Syslog - SonicWall Firewall

TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM Syslog
ENVIRONMENT: SonicWall
SUMMARY: Configuration Guide for SonicWall firewalls using SonicOS

• Vendor Information
• Device Configuration Checklist
• Example Log Messages

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Syslog Guide to complete the Huntress Managed SIEM setup as well as opening a port in Microsoft Defender Firewall.

Vendor Information

1. Creating an address object
   1. Go to Network > Address Objects
   2. Click Add
   3. Enter a friendly name for the object. Example: Huntress-SIEM (this will be used later)
   4. Set Zone Assignment to LAN
   5. Set Type to Host
   6. Enter the Internal IP address of the Huntress agent configured to listen for syslog
   7. Click Add
2. Add a Syslog Server
   1. Go to Device > Log > Syslog page.
   2. Click Syslog Servers tab.
   3. Click Add. The Add Syslog Server dialog appears.
   4. Set the Event Profile to 0.
   5. For the Name or IP Address, select the name of the Address Object created above
   6. Set Port to 514. Please note that Huntress SIEM is not compatible with TLS or encrypted syslog messages! You must make sure "Enable TLS" is not checked and the transport protocol cannot be TLS
   7. Set Syslog Format to “Enhanced”
   8. Set Syslog Facility to “Local Use 0”
   9. Click OK
3. Logging Level Checks
   1. Follow this guide to verify your logging level setting is set to 'inform'. You may not see data unless your logging level is set to inform! Please see "Logging Levels" below for important info!
4. Enable the Syslog Server
   1. From the Syslog Server list find the one created above
   2. Check the box in the Enable column corresponding to the Syslog Server

Logging Levels

The default logging level is Inform if you follow the Device Configuration Checklist above without taking any additional action. This logging level works for most partners and is highly recommended as your starting point. 

Please note: 
Setting logging level to anything below inform may result in sporadic or no data being sent. 
Setting your logging level to anything above inform may result in duplicate sources. 

• Follow this guide for customizing Firewall and SSL VPN event profiles to customize which events get sent to SIEM.
• Refer to this guide to customize the log settings and levels that best suit your environment.