Security Information and Event Management (SIEM) software collects, analyzes, and aggregates security data from multiple sources to detect potential security threats. You can choose to send the events detected by Aurora Endpoint Security solutions to your organization’s SIEM software or syslog server. The alert data that is sent to a SIEM or syslog server is the same alert data that is displayed in the management console. For more information about the specific events reported by Aurora Endpoint Security solutions, see the Aurora Endpoint Security Syslog Guide.
In the management console, on the menu bar, click Settings > Application.
Select the Syslog/SIEM check box.
Select the events that you want to send to your organization's SIEM or syslog integration. For more information about each event type, see the Aurora Endpoint Security Syslog Guide.
