Configuring CEF logging for endpoint events

Use the CLI commands in this topic to configure logging for CEF-formatted log messages for endpoint events. These CEF log messages can be sent from the Endpoint Security (HX) appliance to your Helix environment or Security Information and Event Management (SIEM) solution.

To forward logs to Helix, create a destination for the Cloud Collector or Communications Broker (Comm Broker). The Cloud Collector or Comm Broker will aggregate and forward Endpoint Security (HX) CEF logs to Helix.

To integrate with a SIEM solution, create a destination for the remote syslog server.

Descriptions of the collected CEF log data can be found in "CEF Logs and Output" in the Endpoint Security (HX) Server User Guide.

Prerequisites

Admin or fe_services access
To forward CEF logs to Helix, a Trellix Cloud Collector or Comm Broker must be installed. See the Cloud Collector Installation Guide or the Unmanaged Communications Broker Installation Guide for details.

Viewing the current logging configuration

To view the current logging configuration:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

View the configuration:

hostname # show logging

Here is sample output from this command:

Local logging level: notice (OVERRIDES DISABLED)
Override for class cef: none
Remote syslog default level: notice
No remote syslog servers configured.
Receive remote messages via UDP: no
Receive remote messages via TCP: no
Receive remote messages via TLS: no
Log file rotation:
Log rotation size threshold: 256 megabytes
Archived log files to keep: 40
Log format:
Subsecond timestamp field: disabled
Secure channel logs: yes

In this example, CEF logging is actually disabled because the Override for class cef setting is not set to info. All CEF logging occurs for messages logged at the info system log level. If this level is set to anything other than info, CEF logging will not occur. See Enabling local CEF logging.

Adding a destination

Define a Cloud Collector or Comm Broker destination to forward CEF log messages to Helix. Define a remote syslog server destination to integrate Endpoint Security (HX) with your SIEM solution.

To add a destination:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Add the destination:
```
hostname # logging <IP-address> trap none
```
```
hostname # logging <IP-address> trap override class cef priority info
```
where <IP-address> is the IP address of the Cloud Collector or the remote syslog server destination.
Save your settings:
```
hostname # write mem
```

Removing a destination

To remove a destination:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Remove a remote syslog server destination:
```
hostname # no logging <IP-address>
```
where <IP-address> is the IP address of the Cloud Collector or the remote syslog server destination.
Save your settings:
```
hostname # write mem
```

Using TCP for remote logging

To use TCP for remote logging instead of UDP:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Request TCP instead of UDP for a remote logging target:
```
hostname # logging <remote-IP-address> protocol tcp
```
Save your settings:
```
hostname # write mem
```

Configuring the port for a remote logging target

To change the port for a remote logging target from port 514:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Change the port number:

hostname # logging <remote-IP-address> port <new-port-number>

Save your settings:
```
hostname # write mem
```

Enabling local CEF logging

To enable local CEF logging:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Enable CEF logging:
```
hostname # logging local override class cef priority info
```
All CEF logging occurs for messages logged at the info system log level. If you set this to any other system log level, CEF logging will not occur.
Save your settings:
```
hostname # write mem
```

Disabling local CEF logging

To disable local CEF logging:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Disable CEF logging:

hostname # logging local override class cef priority none

Save your settings:
```
hostname # write mem
```