Adding external syslog output

[lsisic]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

88

RAM

512GB

Storage for /

223GB

Storage for /nsm

15TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I want to send Suricata alerts to an external syslog server. According to the instructions from the documentation, I have set up the following file: /opt/so/saltstack/local/salt/logstash/pipelines/config/custom/output_to_external_syslog.conf. Also, through the Web UI, I added "custom/output_to_external_syslog.conf" to logstash/defined_pipelines/manager through the configuration menu. You can see the file below. Is it necessary to change the port from 514 to another since the Elastic-agent uses port 514, and will the syslog output work with this change, or do I need to configure something additionally? Note that in version 2.3.280, this worked and sent to syslog without any problems.

filter {
if [module] =~ "suricata" {
clone {
id => "clone_suricata__sev_events"
clones => ["suricata-sev-clone"]
add_tag => [ "clone" ]
}
}
}
output {
if "clone" in [tags] {
syslog {
id => "output-to-ext-syslog"
host => "x.x.x.x"
port => 514
}
}
}

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

You have to adjust your filter in 2.4 from what you had in 2.3.

Change:

filter {
if [module] =~ "suricata" {

To:

filter {
if [event][module] =~ "suricata" {

If you aren't modifying the event, you don't really need to use a clone filter plugin, you could just use the custom output like https://docs.securityonion.net/en/2.4/logstash.html#forwarding-events-to-an-external-destination