Tested with Stormshield 4.0.3 and Graylog 5.1.4. Should work with all Stormshield 4.X version.
The Content Pack should be compatible with all Graylog 5.X version.
Note this was built without extractors, only pipeline rules.
- Input (Syslog/UDP/1514)
- Stream (Firewall)
- Pipeline Rule w/ 1 stage (Extract key/values pipeline function)
- Dashboard (24h) (Stats Firewall)
- Graylog 5.0
- Stormshield Firewall w/ Syslog 1514/UDP Ports
- Open port 1514 for UDP on the graylog host and/or docker compose file
- Edit content-pack.json and find the strings:
firewall.lab.lanand rename it according to your firewall hostname.
Europe/Parisand rename it according to your server Timezone