WatchGuard

This article covers how to create a remote log target and send the generated logs to Chronicle as syslog format. 

Trend Micro Apex Central™ is a web-based console that provides centralized management for Trend Micro products and services at the gateway, mail server, file server, and corporate desktop levels.

Prerequisites

Admin Login credentials for the WatchGuard.

Configuration

Steps to create a Remote Log Target

1. Select System > Logging.
2. Click the Syslog Server tab.
3. Select the Send log messages to these Syslog servers check box.
4. Click Add.
5. In the IP Address text box, type the IP address of the Syslog Server.
6. In the Port text box, Type: 11674
7. From the Log Format drop-down list, Select Syslog.

The details you can include in the log messages depend on the log format you select.

1. Select The timestamp check box.
2. Select The serial number of the device check box.
3. In the Syslog Settings section, for each type of log message, select a Syslog facility from the drop-down list.

• • - For High-Priority Syslog messages, such as Alarms, select Local0.
  • - To assign priorities for other types of log messages (lower numbers have greater priority), select Local1 - Local7.
  • - To not send details for a message type, select NONE.

4. Click OK.

 Now the Logs will be generated to the Chronicle as SYSLOG format.