Stormshield Firewall

the NEW Marketplace Content Pack
1

Download from Github
View on GitHub
Open Issue

Stormshield Firewall Content Pack

Tested with Stormshield 4.0.3 and Graylog 5.1.4. Should work with all Stormshield 4.X version.

The Content Pack should be compatible with all Graylog 5.X version.

Note this was built without extractors, only pipeline rules.

Includes

  • Input (Syslog/UDP/1514)
  • Stream (Firewall)
  • Pipeline Rule w/ 1 stage (Extract key/values pipeline function)
  • Dashboard (24h) (Stats Firewall)

Requirements

  • Graylog 5.0
  • Stormshield Firewall w/ Syslog 1514/UDP Ports
  • Open port 1514 for UDP on the graylog host and/or docker compose file
  • Edit content-pack.json and find the strings:
    • firewall.lab.lan and rename it according to your firewall hostname.
    • Europe/Paris and rename it according to your server Timezone