SIEM: Syslog - Versa SASE

Team: Huntress Managed Security Information and Event Management (SIEM)
Product: SIEM Syslog
Environment: Versa SASE
Summary: Configuration Guide for Versa SASE syslog forwarding in the CEF format, exported from a Versa Analytics log collector. Covers firewall and threat logs.

This page only covers the device-specific configuration. You'll still need to read the Huntress Managed SIEM Syslog Guide to set up a syslog collector and open a port in Microsoft Defender Firewall.

Vendor Information

CEF is the only format Huntress supports from Versa. Versa's templates default to KVP, and our Smart Filtering capabilities will not work unless the format is set to CEF.

Please note that Huntress provides third-party vendor instructions as a best effort to expedite onboarding. Vendor documentation and versions frequently change, so it may be necessary to find the appropriate documentation for your version of the vendor software or service. Versa does not publish a CEF field reference, so Huntress' field mapping is best-effort and still being validated against real exports.

Device Configuration Checklist

CEF export is configured on the Versa Analytics node that collects logs from your VOS devices, so your devices must already be sending logs to Analytics. All of the following is done in Versa Director. Huntress SIEM is not compatible with TLS or encrypted syslog.

Go to the Analytics tab, select your Analytics node, then go to Administration > Configurations > Log Collector Exporter.

Create a CEF Template

1. On the Remote Template tab, click the Add (+) icon.
2. Enter a Name (for example, Huntress-SIEM), set Type to Syslog, and set Format to CEF (not the default, KVP).
3. Click OK.

Create a Collector Pointing at Huntress

1. On the Remote Collector tab, click the Add (+) icon.
2. Enter a Name, then set Destination Address and Destination Port to the internal IP address (or FQDN) and port of the Huntress Agent configured to listen for syslog.
3. Set Type to UDP or TCP to match the Huntress collector (not TLS), and select the CEF template created above for Template.
4. Click OK.

Export the Firewall and Threat Logs

1. On the Exporter Rules tab, click the Add (+) icon.
2. Enter a Name, select your Local Collector, and set Remote Collector Profile to a profile that contains the Huntress collector.
3. Under Log Types, select the firewall and threat logs: firewall-log and threat-log (which cover idpLog, avLog, and urlfLog). If you select none, all log types are exported.
4. Click OK.

Other Versa log types will still arrive, but are treated as generic CEF and are not normalized.

Example Log Messages

These examples are illustrative, based on Versa's published log field reference. Your export may include additional fields.

Firewall Log Message

<134>Oct  8 15:21:07 sase-gw CEF:0|Versa Networks|VOS|22.1|accessLog|accessLog|3|applianceName=SaseGateway tenantName=Corp-Inline-Customer-1 action=allow rule=Allow_To_SDWAN sourceIPv4Address=10.0.35.224 destinationIPv4Address=10.48.0.99 sourceTransportPort=1505 destinationTransportPort=53 protocolIdentifier=17 appIdStr=dns fromUser=jdoe

Threat (IPS) Log Message

<134>Oct  8 15:24:10 branch-1 CEF:0|Versa Networks|VOS|22.1|idpLog|idpLog|7|applianceName=Branch-1 tenantName=Customer-1 signatureId=1140408011 idpAction=reject signatureMsg=Information disclosure attempt threatType=information-disclosure ipsProfileRule=Block_High sourceIPv4Address=172.30.57.19 destinationIPv4Address=10.100.253.12 sourceTransportPort=51234 destinationTransportPort=443 protocolIdentifier=6

Validate that Versa is Sending Data

To confirm Huntress is ingesting data, check SIEM > Source Management in the Huntress portal and look at the Versa SASE row's Last Activity column (it will be very recent if the source is active). New sources can take up to 24 hours to appear. Here's a starter query:

from logs | where event.provider=="Syslog-Versa"

If nothing appears, see Troubleshooting SIEM Local Syslog Collection.