Configure LogRhythm SIEM Syslog Integration

NetMon outputs a syslog feed of Alarms, Audit, and Flow Traffic Data to the LogRhythm SIEM (or any other SIEM which supports syslog).

To integrate NetMon with LogRhythm SIEM:

1. Enable Syslog on the collecting Agent:

   1. Log in to the LogRhythm Console.

   2. Open the Deployment Manager.

   3. Click the System Monitors tab.

   4. Double-click the Agent that will receive the Syslog output.

   5. On the Syslog and Flow Settings tab, select the Enable Syslog Server check box.

   6. Click the Advanced button, and then set the SyslogTCPPort to 514. Click OK.

   7. Click OK to close the System Monitor Agent Properties dialog box.

2. Configure NetMon to Output Syslog:

   1. Open the NetMon Web Management interface.

   2. On the top navigation bar, click Configuration, and then click the Syslog tab.

   3. In the Syslog Type field, select TCP or UDP.

   4. In the Syslog IP field, enter your System Monitor Agent's IP address.

   5. Click Apply Changes.

3. Verify that the Agent is receiving Syslog output:

   1. Click the Log Sources tab.

   2. Click the Refresh icon to refresh Log Sources.

   3. The Pending New Log Source appears with the Log Host Name of the NetMon server.

   4. Double-click the new Log Source.

   5. In the Log Source Acceptance Properties dialog box, change the Log Source Type to Syslog - LogRhythm Network Monitor.

   6. Select the Action check box, right-click the Log Source, click Actions, click Accept, and then click Custom.

   7. Select the “LogRhythm Default v2.0” Log Processing Policy and click OK.