Export to Syslog Server

[xpreme]

Dear friends,

    Good day. I have configured "Export to SIEM system" on my administration server (Automatically export... was checked as well). But nothing is exported to the syslog server. However, as I enable syslog export on KSWS policy (for servers) it sends data to syslog server (per server) successfully. But I need to send Kaspersky Security Center events to syslog server. Would it be possible? By the way, Kaspersky server has access to syslog server on port 514 UDP and TCP.

Thanks  in advance

[JL - KL DACH]

Hello,

please configure the export to Siem system as described here and make sure the certificates are valid

Configuring Kaspersky Security Center for export of events to a SIEM system

After that configure Events to be send to the SIEM System as described here:

support.kaspersky.com/KSC/14.2/en-US/151327_1.htm

If you still encounter issues open a ticket with Technical Support

Thank you in advance

Best Regards

 

[ElvinE5]

in support of the previous post

If in simple terms...

 

after you have configured the forwarding of SIEM events ... exactly by the SYSLOG protocol ... you must specify WHAT events you need to send ...

To do this, in the properties of ALL policies for products, you need to mark ALL necessary events that must be sent ...

Спойлер

 

PS:

if you have an Advanced license or higher, and when sending events to SIEM in CEF or LEEF formats, you do not need to additionally configure anything ... all events will be sent to SIEM

[xpreme]

Dear @ElvinE5

Thanks for your all time support. It was straightforward and cool. I checked some events to be exported to Syslog server. I am waiting for the result.

Thanks

[xpreme]

Hi @Joerg Lechea

Thanks for your support. I am checking @ElvinE5 's solution as well.

Thanks

[xpreme]

Hi,

@Joerg Lechea 

Good day. Does this feature require a special license? I am now using a Select license. 

Thanks

[JL - KL DACH]

Hello xpreme,

the license is only relevant using specific SIEM System like Qradar. As per following link Select license supports it by using Syslog

Licenses and features of Kaspersky Security Center 14.2

Regards

 

[xpreme]

Hi @Joerg Lechea

    Thanks for youe support. As a matter of fact, events are exported while setting on Syslog server but it does not work when choosing Splunk format. Then I checked Kaspersky event in Windows event viewer. I found some errors regarding export failure due to limited functionality mode. So, I guessed it is somthing related to license.

Thanks

[JL - KL DACH]

Hello,

I suggest to open a ticket with Technical Support for further investigations.

Regards

[ElvinE5]

В 17.07.2023 в 12:28, xpreme сказал:

Does this feature require a special license? I am now using a Select license. 

I'm sorry, I'll try to explain again...

1. when using your "Select" license - you can send events to all SIEM (Splunk, QRadar, etc.) systems BUT ONLY via Syslog protocol

Спойлер

At the same time, as I wrote above, you will need to "manually" select which events to send ...

 

2. If you have an "Advanced" license, or higher ... You can use all other options for sending events

Спойлер

and also you don't have to choose which messages to send... the server will send absolutely everything

but in order for the functionality to become available, you will need to additionally activate the KSC itself with the appropriate activation key

Спойлер

it is included in the license package that you purchase...

Edited July 25, 2023 by ElvinE5

[xpreme]

Thanks @ElvinE5 for your usual support.

Thanks @Joerg Lechea for your reply.