Configure Epic for Arctic Wolf monitoring

You can configure Epic® to send the necessary logs to Arctic Wolf® for security monitoring.

CAUTION: Make sure that PII, PHI, and other sensitive information are not included in the data ingested through this integration unless explicitly required and authorized. Validate all data sources and configurations to ensure compliance with applicable privacy and regulatory requirements.

These resources are required:

  • An activated Arctic Wolf Sensor or Virtual Log Collector (vLC)
  • Administrator permissions for Epic System Definitions
  • If you use encrypted syslog, TLS version 1.2 and a certificate. Contact your CST for more information.
Note: Arctic Wolf supports TLS version 1.2 for encrypted syslog data sent to the Arctic Wolf Sensor. If your log source requires older cipher suites, contact your Concierge Security® Team (CST) to discuss an exception.

Configure Epic Hyperspace syslog settings

Note: Arctic Wolf supports raw log ingestion for syslog integrations, but security monitoring is not currently available for every log type. CEF formatting does not guarantee that every Epic event type is monitored.
  1. Sign in to Hyperspace.
  2. Navigate to Epic > System Definitions > Security > Auditing Options > SIEM Syslog Settings > SIEM Syslog Configuration Options.
  3. Configure these settings:
    • Host — Enter the IP address or hostname of the Arctic Wolf Sensor or vLC.
    • Port — Enter 514 for standard syslog or 6514 for encrypted syslog.
    • SIEM format — Select CEF (Common Event Format).
    • Syslog ending character — Select New Line (\n).
    • Check Application Layer Response — Set to Disabled.
    • Record Pointer — Select Hash (SHA-256).
  4. In the SIEM Syslog Settings menu, click SIEM Syslog.
  5. Click Enabled.

Provide configuration information to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. ナビゲーションメニューで、［チケットとアラート］ > ［すべてのチケット］をクリックします。
  3. Perform the appropriate action, depending on if you are:
    • A new customer — In the Ticket Type list, select Onboarding. Then, click the existing [Deploy] Site Config: <ticket_subject> ticket.
    • An existing customer — Click Open a New Ticket.
  4. On the Open a New Ticket page, configure these settings:
    • What is this ticket related to? — Select General request.
    • Subject — Enter Syslog changes.
    • Related ticket (optional) — Keep empty.
    • Message — Enter this information for your Concierge Security® Team (CST):
      • Confirmation that you completed the steps in this configuration guide.
      • The IP address or hostname of the Arctic Wolf Sensor that you used during the configuration.
      • The IP address, timezone, and device type for all sources that you are forwarding.
      • Questions or comments that you have.
  5. Click Send Message.

    Your CST reviews the details to make sure that Arctic Wolf is successfully processing the logs.