commbroker input

Adds the input module or deletes the input module from the Communications Broker Sender (Comm Broker) configuration.

You can configure the Comm Broker module to send and receive third-party syslog and JSON formatted logs to the Threat Analysis Platform (TAP) for analysis.

For Helix to analyze both syslog and JSON data at the same time, you must configure the Comm Broker to send and receive third-party logs using a different port, interface or protocol.

For details about how to configure the Comm Broker input module, see the "Configuring the Communications Broker Sender Input Module" section of the Network Security User Guide.

Syntax

[no] commbroker input {syslog | json} interface {ether1 | ether2} proto {tcp | udp | ssl} port <port number>

Parameters

no

Use the no form of this command to remove the input module Comm Broker module configuration.

syslog | JSON

Specifies the input format type for the Comm Broker module.

ether1 | ether2

Specifies the management interface to receive incoming events sent over TCP, UDP, or SSL.

TCP |UDP |SSL

Specifies the type of protocol to receive the incoming syslog or JSON events.

port <portnumber>

Specifies the port number that is used by Comm Broker to receive third-party syslog and JSON events. Valid values are integers ranging from 514 to 65535.

Example

The following example sets the Comm Broker to send and receive syslog events over TCP to the ether1 interface on port 514.

hostname (config) # commbroker input syslog interface ether1 proto tcp port 514
Enabling commbroker

The following example disables the Comm Broker module.

hostname (config) # no commbroker input
Disabling commbroker

User role

Admin or operator

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later: