sending IDS alerts to remote syslog server?

[mpfeilst]

Hello

is there any supported way to send IDS alerts (4210 running 3 and 4.1) to a remote syslog server? Either through VMS or at the sensor itself ?

thanks

Martin Pfeilsticker

[umedryk]

As far as my knowledge goes, you cannot send IDS alerts to a remote syslog server.

[5mlattimore]

We have had success sending alerts to an remote server by adding its ip address to the sensors Remote Host config on the MC

Then we imported the sensors from the console of the remote syslog server and the alarms poured in

We got much better success recording alarms than with the security monitor

Hope this is helpful

[p.hachmeister]

Exactly how did you get the sensor to generate syslog messages?

I added the syslog server to the truster hosts, but I don't see any port 514 traffic leaving the sensor (I used tcpdump.)

Are the syslog messages coming directly from the sensor or the VMS server?

Thanks