search

sophos / Sophos-Central-SIEM-Integration

Simple integration script for 3rd party systems such as SIEMs. Offers command line, file or syslog output in CEF, JSON or key-value pair formats.
121 stars 70 forks source link

syslog export for rapid7 #44

Closed ethernetguru closed 3 years ago

ethernetguru commented 3 years ago

I am setting up a syslog export for rapid 7 and following the guide here: https://docs.rapid7.com/insightidr/sophos-central/ I was able to get a connection done and got a result.txt that showed recent data back but I am not able to get the syslog connection working. Do I have the correct config file?

Edit: The script is running on a windows server with python 3 

---snip--
[login]

# API Access URL + Headers
# API token setup steps: https://community.sophos.com/kb/en-us/125169
token_info = url: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# format can be json, cef or keyvalue
format = json
# filename can be syslog, stdout, any custom filename
filename = syslog
# endpoint can be event, alert or all
endpoint = event
# syslog properties
# for remote address use <remoteServerIp>:<port>, for e.g. 192.1.2.3:514
# for linux local systems use /dev/log
# for MAC OSX use /var/run/syslog
address = xx.xx.xx.xx:514
facility = daemon
socktype = udp

--snip--
tennis-r7 commented 3 years ago

@ethernetguru did you resolve this?

ethernetguru commented 3 years ago

@tennis-r7 I did get this resolved by working with rapid7 support. The default port of 514 is already bound to other inbound connections so I made it another port number.

fdejesus1125 commented 3 years ago

Can you share this the code with me. I am also running into a similar problem.

ethernetguru commented 3 years ago

The main issue was because that the collector service is already monitoring the port of 514 that is for syslog dumps. A new port was set up 516 to be used instead. So the collector port needs to be updated in the inisight idr to look for port 516 image and then the config.ini changed to match that new port number.


format = json
# filename can be syslog, stdout, any custom filename
filename = syslog
# endpoint can be event, alert or all
endpoint = event
# syslog properties
# for remote address use <remoteServerIp>:<port>, for e.g. 192.1.2.3:514
# for linux local systems use /dev/log
# for MAC OSX use /var/run/syslog
address = x.x.x.x:516
facility = daemon
socktype = udp
tennis-r7 commented 3 years ago

@fdejesus1125 if you want to share some details of the problem you're facing, perhaps we can provide more help.