructions
vladyslav-huriev Oct 19, 2023
7687b16
Fix docs
squioc Oct 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added docs/assets/instructions/sonicwall_sma/settings.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
41 changes: 41 additions & 0 deletions docs/xdr/features/collect/integrations/network/sonicwall_sma.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
uuid: 622999fe-d383-4d41-9f2d-eed5013fe463
name: SonicWall SMA
type: intake

## Overview

SonicWall Secure Mobile Access offers secure and seamless remote access to corporate resources, applications, and data, enhancing workforce mobility while maintaining robust security and compliance measures.

vg-svitla marked this conversation as resolved.
Show resolved Hide resolved
!!! warning
Important note - This format is currently in beta. We highly value your feedback to improve its performance.

{!_shared_content/operations_center/detection/generated/suggested_rules_622999fe-d383-4d41-9f2d-eed5013fe463_do_not_edit_manually.md!}

{!_shared_content/operations_center/integrations/generated/622999fe-d383-4d41-9f2d-eed5013fe463.md!}

## Configure

This setup guide will show you how to forward your SonicWall SMA logs to Sekoia.io by means of a syslog transport channel.

### Prerequisites

- Have an internal log concentrator (Rsyslog)

### Enable Syslog forwarding for SonicWall SMA

1. Log in to the SonicWall SMA appliance’s management interface
squioc marked this conversation as resolved.
Show resolved Hide resolved
2. Go to `Log > Settings`
3. In the Log & Alert levels section, define the severity level of log messages.
4. In the syslog settings, type the ip address and the port of your log concentrator as Primary syslog server.

![SonicWall SMA settings](/assets/instructions/sonicwall_sma/settings.png)

5. Click Accept to save your configuration settings

### Create the intake

Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format SonicWall SMA.

### Forward logs to Sekoia.io

Please consult the [Syslog Forwarding](../../../ingestion_methods/sekoiaio_forwarder/) documentation to forward these logs to Sekoia.io.
1 change: 1 addition & 0 deletions mkdocs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,7 @@ nav:
- Pulse / Ivanti Secure Connect: xdr/features/collect/integrations/network/pulse.md
- Rubycat PROVE IT: xdr/features/collect/integrations/network/rubycat_prove_it.md
- SonicWall Firewall: xdr/features/collect/integrations/network/sonicwall_fw.md
- SonicWall SMA: xdr/features/collect/integrations/network/sonicwall_sma.md
- Squid: xdr/features/collect/integrations/network/squid.md
- Stormshield SNS: xdr/features/collect/integrations/network/stormshield_network_security.md
- Suricata: xdr/features/collect/integrations/network/suricata.md
Expand Down