...
Early indicators of attack, such as abnormal DNS scans or failed login attempts.
The presence of known threat signatures
Behavioral anomalies associated with zero-day attacks, such as atypical communication between assets
Engineering operations associated with advanced persistent threat (APT) activity, such as unexpected process value changes
Any activity or indicator that meets your custom-defined criteria
Device Information
Entity | Particulars |
|---|---|
Vendor Name | Claroty |
Product Name | Continuous Threat Detection (CTD) |
Type of Device | Hosted |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
Claroty Continuous Threat Detection | CLAROTY_CTD | Syslog - CEF | CyberHub |
Port Requirements
Source | Destination | Port |
|---|---|---|
Claroty Continuous Threat Detection | CyberHub | 6514 (TCP) |
To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.
...
To configure Syslog from Claroty CTD Server
Log in to CTD Server (need user with admin access)credentials.
Navigate to Settings - > Integrations - > SIEM Syslog
...
Uncheck In ADD NEW SYSLOG, uncheck Local as we are sending logs to another target.
Below points are mapped exactly as per the reference screenshot:
From (Site) – Select one or multiple sites (i.e. CTD Servers)
...
.
Vendor Name - Other
Message Contents – Select which level to log - Alerts, Baselines, Events, or Health Monitoring. Default is Alerts.
Category - Make category selected as ALL.
Message Format – Select CEF
Server – CyberHub IP Address
Port – 6514
Protocol –
...
TLS
When TLS is chosen, the Syslog message will be sent as an encrypted TCP message with CEF format, with an option to add server authentication by uploading a server certificate.
System URL – Automatically shows the source URL; this field is not editable
Save –
...
Click to commit your entries
...
Selecting In Message Content as Alertsthen below screen appears. Select Category as , select Alerts and in Category, select All.
...
Selecting In Message Content as Eventsthen below screen appears. Select Category as select Events and in Category, select All.
...
Selecting In Message Content as Health Monitoring then below screen appears. You may tweak , select Health Monitoring and enter the value for Interval a per your requirement.
...
Selecting In Message Content as Baseline then below screen appears. Here are some important settings, select Baseline.
Protocol: Displays protocols that exist in the specific environment. Select the protocol/s you want to filter for. The drop down displays protocols that exist in the specific environment.
Communication Type: Search for the types of communication you require or scroll down to select from the list of communication Select your required communication types.
Access Type: Select from the list of available access types.
...
To configure Syslog from EMC Server
Log in to EMC (need user with admin access)credentials.
Navigate to Settings > Integrations > SIEM Syslog
Click the + to Create New.
...
Enter the following Configuration:
To: Uncheck LOCAL because we are sending logs to a remote server
From: Select one or multiple CTD sites or ALLfrom
...
which you want to send syslog for
Vendor name: Select vendor as Other
Message Contents -
...
Select Alerts, Baselines, Events from Message Contentsdrop-down and configure recommended settings provided before under CTD server configuration.
Message Format – Select CEF
Server – CyberHub IP Address
Port – 6514
Protocol – TLS:
When TLS is chosen, the Syslog message will be sent as an encrypted TCP message with CEF format, with an option to add server authentication by uploading a server certificate.
System URL – Automatically shows the source URL; this field is not editable and does not need to be configured
Save –
...
Click to commit your entries.
...
To Test the Added Syslog Servers
Once Syslog configuration gets done then click to Send a Test Message option to test the Syslog servers those were added.
...
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
IP Address | Claroty Continuous Threat Detection interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub |