Configuration and firewall settings for Aurora Managed Endpoint Defense syslog mirroring
To allow communication between Arctic Wolf syslog mirroring servers and your organization's syslog servers, you need to configure your organization's firewall to allow connections from the appropriate Arctic Wolf IP addresses. Additionally, you need the FQDN (or IP) address and port of your organization's syslog servers, which needs to present a signed, TLS-enabled, server certificate to receive syslog messages. If your organization requires mTLS authentication, you need to provide a signed client certificate to Arctic Wolf. The following table lists the configuration details, such as the IP addresses that you should allow based on your assigned region for the Aurora Endpoint Security management console, as well as information about how to generate an mTLS client certificate for Arctic Wolf.
For assistance with setting up syslog mirroring for your organization, visit the Unified Portal and open a case for Aurora Managed Endpoint Defense. A Aurora Managed Endpoint Defense analyst will work with your organization to complete the configuration.
|
Requirement |
Description |
|---|---|
|
Allow the source IP address (from Arctic Wolf) |
Based on your assigned region, configure your firewall to allow connections from the appropriate IP address from Arctic Wolf:
|
|
Destination address and port number |
You need the FQDN (or IP) address and port number of your organization's syslog server that will receive the syslog messages. A signed, TLS-enabled, server certificate is required to establish a connection for syslog mirroring. |
|
Protocol |
TLS encrypted syslog over TCP |
|
mTLS authentication (optional) |
If mTLS authentication is required for your organization, you need to generate an mTLS client certificate and provide it to Arctic Wolf. When generating the mTLS client certificate:
CODE
|
|
Processing the header of the forwarded syslog event |
Syslog events that are forwarded to your organization's syslog servers have an extra header, in addition to the header of the original event. The header for the original event provides the accurate date and time of the event. You can configure your organization's system to process the extra header, which has the date and time of when the message was forwarded. The extra header is in RFC5424 format and is bolded in the example below:
CODE
Prior to the November 2022 update, the extra header was in RFC3164 format and is bolded in the example below:
CODE
|