✖

- Related Products
- ADManager Plus

  Active Directory Management & Reporting

  Download | Demo
- ADAudit Plus

  Real-time Active Directory Auditing and UBA

  Download | Demo
- EventLog Analyzer

  Real-time Log Analysis & Reporting

  Download | Demo
- Exchange Reporter Plus

  Exchange Server Auditing & Reporting

  Download | Demo
- AD360

  Integrated Identity & Access Management

  Download | Demo
- Log360

  Comprehensive SIEM and UEBA

  Download | Demo

# SIEM Integration

'SIEM Integration' option allows you to forward data from ADSelfServicePlus to an external SIEM product or to a Syslog Server in real time.

Forwarding ADSelfService Plus data to a Syslog Server

Syslog is the event logging service in unix systems.You may also use this setting to forward to your SIEM's UDP or TCP Receiver.

#### Configuring a Syslog Server:

- Syslog daemon runs by default in udp, port 514.
- The default settings can be modified in its configuration file /etc/syslog.conf . Remember to restart Syslog daemon for the changes to take effect.

###### Steps to enable Syslog Logging in ADSelfServicePlus:

1. Click on 'Admin' Tab → 'Product Settings' → 'Integration Settings'
2. Click the 'Syslog' Tile.
3. Enter the Syslog server name. Ensure that the Syslog server is reachable from the ADSelfServicePlus server.
4. Enter Syslog port number and protocol.
5. Choose Syslog standard and data format as required by your SIEM Parser.
6. Click on Save

Forwarding ADSelfService Plus data to an external SIEM product : Splunk HTTP

###### Configuring Splunk Http Event Collector:

- Click on 'Settings' → 'Data Inputs' → 'Http Event Collector'.
- Click 'New Token'. Provide a name for the token(Preferably ADSelfServicePlus) and leave the rest to the default values(Customize if required).
- After saving the configuration, an auth token will be generated. This token needs to be provided in ADSelfServicePlus configuration.
- Under 'Global Settings' in the 'Http Event Collector' page, Enable 'All tokens'.
- You can also customize 'Http port number' and 'SSL' settings as required in the 'Global Settings'.

###### Steps to enable Splunk Logging in ADSelfServicePlus:

1. Click on 'Admin' Tab → 'Product Settings' → 'Integration Settings'
2. Click the 'Splunk' Tile.
3. Enter the Splunk Server name. Ensure that the Splunk Server is reachable from the ADSelfServicePlus Server.
4. Enter Splunk Http Event Collector port number and protocol.
5. Specify the Http Event Collector token generated in Splunk for ADSelfServicePlus.
6. Click on Save.

To search for ADSelfServicePlus Data in your SIEM product

The forwarded ADSelfService Plus events can be searched, grouped into reports and categorized as needed in your SIEM product.

- Events from ADSelfServicePlus can be easily separated by the 'SOURCE' field.
- Each log event will have a 'Category' field. The possible values for this field are defined under 'Choose categories to forward' menu in the configuration page.
- Timestamp of each event will be available in the 'TIME_GENERATED' field.
- Other fields pertaining to events may vary depending on the event category. So one regex can be maintained for each of the required categories in your SIEM product.

## Thanks!

Your request has been submitted to the ADSelfService Plus technical support team. Our technical support people will assist you at the earliest.

#### Need technical assistance?

- Enter your email ID
- Talk to experts

- By clicking 'Talk to experts', you agree to processing of personal data according to the Privacy Policy.

Copyright © 2021, ZOHO Corp. All Rights Reserved.