Page Comparison

...

Valid tags and data tables

The full tag must have 3 levels. The first two are fixed as waf.signalsciences. The third level identifies the type of events sent. 

...

How is the data sent to Devo?

Use the info in the How is the data sent to Devo? section of the internal doc to fill this section with the required method

Event source → Relay → Devo

Logs generated by company must be sent to the Devo platform via the Devo Relay to secure communication. See the required relay rules below:

Add all the rules following the format of the example below:

Relay rule 1 - Versa NGFW Access

• Source Port → 13030

• Source Data → (.*)accessLog, applianceName=(.*)

• Target Tag → network.versa.ngfw.access

• Select the Stop Processing and Sent without syslog tag checkboxes

Image Removed

Relay rule 2 - name

...

Event source → Collector → Devo

If there's documentation for the collector:

To send logs to these tables, Devo provides a collector that you can download and use to send the required events to your Devo domain. You can download the collector and learn how to use it in Collector article. 

Use this if the collector is not documented:

Logs generated by ... Logs generated by Signal Sciences Web Application Firewall are forwarded to Devo using a dedicated proprietary Apache nifi collector. Contact us if you need to forward these events to your Devo domain so we can guide you through the process. 

Event source → Devo (Syslog, HTTP...):

You can forward logs generated by Company using any Syslog drain (for example, Syslog-ng). Learn more about how to send Company logs and their structure here.

Log samples

The following are sample logs sent to each of the waf.signalsciences data tables. Also, find how the information will be parsed in your data table under each sample log.