Configuring Syslog Collectors

Veeam App for Palo Alto Networks XSIAM receives data from Veeam Backup & Replication or Veeam ONE through syslog collectors added to Palo Alto Networks Broker virtual machines. For more information about broker VMs, see this section in the Cortex XSIAM documentation.

To add a syslog collector, do the following:

1. In the main menu, click Settings > Configurations.
2. On the Data Broker > Broker VMs > Brokers tab, select a broker virtual machine. In the Apps column, click Add and select Syslog Collector.
3. In the New Syslog Data Source window, specify the following settings:

• Protocol — Transport protocol used by the syslog server. Default values are TCP, UDP or TLS.
• Port — Port number used by the syslog server. Default values are 514 (for TCP and UDP) and 6514 (for TLS).
• Source Network — IPv4 address or subnet of the syslog server.
• Format — The format of syslog messages. To display the data correctly, select RAW.
• Vendor — The name of the product vendor. To display the data correctly, specify Veeam.
• Product — The name of the product you want to get data from. For example, VBR.

4. Click Done.

After you add a syslog collector, the dataset is created. The name of the dataset includes values of the Vendor, Product, and Format settings.. For example, veeam_vbr_raw. If you use correlation rules, specify the name of the dataset in the correlation rule query. For more details, see Configuring Correlations.