Send Audit Logs to a Syslog Server

Devo SOAR can send Syslog files directly to your log management system, such as Splunk or Sumo Logic, as they become available on an ongoing basis.

To Edit or to activate Start Sending Syslog files to your log management system:

1. Navigate to Settings > Account on left navigation and select Syslog tab.

2. Click on Edit to change the default settings.

3. Enter the Destination IP Address or Hostname and the Destination Syslog Port of the remote management system.

4. Select the Syslog Message Format: RFC5424 or BSD.

5. To encrypt the log content over the network, select the radio button as Yes for Transport Security (TLS).

6. Paste the SSL Certification provided by the remote server into the text box that’s provided.

7. Click Save.

When you save and start sending, a test message is sent to the remote Syslog server to validate the configuration of the Syslog server. If the validation is successful, a message is displayed on the screen.