Exporting events to SIEM systems
July 12, 2024
ID 255365
Kaspersky Container Security allows you to send event messages to SIEM systems for collection, analysis, and subsequent response to potential threats. The messages contain data for the same types and categories of events that are logged in the security event log.
The data about the system events is transmitted as the integration with the SIEM system is configured during the installation of the solution. Event messages are forwarded to the SIEM registration server in the CEF format over TCP or UDP using the provided port (typically port 514). When the solution is deployed, these parameters are specified in the values.yaml configuration file:
CEF_PROTOCOL=tcp
CEF_HOST=<ip address>
CEF_PORT=<port>
The transmitted message consists of the following components:
- The Syslog header, which specifies the date, time, and host name.
- Prefix and CEF version number.
- Device vendor.
- Solution name.
- Solution version.
- Solution-generated unique event type code.
- Event description.
- Event severity assessment.
- Additional information, such as device IP address, event reason, event result, and event status.