- Configuration of SonicWall Connector.
- Under the connector, go to Ingestion.
- Select Event Connector. Click on Configure.
- Enter the collector Id and Password.
- Select the Validate and Save.
- SonicWall Connector Requirement.
-
Machine with Static IP address allocation.
-
Install the docker engine from Get Docker.
systemctl start docker -
Collect the system IP address.
-
Opening the Port in the system for the Firewall.
-
For use in Linux and MAC
# Opening port in linux system firewall firewall-cmd --permanent --add-port=514/udp firewall-cmd --reload -
For Use in Windows, Open the Powershell command prompt.
# Opening port in Windows system firewall New-NetFirewallRule -DisplayName "Allow UDP Port 514" -Direction Inbound -Protocol UDP -LocalPort 514 -Action Allow New-NetFirewallRule -DisplayName "Allow UDP Port 514" -Direction Outbound -Protocol UDP -LocalPort 514 -Action Allow
-
-
Download the docker image tar file from given URL
https://connectors-xdr.seqrite.com/connectors/collector/download?collectorId=<created collector id>&password=<created collector password>&tid=<tenant-id> -
Load docker image
docker load --input <path to hhcollector-1.0.0.tar file> -
Start the agent using below command
docker run -p 514:514/udp --env COLLECTOR_ID=<created collector id> --env TID=<tenant id> hhcollector
- Sophos Firewall Configuration Requirement
- The event collector is up and running. Now enabling the Forwarding the events to the machine.
- Go to SonicWall Web interface, navigate to Logs & Reporting | Log Settings> Syslog > Syslog Server, Add a new syslog server, set the event collector machine IP and UDP port 514 as target for syslog log forwarding. Save the changes.
