Configuring SIEM integration settings

By default, SIEM integration is not used. You can enable and disable SIEM integration, and configure relevant settings (see the table below).

SIEM integration settings

To configure the settings for integration with SIEM:

1. In the Application Console tree, open the context menu of the Logs and notifications node.
2. Select Properties.

   The Logs and notifications settings window opens.

3. Select the SIEM integration tab.
4. In the Integration settings block, select the Send events to a remote syslog server via syslog protocol check box.
   

   The check box enables or disables the functionality for sending published events to an external syslog server.

   If the check box is selected, the application sends published events to the SIEM server according to the configured SIEM integration settings.

   If the check box is cleared, the application does not perform SIEM integration. You cannot configure SIEM integration settings if the check box is cleared.

   By default, the check box is cleared.

5. If necessary, in the Integration settings block, select the Remove local copies for events that have been sent to a remote syslog server check box.
   

   The check box enables or disables deletion of local copies of logs when they are sent to the SIEM server.

   If the check box is selected, the application deletes the local copies of events after they have been successfully published to the SIEM server. This mode is recommended on low-performance devices.

   If the check box is cleared, the application only sends events to the SIEM server. Copies of logs continue to be stored locally.

   By default, the check box is cleared.

   The status of the Remove local copies for events that have been sent to a remote syslog server check box does not affect the settings for storing events of the security log: the application never automatically deletes security log events.

6. In the Events format block, specify the format to which you want to convert application events so that they can be sent to the SIEM server.

   By default, the application converts them into a structured data format.

7. In the Connection settings block:
   • Specify the SIEM connection protocol.
   • In the fields of the same name, specify the IPv4 address and port for connecting to the main syslog server.
   • Select the Use mirror syslog server if the main server is not accessible check box if you want the application to use other connection settings when unable to send events to the main syslog server.
   • In the fields of the same name, specify the IPv4 address and port for connecting to an additional syslog server.
8. Click the OK button.

   The configured SIEM integration settings will be applied.