On-Prem Firewall Syslogs from Log Forwarder VM into Sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-1678902%22%20slang%3D%22en-US%22%3EOn-Prem%20Firewall%20Syslogs%20from%20Log%20Forwarder%20VM%20into%20Sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1678902%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20followed%20all%20the%20documentation%20for%20building%20the%20log%20forwarder%20VM%20(Ubunutu)%20and%20configuring%20the%20Syslog%20Data%20Collector.%26nbsp%3B%20Syslog%20events%20from%20the%20actual%20VM%20are%20making%20it%20into%20Sentinel%20no%20problem%2C%20however%20the%20Syslog%20events%20we%20have%20sent%20from%20an%20on-premises%20firewall%20(Protectli)%20to%20the%20Log%20Forwarder%20VM%20are%20not%20making%20it%20into%20Sentinel.%26nbsp%3B%20Below%20is%20a%20screenshot%20showing%20the%20logs%20in%20question.%26nbsp%3B%20The%20logs%20in%20question%20are%20coming%20into%20the%20VM%20on%20TCP%20Port%20514.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20ideas%20what%20I%20need%20to%20do%20here%20or%20what%20I%20can%20try%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22vhusker1507_0-1600352374751.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F219164iEC860C0ACE977F2E%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22vhusker1507_0-1600352374751.png%22%20alt%3D%22vhusker1507_0-1600352374751.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1678902%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ELinux%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESentinel%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esyslog%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esyslog%20server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Regular Visitor

I have followed all the documentation for building the log forwarder VM (Ubunutu) and configuring the Syslog Data Collector.  Syslog events from the actual VM are making it into Sentinel no problem, however the Syslog events we have sent from an on-premises firewall (Protectli) to the Log Forwarder VM are not making it into Sentinel.  Below is a screenshot showing the logs in question.  The logs in question are coming into the VM on TCP Port 514.

 

Any ideas what I need to do here or what I can try?

 

vhusker1507_0-1600352374751.png

 

 

0 Replies