Configuring SIEM integration settings

To reduce the load on low-performance devices and to reduce the risk of system degradation as a result of increased application log sizes, you can configure the publication of audit events and task performance events to the syslog server via the Syslog protocol.

A syslog server is an external server for aggregating events (SIEM). It stores and analyzes received events and performs other log management actions.

You can use SIEM integration in two modes:

• Duplicate events on the syslog server: in this mode, all task performance events whose publication is configured in log settings, as well as all system audit events, continue to be stored on the protected device even after they are sent to the SIEM server.

  We recommend that you use this mode to reduce the load on the protected device as much as possible.

• Delete local copies of events: in this mode, all events that are registered during application operation and published to the SIEM server will be deleted from the protected device.

  The application never deletes local versions of the security log.

Kaspersky Security for Windows Server can convert events in application logs into formats supported by the syslog server so that those events can be transmitted and successfully recognized by the SIEM server. The application supports conversion into structured data format and into JSON format.

To reduce the risk that events will be relayed to the SIEM server unsuccessfully, you can define settings for connecting to a mirror syslog server.

A mirror syslog server is an additional syslog server to which the application switches automatically if the connection to the main syslog server is unavailable or if the main server cannot be used.

By default, SIEM integration is not used. You can enable and disable SIEM integration, and configure relevant settings (see the table below).

SIEM integration settings

To configure SIEM integration settings:

1. Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
2. Select the administration group for which you want to configure application settings.
3. Perform one of the following actions in the details pane of the selected administration group:
   • To configure application settings for a group of protected devices, select the Policies tab and open the Properties: <Policy name> window.
   • To configure the application for a single protected device, select the Devices tab and open the Application settings window.

     If an active Kaspersky Security Center policy is applied to a device and blocks changes to application settings, then these settings cannot be edited in the Application settings window.

4. In the Logs and notifications section click the Settings button in the Task logs subsection.

   The Logs and notifications settings window opens.

5. Select the SIEM integration tab.
6. In the Integration settings section, select the Send events to a remote syslog server via syslog protocol check box.
   

   The check box enables or disables the functionality for sending published events to an external syslog server.

   If the check box is selected, the application sends published events to the SIEM server according to the configured SIEM integration settings.

   If the check box is cleared, the application does not perform SIEM integration. You cannot configure SIEM integration settings if the check box is cleared.

   The check box is cleared by default.

7. If necessary, in the Integration settings section, select the Remove local copies for events that have been sent to a remote syslog server check box.
   

   The check box enables or disables deletion of local copies of logs when they are sent to the SIEM server.

   If the check box is selected, the application deletes the local copies of events after they have been successfully published to the SIEM server. This mode is recommended on low-performance devices.

   If the check box is cleared, the application only sends events to the SIEM server. Copies of logs continue to be stored locally.

   The check box is cleared by default.

   The status of the Remove local copies for events that have been sent to a remote syslog server check box does not affect the settings for storing events of the security log: the application never automatically deletes security log events.

8. In the Events format section, specify the format to which you want to convert application events so that they can be sent to the SIEM server.

   By default, the application converts them into a structured data format.

9. In the Connection settings section:
   • Specify the SIEM connection protocol.
   • Specify the settings for connecting to the main syslog server.

     You can only specify an IP address in IPv4 format.

   • Select the Use mirror syslog server if the main server is not accessible check box if you want the application to use other connection settings when unable to send events to the main syslog server.

     Specify the following settings for connecting to the mirror syslog server: Address and Port.

     The Address and Port fields for the mirror syslog server cannot be edited if the Use mirror syslog server if the main server is not accessible check box is cleared.

     You can only specify an IP address in IPv4 format.

10. Click OK.

The configured SIEM integration settings will be applied.