Vectra Cognito

Vectra Cognito NDR can be configured to send notification events via syslog to Logmanager.

To configure Vectra Cognito external logging:

Go to Settings > Notifications > Syslog > Edit
Input Logmanager IP address or hostname.
Input Logmanager destination port.
Select protocol TCP. You can also select UDP but it is not recommended. If you wish to use SSL encryption, select it and input 6514 destination port.
Select format CEF. Other formats will not work.
Select log types you wish to forward to Logmanager. Parser was tested for all available log types.
Select additional conditions you are interested in. Parser was tested for all available conditions.
Set Include enhanced details to ON.

Vectra syslog settings