The Syslog settings page lets you configure integration with a SIEM tool that leverages the syslog protocol to record system events.

Security Information and Event Management (SIEM) technology gathers information about security alerts generated by network hardware and software components. It centralizes this data and generates reports to help you monitor activity, perform log audits, and respond to incidents. Workspace ONE UEM integrates with your SIEM tools by sending event logs using Syslog.

For more information about syslog integration, see Syslog Integration Overview.

General Tab

  • Current Setting – Select whether to Inherit or Override the displayed settings. Inherit means use the settings of the current organization group's parent OG, while Override enables the settings for editing so you can modify the current OG's settings directly.
Setting Description
Syslog Integration Enable or disable syslog integration.
Host Name Enter the URL for the SIEM tool in the Host Name text box.
Protocol Select the required protocol from available options to send the data . It is to be noted that support for TLS v1.1 is provided.
Port Enter the port number to communicate with the SIEM tool in the Port text box.
Syslog Facility

Select the facility level for the feature from the Syslog Facility menu. The syslog protocol defines the syslog facility.

The widespread use and manipulation of the syslog protocol can clutter the meaning of the syslog facility. However, it can roughly suggest from what part of a system a message originated and it can help distinguish different classes of messages. Some administrators use the syslog facility in rules to route parts of messages to different log files.

Message Tag Enter a descriptive tag to identify events from the Workspace ONE UEM console in the Message Tag text box. For example, "AirWatch".
Message Content

Enter the data to include in the transmission in the Message Content text box. This is how the message data gets formatted when sent using syslog to your SIEM tool. Use lookup values to set the content. For secure TCP, New line (CRLF) formatting using Enter, \n, \r does not work and gets automatically converted to tab, \t for secure TCP.

  • Child Permission – Select the available behavior of child organization groups that exist below the currently selected organization group. Inherit only means child OGs are only allowed to inherit these settings. Override only means they override the settings, and Inherit or Override means you can choose to inherit or override settings in child OGs that exist below the currently selected OG.

Advanced Tab

Setting Description
Console Events Select whether to enable or disable the reporting of Console events.
Select Console Events to Send to Syslog

Visible if you enable Console Events. For each sub-heading, select the specific events that you want to trigger a message to syslog.

Use Select All or Clear All to select or unselect all the events all at once. To select or unselect specific events, enable or disable the checkboxes.

Note:

On enabling the Console Events, by default, all events under all categories of console events are selected.

Device Events Select whether to enable or disable the reporting of Device events.
Select Device Events to Send to Syslog

Visible if you enable Device Events. For each sub-heading, select the specific events that you want to trigger a message to syslog.

Use Select All or Clear All to select or unselect all the events all at once. To select or unselect specific events, enable or disable the checkboxes.

Note:

On enabling the Device Events, by default, all events under all categories of device events are selected.

  • Test Connection – Use the Test Connection button to ensure successful communication between the Workspace ONE UEM console and the SIEM tool.