Contents x
    Syslog
    • 14 Sep 2023
    • 2 Minutes to read
    • Print
    • Dark
      Light
    • PDF
    Contents

    Syslog

    • Updated on 14 Sep 2023
    • 2 Minutes to read
    • Print
    • Dark
      Light
    • PDF
    Article summary

    About this Article
    This article provides the below information about configuration of Syslog server with VSP CMS, log format and unique message code and event mapping.


    Enable Syslog Server on CMS

    A super admin can add information related to Syslog server on VSP CMS as described below

    1. Login into CMS using URL https://<CMS _IPAddress> in any browser
    2. Navigate to Administration > Configurations in the left navigation pane
    3. Expand Syslog Server Settings
    4. Click Enable Forwarding
    5. Provide information about the Syslog server - Host Name, IP Address, Protocol, Port, Log Data Format and Log Filter
    6. Click TEST SETTINGS to test the configuration
    7. Click SAVE


    Syslog Format

    Log Format

    General Log Format
    TIMESTAMP|Virsec Security Platform|Virsec|<RELEASE VERSION>|<MESSAGE SPECIFIC NUMBER>|<BRIEF EVENT DECRIPTION>|<NOTIFICATION SEVERITY>|<DETAILED INFORMATION>


    The below table describes the log parameters:

    ParameterDescription
    TIMESTAMP

    The timestamp when the event occurred along with the log format (CEF: 1)

    Virsec Security Platform(Constant) Product name
    VirsecConstant
    <RELEASE VERSION>VSP Release Number
    <MESSAGE SPECIFIC NUMBER>This number is unique to each type of event
    <BRIEF EVENT DECRIPTION>A brief description of the event
    <NOTIFICATION SEVERITY>Provides the notification severity as below
    • 8 – Critical
    • 5 – Warning
    • 2 - Info
    <DETAILED INFORMATION>All relevant information related to the event
    Sample Log Message
    Jul  6 12:24:54 10.16.6.4 CEF: 1|Virsec Security Platform|Virsec|1.3.0|117|CMS User Login Successful|8|src=10.16.6.4 role=Super Admin login_at=06 Jul 2020 04:25:58 PM UTC realm=LOCAL username=npatro@virsec.com msg=User npatro@virsec.com succeeded in authentication.


    Attack/Threat Log Format

    General Attack/Threat Log Format
    TIMESTAMP|Virsec Security Platform|Virsec|<RELEASE VERSION>|<MESSAGE SPECIFIC NUMBER>|<BRIEF EVENT DECRIPTION>|<SEVERITY>|<EVENT ID>|<DETAILED INFORMATION>


    The below table describes the log parameters:

    ParameterDescription
    TIMESTAMP

    The timestamp when the event occurred along with the log format (CEF: 1)

    Virsec Security Platform(Constant) Product name
    VirsecConstant
    <RELEASE VERSION>VSP Release Number
    <MESSAGE SPECIFIC NUMBER>This number is unique to each type of event
    <BRIEF EVENT DECRIPTION>A brief description of the event
    <SEVERITY>Provides the severity as below
    • 10 – Attack
    • 8 – Threat
    • 5 - Notification
    <EVENT ID>This Event ID is a unique ID generated for each incident in CMS. The Event ID gives information about Attack Type, Date when the Incident was reported.
    <DETAILED INFORMATION>All relevant information related to the event

    The Event ID depicts the below information:

    Sample Attack/Threat Log
    Jul  7 02:46:23 10.16.6.4 CEF: 1|Virsec Security Platform|Virsec|1.3.0|2|SQLi|10|EventId=VS-SQLI-070720-A00262|Application_Name=Suneel-Tomcat7 Tomcat7 Server_Name=WIN-SUNEEL Incident_Level=ATTACK Incident_Category=WEB_ATTACK Incident_Type=SQLi Incident_Timestamp=07 Jul 2020 06:47:28 AM UTC Threat Level=ATTACK Malicious Input=[{"account_name": "smith' OR '1' = '1"}] Attacker=10.16.11.250:55998 Event Source Name=CVE SQL=SELECT * FROM user_data WHERE last_name = ?{1=smith' OR '1' = '1} Session token id=F5B0479E70CE19603A807CC15183EB1A UUID=50e5e82d-403e-4c HTTP Request=POST /webgoat/attack pid=2056 description=SQLi category=Web Attack eventTime=2020-07-07 06:46:32 tid=25


    VSP Events

    The below table lists all the VSP events and their corresponding code:

    EventCode
    User Management Events
    New User Invited101
    CMS User Activated102
    CMS User Deactivated103
    CMS User Deleted104
    CMS User Role Updated105
    CMS User Password Reset106
    CMS User Account Locked107
    CMS User IP Address Blocked108
    Login and Logout Events
    CMS User log in successfully117

    CMS User logged out successfully

    		118

    CMS User logged in unsuccessful

    		119
    Application Related Events
    Application Created109
    Application Deleted110
    System Alerts
    Probe Associated to Application114
    New Probe Registration116
    Provisioning Related Events
    Application Provisioning Started111
    Application Provisioning Failed112
    Application Provisioning Stopped113
    Application Provisioning Completed115
    Attacks - Web Protection
    SQL Injection2
    Stored XSS4
    Reflected XSS5
    CRLF Injection6
    Path Traversal7
    CMDi (Command Injection)8
    Cross-site Request Forgery9
    Attacks - Web Protection (On Web Server)
    DOS Protection11
    Scanner Detection12
    Protocol Attack13
    Protocol Enforcement14
    Application Attack - LFI16
    Application Attack - RFI17
    Application Attack - RCE18
    Application Attack - XSS19
    Application Attack - SQLi20
    Application Attack - PHP21
    Application Attack - JAVA22
    Session Fixation23
    Method Enforcement30
    XML Injection31
    LFI RFI Attacks
    Local File Inclusion32
    Remote File Inclusion33
    DOM XSS34
    Fileless Attacks
    Buffer Error35
    Authentication Failures
    Authentication Failure37
    Attacks - Host Protection
    Process Monitoring40
    Library Monitoring41
    File Integrity42
    PVE Attacks
    Exception Notify46
    Signal Notify47


    Was this article helpful?
    What's Next