Use the View and add Rsyslog servers section on the RSYSLOG tab of the Notification settings page to add and configure rsyslog servers.
.png "All_RsyslogSettings_scap.png")
Click the Settings tab.
Click Notifications on the side bar.
Click the RSYSLOG tab.
Click Add Rsyslog server. The Add new Rsyslog server dialog box opens.
Enter the name of the rsyslog server to receive the notifications (for example, NX7400) in the Server Name box.
Enter the IP address of the rsyslog server in the IP Address box.
Select the Enabled checkbox to choose which servers will receive rsyslog notifications.
Select the delivery frequency in the Delivery drop-down list box:
Default—Use the delivery frequency specified in the Default delivery box in the Rsyslog Settings area.
Per Event—Send a notification each time a malware object is detected.
Select the event type or All Events in the Notification drop-down list box to send rsyslog notifications when the specified events are detected.
Select CEF, LEEF, CSV, XML, JSON, or Text as the default format and select which level of detail (only for XML, JSON, or text) is provided in the Format drop-down list box. Select Default to use the format specified in the Default format box in the Rsyslog settings section.
Normal—This format contains detailed information and abstracts, such as alert type, ID, source IP, malware name, hostname, and alert URL without redundant information.
Concise—This format contains basic information, such as alert type, ID, source IP, malware name, hostname, and alert URL.
Extended—This format contains detailed information and abstracts, including data-theft information (if any) and static-analysis details. This format provides all details about files and objects modified during analysis.
Select the severity classification for the rsyslog notification in the Send as box:
Default—Use the value specified in the Default send as field in the Rsyslog Settings area.
Alert—Action must be taken immediately (severity 1).
Critical—Critical conditions (severity 2).
Debug—Debug-level messages (severity 7).
Emergency—Emergency: system is unusable (severity 0).
Error—Error conditions (severity 3).
Informational—Informational messages (severity 6).
Notice—Normal but significant conditions (severity 5).
Warning—Warning conditions (severity 4).
Select UDP or TCP in the Protocol drop-down list box.
Click Add new Rsyslog Server.
Click the Settings tab.
Select Notifications on the side bar.
Click the RSYSLOG tab.
Click the server in the Name column of the View and add Rsyslog Servers section.
Click the icon in the Edit column.
Update settings as needed.
Click Update Rsyslog server.
Click the Settings tab.
Select Notifications on the side bar.
Click the RSYSLOG tab.
Select the checkbox for the server.
Click Enable or Disable.
Click Yes to confirm the action.
Click the Settings tab.
Select Notifications on the side bar.
Click the RSYSLOG tab.
Select the checkbox for the server.
Click Remove.
Click Yes to confirm the action.