XMA: Sending Syslog messages from XMA to 2 SIEM with a single filter define

XMA: Sending Syslog messages from XMA to 2 SIEM with a single filter define

To send Syslog messages to 2 SIEM, it's required to have two ACTION having each one set with one of the SIEM IP Address.


ACTIONCOLL_BEGIN
    ACTION_BEGIN
       ACTIONTYPE IPALERT  ! SYSLOGQ
       ....
       IPALERT_ADDRESS <IP Address-A>
       ....
     ACTION_END
     ACTION_BEGIN
        ACTIONTYPE IPALERT  ! SYSLOGQ
        ....
        IPALERT_ADDRESS <IP Address-B>
         ....
     ACTION_END
ACTIONCOLL_END

If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.

    • Related Articles

    • XMA: Data selection criteria to avoid sending $0 messages to a target SIEM

      The FILTER Data selection criteria for the ACTIONTYPE SYSLOGQ filter definition to avoid sending EMS messages from the collector $0 to the target SIEM are as follows: MOVER_BEGIN MOVER_SELECT_BEGIN PRODUCT = EMS MOVER_SELECT_END MOVER_END DATA_BEGIN ...

    • XMA: Send XMA messages to SIEM via HPE SSL proxy

      Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

    • XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

      If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...

    • Is there an RFC standard format for XMA syslog messages?

      XYGATEMA does not follow a RFC standard format for delivering syslog messages. XMA builds the messages based on the ALERTSTRING configuration for each filter that is added to the FILTERS. The FILTERS file is located in the XYGATEMA installation ...

    • XMA: SLSENDER Error unable to send messages to host.

      The SYSLOGQ database table in the XMADAT subvolume has 2 columns that can be used to determine if messages are being sent to the SIEM. ENTRYGMT is the timestamp when the message was inserted into the queue by a mover. ALERTEDGMT is the timestamp when ...