jerome_itable Lv2Posted 23 Jan 2024 16:42
  
Sending Logs to Elasticsearch:

    Syslog Configuration:
        Configure NGAF to forward logs via syslog to the Elk Stack server. You can choose from UDP or TCP transport protocols.
        Specify the hostname or IP address of your Elk Stack server and the desired port (typically 514 for UDP).
        Select the log categories you want to send (e.g., firewall, VPN, intrusion detection).

    Logstash Configuration:
        Set up a Logstash instance on your Elk Stack server.
        Define a Logstash input to receive syslog messages from the specified port.
        Use a grok filter to parse the NGAF log format. You can find example grok patterns online or in the Sangfor NGAF documentation.
        Add any desired transformations or enrichments to the data (e.g., adding timestamps, geo-location).
        Output the processed data to Elasticsearch.

    Kibana Visualization:
        Create dashboards in Kibana to visualize the NGAF logs.
        Use filters, aggregates, and other analytics features to gain insights into network activity, threats, and security events.

Alternatives to Kiwi Syslog:

    Open-source options:
        Graylog: A popular open-source log management platform with a user-friendly interface and powerful filtering and analysis capabilities.
        Logsene: Another open-source platform that offers centralized log collection, storage, and visualization.
        Fluentd: A flexible data collector that can forward logs to various destinations, including Elasticsearch.

    Commercial options:
        Elasticsearch Cloud: Hosted Elasticsearch solution from Elastic.co with built-in Kibana.
        Splunk: Popular commercial log management platform with rich analytics and reporting features.

Community Experiences:

    Check out this Sangfor community forum thread for some user experiences and helpful tips on sending NGAF logs to Elasticsearch: https://community.sangfor.com/plugin.php?id=info:index
    You can also find online tutorials and blog posts with detailed instructions on configuring the process.

I Can Help:

Change

Moderator on This Board

0
2
4

Started Topics

Followers

Follow

67
14
3

Started Topics

Followers

Follow

3
0
2

Started Topics

Followers

Follow

1
131
3

Started Topics

Followers

Follow

Board Leaders