Overview
Cloud Control Center forwards the records shown on the Monitoring pages to a syslog server on your own network. Audit logs, events, and alerts are sent in standard syslog (RFC 5424) format to the destination you specify, so Elisity records are retained in the logging and security tooling you already operate, such as Splunk, QRadar, or Microsoft Sentinel.
The destination is configured in Cloud Control Center as a Syslog external monitor. Cloud Control Center stores the configuration, and the Elisity AD Agent running on your network delivers the events to the syslog server over UDP or TCP. A tenant supports one Syslog monitor, and it operates alongside a security information and event management (SIEM) monitor such as HEC Log Exporter, Microsoft Sentinel, or Splunk.
For an overview of the Monitoring pages and the records available on each of them, see Monitoring. Per-rule policy logging from Virtual Edge Nodes is configured separately in Security Profiles.
Prerequisites
- Administrator access to Cloud Control Center with permission to manage Monitoring log events.
- An Elisity AD Agent registered in Cloud Control Center and running where it can reach the syslog server. Registered agents are listed under Settings > Active Directory > Agents; to install and register one, see Connect Microsoft Active Directory.
- A syslog server that accepts messages on the port and protocol you plan to configure. The standard syslog port is 514.
- A domain account for the agent, entered in the format user@domain.com or DOMAIN\user.
Configuring the Syslog External Monitor
Step 1. Open External Monitors
Navigate to Monitoring > External Monitors and select Add External Monitor.
Step 2. Select the Syslog monitor type
The Add External Monitor panel lists the available monitor types. Locate the Syslog tile, using the search field to filter the list when several types are present, and select Configure.
Step 3. Define the syslog destination
Enter the address of the syslog server in Syslog Server Address, the listening port in Syslog Port, and the transport in Protocol. The port defaults to 514, and the protocol can be set to UDP or TCP. Match these values to the listener configured on the syslog server.
Syslog messages are not encrypted with TLS, so keep the path between the AD Agent and the syslog server on a trusted network segment.
Step 4. Complete the Credentials section
In the Credentials section, select the Agent that forwards the events, then enter the Username and Password of the domain account the agent uses. The password is masked as it is entered and can be revealed with the visibility control in the field.
All fields on the form are required:
| Field | Description |
|---|---|
| Syslog Server Address | The hostname or IP address of the syslog server that receives the events, for example syslog.corp.example.com. |
| Syslog Port | The port the syslog server listens on. The default is 514. |
| Protocol | The transport used to deliver the messages, either UDP or TCP. |
| Agent | The Elisity AD Agent that reads this configuration and forwards the events to the syslog server. |
| Username | The domain account the agent uses. Enter the domain-qualified form of the account, either user@domain.com or DOMAIN\user. |
| Password | The password for the domain account. |
Step 5. Submit the configuration
Select Submit. The Syslog monitor is created and listed on the External Monitors page, and the agent begins forwarding Monitoring events to the destination. Return to this page when the syslog server, the transport, or the account credentials change.
Because the AD Agent sends the events directly to the address you specify, the syslog server must remain reachable from the agent on the configured port and protocol. Cloud Control Center does not test the destination when the configuration is saved, so a monitor listed on the External Monitors page does not on its own confirm that messages are arriving. Verify delivery as described below.
Verifying Syslog Forwarding
Navigate to Monitoring > Agent Events to confirm that the agent is processing the forwarding configuration. Records produced by syslog forwarding are identified in the Source column by the values Syslog Forwarder and Syslog Agent.
Then confirm on the syslog server that Elisity messages are arriving. If no messages are received, check the following:
- The AD Agent selected in the Agent field is running and connected to Cloud Control Center. For agent connectivity issues, see Troubleshoot AD Agent Issues.
- The port and protocol on the monitor match the listener on the syslog server. A server listening on TCP does not accept messages sent over UDP.
- Firewall and network policy between the agent and the syslog server permit traffic on the configured port.
- The domain account entered in the Credentials section is valid and not locked out.
Events continue to be recorded on the Monitoring pages in Cloud Control Center whether or not forwarding succeeds, so the records remain available for review while a delivery issue is resolved.