...
...
...
...
...
...
...
...
...
...
| Table of Contents | ||||
|---|---|---|---|---|
|
Introduction
The tags beginning with uba.varonis identify events generated by Varonis Data Security Platform belonging to Varonis
...
.
You need to configure the Varonis rules to generate syslog messages-type alert method, create an alert template for sending to Devo, and set up syslog message forwarding to the Devo Relay. The messages should be sent to a dedicated port (of your choice) on the relay to be tagged and forwarded securely to the Devo Cloud.
...
Valid tags and data tables
The full tag must have
...
3 levels. The first two are fixed as uba.varonis
...
Technology
...
Brand
...
Type
...
uba
...
varonis
...
dataalert
alerts
audit
Therefore, the valid tags include:
...
and the third identifies the type of events sent.
Product / Service | Tags | Data tables |
|---|---|---|
Varonis Data Security Platform |
|
|
|
These are the valid tags and corresponding data tables that will receive the parsers' data:
...
Tag
...
Data table
|
...
| |
|
|
...
uba.varonis.alerts
...
uba.varonis.audit
...
uba.varonis.audit
...
...
...
| Anchor | ||
|---|---|---|
|
...
|
...
|
uba.varonis.
...
alerts
Field | Type | Source field name | Extra |
|---|
...
fields | |
|---|---|
eventdate |
|
...
| |
host |
|
...
vhost |
...
hostchain |
|
|
...
✓ |
...
cefVersion |
|
...
|
...
embDeviceVendor |
|
...
|
...
embDeviceProduct |
|
...
|
...
deviceVersion |
|
...
|
...
signatureID |
|
...
|
...
name |
|
...
|
...
severity |
|
...
|
...
_cefVer |
...
|
...
|
...
act |
|
...
|
...
cat |
|
...
-
...
| |||
ruleID |
|
| |
mailRecipient |
|
...
|
...
ruleName |
|
...
|
...
attachmentName |
|
...
|
...
clientAccessType |
|
...
|
...
mailboxAccessType |
|
...
|
...
changedPermissions |
|
...
|
...
uba.varonis.alerts
...
Field
...
Type
...
Extra Label
...
eventdate
...
timestamp
...
-
...
host
...
str
...
-
...
hostchain
...
str
...
✓
...
cefVersion
...
str
...
-
...
embDeviceVendor
...
str
...
-
...
embDeviceProduct
...
str
...
-
...
deviceVersion
...
str
...
-
...
signatureID
...
str
...
-
...
name
...
str
...
-
...
severity
...
str
...
-
...
_cefVer
...
str
...
-
...
act
...
str
...
-
...
cat
...
str
...
-
...
ruleID
...
int8
...
-
...
mailRecipient
...
str
...
-
...
ruleName
...
str
...
-
...
attachmentName
...
str
...
-
...
clientAccessType
...
str
...
-
...
mailboxAccessType
...
str
...
-
...
changedPermissions
...
str
...
-
...
cnt
...
int4
...
-
...
deviceCustomDate1Label
...
str
...
-
...
deviceCustomDate1
...
timestamp
...
-
...
dhost
...
str
...
-
...
dpriv
...
str
...
-
...
duser
...
str
...
-
...
dvchost
...
str
...
-
...
end
...
timestamp
...
-
...
filePath
...
str
...
-
...
filePermission
...
str
...
-
...
fileType
...
str
...
-
...
fname
...
str
...
-
...
msg
...
str
...
-
...
oldFilePermission
...
str
...
-
...
outcome
...
str
...
-
...
rt
...
timestamp
...
-
...
start
...
timestamp
...
