Sending the Firewall Purple logs to SIEM

Follow

prabuaj

• February 27, 2024 06:36

Hi Firewall Community,

 

I have a Splunk environment where i have been centralized all the logs belongs to network devices. Prior to purchase the Firewall purple i was running the PfSense firewall on  Esxi. Previously I have created the customized dashboard on splunk for pfsense via syslogs from pfsense.

Is there any method to get the syslogs from firewalla purple to achieve the similar result from pfsense?

 

Thank you.

Jesu

 

 

 

0

• 

  Firewalla

  • February 27, 2024 16:49

  Firewalla runs linux, so syslog can be accessed https://help.firewalla.com/hc/en-us/articles/115004397274-How-to-access-Firewalla-using-SSH

  Not everything inside the firewalla can be pushed to syslogs, so you may need API's to query things, see https://help.firewalla.com/hc/en-us/articles/5345330648083-Getting-Started-with-the-Firewalla-MSP-API

  0

  Comment actions Permalink
• 

  prabuaj

  • March 10, 2024 10:30

  Thank you for your reply. I am using Firewalla Purple, I checked there is no API feature available.

  0

  Comment actions Permalink
• 

  Chris Hewitt

  • April 10, 2024 13:11
  • Edited

  We do API calls for our Purple data all the time.

  0

  Comment actions Permalink
• 

  seanchiggins

  • June 30, 2024 14:55

  Take a look at https://help.firewalla.com/hc/en-us/community/posts/360048667694-Log-files?page=2#comments I was able to use rsyslog to sent my logs to a syslog server and then on the server import them into Elastic, but I would assume it would be the same for Splunk.

  0

  Comment actions Permalink

Please sign in to leave a comment.