About the Device
Attivo BOTsink technology detects, engages, and analyzes BOT and APT attacks. This results in total confidence that your organization is malware-free. A BOTsink system consists of BOTsink and its embedded software. Attivo BOTsink Systems are on-premise and cloud-based BOT and APT detection security tools that complement existing security systems.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | Attivo |
Product Name | BOTsink |
Type of Device | Hosted |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
Attivo BOTsink Events | ATTIVO | SYSLOG - CEF | CyberHub |
Port Requirements
Source | Destination | Port |
|---|---|---|
Attivo BOTsink | CyberHub | 601(TCP) |
Device Configuration
To create a syslog profile
Click the Administration and select Management > Syslog.
Click Add in the Syslog Profiles section.
Enter a name, which enables you to identify the syslog profile.
BOTsink generates the syslog messages with value as Attivo for Device Vendor. Use default value as Attivo.
The Manager tags all the syslog messages with the string BOTsink to enable you to identify BOTsink messages in the syslog server. Use default value as BOTsink.
Make sure the Events Forwarding is set to enabled.
Select event severity as the criterion. Select very-low.
The BOTsink severity of events is mapped with that of syslog severity (RFC 5424). Use as default.
Select message format as CEF.
Enable Faults Forwarding.
Enable Audit Logs Forwarding.
Click Save.
To create a syslog server record
Click the Administration and select Management > Syslog.
To add a syslog server details, click Add in the Syslog Server section.
Enable message forwarding.
Enter the Name of syslog server.
Select the Profile Name which you have created above.
Enter CyberHub IP Address
Enter port number as 601
Select protocol as TCP
Save the configuration
Test connection
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
IP Address | Attivo BOTsink interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub |