/
Sending Logs to Devo Syslog ELB

Sending Logs to Devo Syslog ELB

This feature is available starting from Snare Central v8.7.0

Overview

With the introduction of mTLS protocol in Snare Central 8.7.0, it is now possible for Snare Central to forward events received from Snare Agents to Devo Syslog ELB.

This guide aims to show the steps required to setup Snare Central to send logs to Devo.

Getting the required certificates

  1. Login to Devo

  2. Go to Administration → Credentials

    image-20250804-061738.png

    then X.509 Certificates

    image-20250812-050444.png

  3. Click “Create Certificate” or use an existing one

  4. Click “Chain CA” to download the CA certificate

  5. Click “Certificate” to download the client certificate

  6. Click “Private Key” to download the private key

    image-20250812-051126.png
    For steps 4, 5 and 6

Getting Devo Syslog ELB Address

  1. Go to Administration → Ingestion → Event Load Balancers (ELBs)

  2. Find the Syslog ELB you want to send events to, take note of its address as it will be used in configuring Snare Central

    image-20250812-055108.png

     

Configuring Snare Central for sending logs to Devo Syslog ELB

There are two main methods in achieving this. Both methods are detailed below.

Method 1: Modify outgoing logs for Devo

This method involves configuring Snare Agent to send logs in SNARE format, then configuring Snare Central to modify the log before forwarding to Devo so that Devo can process it.

This method only works for Snare Agent for Windows.

Configuring Snare Agent

  1. Login to Snare Agent Web UI

  2. Go to Destination Configuration

  3. Under Network Destination, configure your destination as follows:

    image-20250812-071758.png
    Sample Snare Agent Configuration

  4. Save changes then restart to apply changes

Configuring Snare Central

  1. Login to Snare Central Web UI

  2. Go to Reflector → Manage Certificates

  3. Add your Devo client certificate and CA certificate. See Manage Certificates for more details.

  4. Go to Reflector → Configure Destination

  5. Add a new destination

  6. Configure your new destination as follows:

    image-20260407-014755.png
    Sample Reflector Destination Configuration

    • Name: Unique user-friendly name of the destination, used for display purposes. Name can contain alphanumeric characters (a-z, A-Z, 0-9), special characters (~!@$%^()_+=-#) and spaces are allowed.

    • IP/Hostname: Address to your Devo Syslog ELB. See https://prophecyinternational.atlassian.net/wiki/spaces/SCV8/pages/3262775453

    • Port: Port of your Devo Syslog ELB. See https://prophecyinternational.atlassian.net/wiki/spaces/SCV8/pages/3262775453

    • Destination Format: “Raw - no conversion”

    • Protocol: “MTLS”

    • Client Certificate: Choose the Devo client certificate you just added.

    • Filters: It is highly recommended to filter the log types WinSecurity, WinApplication, WinSystem and MSWinEventLog as it is the only log types compatible with this method.

    • Search Replace

      • Add a new filter

        • Regular Expression:

          ^(\S+)\s+((?:\S+\s+){2})(.*)$

        • Replacement String:

          <1>1 1985-04-12T23:20:50.52Z ${1} box.win_snare.syslog_5424: - - - ${3}

  7. Click Update, then restart Reflector when prompted to apply changes.

 

Method 2: Forwarding Raw Devo format logs from Snare Agent

This method involves configuring Snare Agent to send Devo format logs to Snare Central then forwarding those logs to Devo as is.

Since Snare Central doesn’t support raw Devo format from Snare Agents, logs received this way by Snare Central will be classified as GenericLog and will not be parsed into fields. Use this method only if other methods do not work.

Configuring Snare Agent

  1. Login to Snare Agent Web UI

  2. Go to Destination Configuration

  3. Under Network Destination, configure your destination as follows:

    image-20250812-062327.png
    Sample Snare Agent Configuration

  4. Save changes then restart Snare Agent to apply changes

Configuring Snare Central

  1. Login to Snare Central Web UI

  2. Go to Reflector → Manage Certificates

  3. Add your Devo client certificate and CA certificate. See Manage Certificates for more details.

  4. Go to Reflector → Configure Destination

  5. Add a new destination

  6. Configure your new destination as follows:

    image-20260407-025406.png
    Sample Reflector Destination Configuration

  7. Click Update, then restart Reflector when prompted to apply changes.