Firewall and network logs (syslog)

Firewalls and other network devices (Sophos Firewall, pfSense, FortiGate and others) can send their logs to the Theseus server by syslog. The detection rules read the devices they know, and the logs become alerts like any other source.

Set up

1. In the console, open Admin → Integrations → Firewall and network logs (syslog).
2. In Devices that send logs, list the IPv4 addresses or networks (CIDR) of the devices, comma-separated. Listing every address (0.0.0.0/0) is refused: name the devices.
3. Choose Save. The change is applied within a minute.
4. On each device, set this server as the syslog server, on UDP port 514. On a two-server install, that is the core server (the address agents use).

Only the listed devices are accepted. Port 514/udp is published on the server only while this integration is set up; Disconnect closes it again.

Network

Allow UDP 514 from the devices to the server in any firewall between them. See Network and firewall and Ports.

Syslog over UDP is not encrypted. Keep it on networks you trust, or between the device and the server over a VPN.