Dell SonicWall Firewall

[dscryber (David Sciuto)]

Dell SonicWall Firewall

@eduardohki

Download from Github
View on Github
Open Issues
Stargazers

Tested with Graylog 2.1

This content pack provides extractors for SonicWall Firewalls and a few example dashboards:

• VPN Connections (24h)
• More coming soon ( help is welcome! )

Includes

• Input SonicWall (Raw/Plaintext UDP)
• Extractors (Garbage Cleanup and KVP, dst_ip, dst_port, dst_if, dst_hostname, src_ip, src_port, src_if, src_hostname, proto_type, proto_service, timestamp)
• Dashboards

Tip

The Dashboards use the “gl2_source_input” field in queries. Be sure to verify if it matches your SonicWall Input ID

Requirements

• Dell SonicWall Firewall configured to send SYSLOG to 12202/UDP, no custom settings

[wetsand24 (Kadir Rangwala)]

Is there a V3 content pack for this ? I am unable to get it working on graylog 4

[ihe]

Hi @wetsand24
I guess not. The post by @dscryber was to keep the fragments of the former marketplace somehow alive.
My recommendation would be to have a look at the json-files and build the extractors on your own.

[faen]

I am using Graylog 5 to capture and report on logs from a Sonicwall. The Sonicwall took some tweaking to get it to send the data over Syslog, but once I did get the data flowing, I used pipelines to process the data rather than extractors, because there’s a lot of variability in the messages. Since I was using pipelines, it was easy enough to add processing rules for splitting fields, GeoIP resolution, and whois. Happy to share my pipeline rules if you like.

PS: I was using extractors on Graylog 4 with the Sonicwall, but I had almost 20 and still wasn’t catching all of the different types of messages. IMO, Pipelines are WAY better for Sonicwall.

[dscryber (David Sciuto)]

Thanks, @faen, for your post. It’s always great to see community members sharing peer-to-peer experiences, successes, and “Aha moments!” with others.

Speaking for the community (as I’ll do in this instance because pipelines are ALWAYS of interest here), I invite you to post your rules in our pipeline rules forum. Alternatively, feel free to post a blog article or even a visual presentation. All three of these suggestions are welcome here!

Thanks again!

[faen]

OK, I posted all of my rules - hope it helps someone!

[lijogrg444]

Hi faen,where can i see this please.

[faen]

Sonicwall Pipeline Rules

Really looks like this part is just skipped rule "Sonicwall Split IP Port Interface for src" when has_field("src") then set_fields( fields: grok( pattern:"%{IPV4:SrcIP}:%{INT:SrcPort}:%{GREEDYDATA:SrcInterface}", value: to_string($message.src) ) ); end [image] Does this look right? Should I separate Dst From Src maybe? EDIT: Yep I split and it seems to work @faen Are you using GL5? I’m trying …

[cyr0nk0r]

where did you post these rules?

[faen]

It’s in the pipeline and rules exchange - it was linked to in one of my previous posts, but here it is again:

Sonicwall Pipeline Rules

Sonicwall: TZ470 running SonicOS 7.01 Input type: Sylog/UDP Rule summary: Stage 0: Primary rule uses the “key_value” function to parse the delimited message using the default delimiter of space. Stage 1: Four rules to split the port from the IP address, as Sonicwall sends as XXX.XXX.XXX.XXX:YYYY and sometimes as XXX.XXX.XXX.XXX:YYYY:INTERFACENAME State 2: GeoIP Lookups on Source and Destination, as well as removing some of the redundant fields caused by Stage 1 rules. Stage 3: Whois Lookup…

[xxlt3xx]

I doubt any of this will work with graylog 6+…hopefully I don’t have to just ditch graylog

[Chief_Slac]

I am running GL open 6.x and set up a bunch of extractors to work with my Sonicwalls. Seems to do okay; GeoIP works too. You just have to pay attention to the order they’re applied.