Overview
Cloud Control Center forwards the records shown on the Monitoring pages to a syslog server on your own network. Audit logs, events, and alerts are sent in standard syslog (RFC 5424) format to the destination you specify, so Elisity records are retained in the logging and security tooling you already operate, such as Splunk, QRadar, or Microsoft Sentinel.
The destination is configured in Cloud Control Center as a Syslog external monitor. Cloud Control Center stores the configuration, and the Elisity AD Agent running on your network delivers the events to the syslog server over UDP or TCP. A tenant supports one Syslog monitor, and it operates alongside a security information and event management (SIEM) monitor such as HEC Log Exporter, Microsoft Sentinel, or Splunk.
For an overview of the Monitoring pages and the records available on each of them, see Monitoring. Per-rule policy logging from Virtual Edge Nodes is configured separately in Security Profiles.
Prerequisites
- Administrator access to Cloud Control Center with permission to manage Monitoring log events.
- An Elisity AD Agent registered in Cloud Control Center and running where it can reach the syslog server. Registered agents are listed under IdentityGraph > Connectors > Active Directory, on the Agents tab; to install and register one, see Connect Microsoft Active Directory.
- A syslog server that accepts messages on the port and protocol you plan to configure. The standard syslog port is 514.
- If the agent's service account does not have permission to relay syslog, a separate domain account for forwarding, entered in the format user@domain.com or DOMAIN\user.
Configuring the Syslog External Monitor
Step 1. Open External Monitors
Navigate to Monitoring > External Monitors and select Add External Monitor.
Step 2. Select the Syslog monitor type
The Add External Monitor panel lists the available monitor types. Locate the Syslog tile, using the search field to filter the list when several types are present, and select Configure.
Step 3. Define the syslog destination
Enter the address of the syslog server in Syslog Server Address, the listening port in Syslog Port, and the transport in Protocol. The port defaults to 514, and the protocol can be set to UDP or TCP. Match these values to the listener configured on the syslog server.
Syslog messages are not encrypted with TLS, so keep the path between the AD Agent and the syslog server on a trusted network segment.
Step 4. Complete the Credentials section
In the Credentials section, select the Agent that forwards the events. Select Use current AD Agent Credentials to forward the events with the agent's own service account; the Username and Password fields are then hidden. When the agent's service account does not have permission to relay syslog, leave the check box cleared, enter the Username of a separate domain account and, if the account has one, its Password. The password is masked as it is entered and can be revealed with the visibility control in the field.
The form contains the following fields:
| Field | Description |
|---|---|
| Syslog Server Address | The hostname or IP address of the syslog server that receives the events, for example syslog.corp.example.com. |
| Syslog Port | The port the syslog server listens on. The default is 514. |
| Protocol | The transport used to deliver the messages, either UDP or TCP. |
| Agent | The Elisity AD Agent that reads this configuration and forwards the events to the syslog server. |
| Use current AD Agent Credentials | When selected, the agent forwards the events with its own service account, and the Username and Password fields are hidden. Cleared by default. |
| Username | Required when Use current AD Agent Credentials is cleared. The domain account the agent uses to relay syslog. Enter the domain-qualified form of the account, either user@domain.com or DOMAIN\user. |
| Password | The password for the domain account. Optional; leave the field blank for an account without a password. |
Step 5. Submit the configuration
Select Submit. The Syslog monitor is created and listed on the External Monitors page, and the agent begins forwarding Monitoring events to the destination. Return to this page when the syslog server, the transport, or the account credentials change.
Because the AD Agent sends the events directly to the address you specify, the syslog server must remain reachable from the agent on the configured port and protocol. Cloud Control Center does not test the destination when the configuration is saved, so a monitor listed on the External Monitors page does not on its own confirm that messages are arriving. Verify delivery as described below.
Verifying Syslog Forwarding
Navigate to IdentityGraph > Connectors > Active Directory and select the Events tab to confirm that the agent is processing the forwarding configuration. Records produced by syslog forwarding are identified in the Source column by the values Syslog Forwarder and Syslog Agent.
Then confirm on the syslog server that Elisity messages are arriving. If no messages are received, check the following:
- The AD Agent selected in the Agent field is running and connected to Cloud Control Center. For agent connectivity issues, see Troubleshoot AD Agent Issues.
- The port and protocol on the monitor match the listener on the syslog server. A server listening on TCP does not accept messages sent over UDP.
- Firewall and network policy between the agent and the syslog server permit traffic on the configured port.
- The account used for forwarding, either the agent's service account or the domain account entered in the Credentials section, is valid and not locked out.
Events continue to be recorded on the Monitoring pages in Cloud Control Center whether or not forwarding succeeds, so the records remain available for review while a delivery issue is resolved.