ManageEngine
ManageEngine's endpoint and IT operations products (patch management, endpoint central, and the service desk among them) emit their audit trails as syslog. That trail records administrative actions on managed endpoints: software pushed, patches applied, configurations changed, remote sessions opened. Because those are the same actions an attacker with management-console access would take, the feed is worth collecting even where the products are purely operational.
ManageEngine-side Setup
Enable syslog forwarding in the product's own configuration and point it at the listener described below. Note that the ManageEngine suite does not share one logging configuration: patch management, Endpoint Central and the service desk are each configured separately, so repeat this for every product you want collected. Follow ManageEngine's documentation for the product in question.
Syslog Configuration
The server sends to a syslog listener: either the cloud syslog endpoint or a local collector appliance. The two destinations use different ports. The cloud endpoint has a per-tenant domain and a block of ports allocated to your account: Syslog Ports, under Configuration → Syslog Ports (v1: Platform → Administration → Syslog Ports), shows the domain, the port range, and which protocol listens on which port; read the numbers off that page rather than assuming a standard one. A collector appliance listens on UDP/514 and TCP/514 by default; a TLS listener (usually 6514 for TLS, 7514 for TLS RFC 6587) is one you add on its Syslog Ports tab and open in the collector's firewall, and each of its listeners can carry a Customer Tag that attributes the records arriving on it. See Syslog Import for the protocol options and Syslog Ports for the listener configuration.
Install the Application
- v2 interface
- Classic v1 interface
In the navigation rail, open Applications and click Install Application, then choose Manage Engine from the Endpoint Management category of the Application Catalog.
Go to Platform → Applications → Install Application From Template and choose Manage Engine from the Endpoint Management category.
Despite the category, this is a syslog integration: the template supplies the parser, and the transport is configured on the listener rather than in the form. Both parameters are required:
| Parameter | Notes |
|---|---|
| datalake | Pre-filled managed. |
| datalake index name | Pre-filled ManageEngine. |
- v2 interface
- Classic v1 interface
The form has no Configuration section; both parameters sit in the collapsed Advanced configuration section: click its heading to reach them.
Click Install Application. The Applications page opens with the notice Default is launching., and the new application is listed with a green Running badge once the pipeline is up.
Press Install. The application then appears in the Installed Applications view, where its badge reads Running once the pipeline is up.
Validating the Data
Perform an action that produces a known audit entry (pushing a patch or opening a remote session) and search for it in the ManageEngine index. Confirm the server hostname and timestamp are correct.
Related
- Endpoint Management: other endpoint products.
- Syslog Import and Syslog Ports: the transport and listener.
- Time Adjustment: for device timestamps sent in local time.