IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Snyk module Sophos module »
Elastic Docs ›Filebeat Reference [8.5] ›Modules

Sonicwall module

edit

Sonicwall module

edit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Prefer to use Elastic Agent for this use case?

Refer to the Elastic Integrations documentation.

Learn more

Elastic Agent is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security threats, query data from operating systems, forward data from remote services or hardware, and more. Refer to the documentation for a detailed comparison of Beats and Elastic Agent.

This is a module for receiving Sonicwall-FW logs over Syslog or a file.

Read the quick start to learn how to configure and run modules.

Configure the module

edit

You can further refine the behavior of the sonicwall module by specifying variable settings in the modules.d/sonicwall.yml file, or overriding settings at the command line.

You must enable at least one fileset in the module. Filesets are disabled by default.

Variable settings

edit

Each fileset has separate variable settings for configuring the behavior of the module. If you don’t specify variable settings, the sonicwall module uses the defaults.

For advanced use cases, you can also override input settings. See Override input settings.

When you specify a setting at the command line, remember to prefix the setting with the module name, for example, sonicwall.firewall.var.paths instead of firewall.var.paths.

firewall fileset settings

edit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

This was converted from RSA NetWitness log parser XML "sonicwall" device revision 124.

var.input
The input from which messages are read. One of file, tcp or udp. Defaults to udp.
var.syslog_host
The address to listen to UDP or TCP based syslog traffic. Defaults to localhost. Set to 0.0.0.0 to bind to all available interfaces.
var.syslog_port
The port to listen for syslog traffic. Defaults to 9519

Ports below 1024 require Filebeat to run as root.

var.tz_offset
By default, datetimes in the logs will be interpreted as relative to the timezone configured in the host where Filebeat is running. If ingesting logs from a host on a different timezone, use this field to set the timezone offset so that datetimes are correctly parsed. Valid values are in the form ±HH:mm, for example, -07:00 for UTC-7.
var.rsa_fields
Flag to control the addition of non-ECS fields to the event. Defaults to true, which causes both ECS and custom fields under rsa to be added.
var.keep_raw_fields
Flag to control the addition of the raw parser fields to the event. This fields will be found under rsa.raw. The default is false.

Fields

edit

For a description of each field in the module, see the exported fields section.

« Snyk module Sophos module »