This article explains about the configuration needs to be done in SRX to forward the logs to Security director insights.

SRX device configuration to forward the logs to Security director insights.

Configure the below in SRX:

SYSLOG EVENTS

set system syslog host x.x.x.x any any

set system syslog host x.x.x.x port 514

set system syslog host x.x.x.x structured-data

set system syslog time-format millisecond

set system syslog source-address y.y.y.y

TRAFFIC LOGS

set security log mode stream

set security log format sd-syslog

set security log source-address y.y.y.y

set security log stream securitylog category all

set security log stream securitylog host x.x.x.x

set security log stream securitylog host port 514

x.x.x.x - IP address of the Log-collector

y.y.y.y - IP address of SRX Device source interface

Once the above has been configured you will be able to forward the logs to Security director insights.

2024-04-17 : Article Created

2024-11-26: Change visibility