-
...
rawMessage
...
str
cnt |
|
| |
deviceCustomDate1Label |
|
| |
deviceCustomDate1 |
|
| |
dhost |
|
| |
dpriv |
|
| |
duser |
|
| |
dvchost |
|
| |
end |
|
| |
filePath |
|
| |
filePermission |
|
| |
fileType |
|
| |
fname |
|
| |
msg |
|
| |
oldFilePermission |
|
| |
outcome |
|
| |
rt |
|
| |
start |
|
| |
rawMessage |
| rawSource | ✓ |
| Anchor | ||||
|---|---|---|---|---|
|
uba.varonis.audit
Field | Type | Source field name | Extra fields |
|---|---|---|---|
eventdate |
|
| |
host |
| vhost | |
rawMessage |
| rawSource | ✓ |
RuleID |
|
| |
RuleName |
|
| |
AlertTime |
|
| |
EventTime |
|
| |
ActingObject |
|
| |
EventType |
|
| |
FileServerDomain |
|
| |
Path |
|
| |
AffectedObject |
|
| |
IPAddressHost |
|
| |
AdditionalData |
|
| |
Severity |
|
| |
Threshold |
|
| |
FirstEventTime |
|
| |
EventStatus |
|
| |
ActingObjectSAMAccountName |
|
| |
hostchain |
|
| ✓ |
tag |
|
| ✓ |
| Anchor | ||
|---|---|---|
|
...
|
...
|
uba.varonis.
...
dataalert
Field | Type | Source field name | Extra |
|---|
...
fields | |
|---|---|
eventdate |
|
...
| |
host |
|
...
-
...
rawMessage
...
str
...
✓
...
RuleID
...
str
...
-
vhost | |
RuleName |
|
...
| |
AlertTime |
|
...
| |
EventTime |
|
...
| |
ActingObject |
|
...
| |
EventType |
|
...
| |
FileServerDomain |
|
...
| |
Path |
|
...
| |
AffectedObject |
|
...
| |
IPAddressHost |
...
|
...
| |
AdditionalData |
|
...
|
...
AlertDescription |
|
...
|
...
ChangedPermissions |
|
...
|
...
PermissionsBeforeChange |
|
...
|
...
PermissionsAfterChange |
|
...
|
...
rawMessage |
|
...
| |||
hostchain |
|
| ✓ |
tag |
|
| ✓ |
How is the data sent to Devo?
Varonis configuration
To set up message forwarding, you will need to take the following steps in the DatAlert area of the DatAdvantage management tool:
Set up Syslog Message Forwarding to your Devo Relay in the DatAlert Configuration settings. You'll need to specify the relay's IP address and the relay port to which you want to send DatAlert messages.
Create a new alert template to apply to syslog message-type alert methods.
Edit the DatAlert rules to generate syslog messages. This means that the messages will get forwarded to the Devo Relay.
Configure Syslog message forwarding
In DatAdvantage, select Tools → DatAlert. DatAlert is displayed.
Select Configuration in the left menu.
In Syslog Message Forwarding, enter the following information:
Syslog server IP address - The IP address of the Devo relay.
Port - The port on which the Devo relay will be listening according to the rule defined in the previous step.
...
Define a new template
Templates define the format of the alert messages sent from DatAlert, using Syslog, to Devo.
In DatAlert, click Alert Templates in the left menu.
...
Click the green plus sign to add a new alert template:
Enter a template name.
Open the Apply to alert methods dropdown list and select Syslog message.
Select the parameters that you want to monitor.
...
Configure the rules to send the alerts to Devo
To send the events triggered by the rules to Devo, the alert must be transferred by creating a Syslog message. Go to the DatAlert rules table and:
Select the rule or rules and then click Edit Rule.
Click Alert Method.
Check the option Syslog message.
...
Devo Relay rules
The rule should simply apply the uba.varonis.dataalert or uba.varonis.alerts tag to all events received on the selected port. Syslog tags contained in the messages received should also be ignored.
Rule 1 - datAlert events
Source Port → 13076
Target Tag → uba.varonis.dataalert
Select both Stop Processing and Sent without syslog tag
Rule 2 - datAdvantage events
Source Port → 13076
Target Tag → uba.varonis.alerts
Select both Stop Processing and Sent without syslog tag