Ingesting Syslog File

[awiley-coyote]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

Enough

RAM

Enough

Storage for /

1TB

Storage for /nsm

20TB

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have a syslog that my team wants to ingest into our sec onion. All the solutions I see online are ingesting directly from the syslog server.

How would I import the file directly?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

You could do this two way, point the syslog to a sensor or Security Onion node, or use the Elastic agent and the custom log integration. https://docs.securityonion.net/en/2.4/syslog.html