Send Sangfor NGAF Log to Elasticsearch

Hello,

Have anyone ever sent logs from Sangfor NGAF to Elasticsearch or Elk Stack? How to send sanfor NGAF log to elk.?

Please share your experince or any other option for syslog except kiwi syslog with best open source log server.?

Thanks

HiHi,

Please find below the relevant information for your easy reference:

Sangfor NGAF Syslog Configuration Guide:

https://knowledgebase.sangfor.com/detailPage?articleData=%7B%22articleType%22%3A1,%22articleId%22%3A%22663c22818f7941e1b22284111f9b2433%22,%22keyword%22%3A%22%22%7D

- Select the Logging Location to Syslog for Security Logs, Application Control Logs, Traffic Audit Logs, NAT Logs, User Authentication Logs, SSL VPN Logs, Local ACL Logs, and HA Error Logs.

The Syslog Server IP Address is 10.10.10.10, and the Port is 514.

- Configure the Syslog server. In this guide, we use Kiwi Syslog Service Manager as an example. Download and install Kiwi Syslog Service Manager at: https://www.kiwisyslog.com

Hi,

Thank you for reply, but my concern is not the how to config syslog on NGAF..but especially how to parse the log from NGAF so elasticsearch will consume log from NGAF or may be another syslog server except kiwi syslog.

Thanks.

Yes, sending Sangfor NGAF logs to Elasticsearch or the ELK Stack (Elasticsearch, Logstash, and Kibana) is a common practice for centralized log management. To achieve this, you can use Logstash to collect, filter, and forward Sangfor NGAF syslog data to Elasticsearch. Configure Logstash with an input plugin to receive syslog messages, apply filters to parse and structure the data, and then use an output plugin to send the processed logs to Elasticsearch. Ensure that the necessary ports are open, and mappings are set up correctly in Elasticsearch to accommodate the NGAF log data. As for open-source alternatives to Kiwi Syslog, you might consider tools like Graylog, Fluentd, or syslog-ng, depending on your specific requirements and preferences. These platforms offer flexibility and scalability for managing logs from various sources.

Sending Logs to Elasticsearch:

    Syslog Configuration:
        Configure NGAF to forward logs via syslog to the Elk Stack server. You can choose from UDP or TCP transport protocols.
        Specify the hostname or IP address of your Elk Stack server and the desired port (typically 514 for UDP).
        Select the log categories you want to send (e.g., firewall, VPN, intrusion detection).

    Logstash Configuration:
        Set up a Logstash instance on your Elk Stack server.
        Define a Logstash input to receive syslog messages from the specified port.
        Use a grok filter to parse the NGAF log format. You can find example grok patterns online or in the Sangfor NGAF documentation.
        Add any desired transformations or enrichments to the data (e.g., adding timestamps, geo-location).
        Output the processed data to Elasticsearch.

    Kibana Visualization:
        Create dashboards in Kibana to visualize the NGAF logs.
        Use filters, aggregates, and other analytics features to gain insights into network activity, threats, and security events.

Alternatives to Kiwi Syslog:

    Open-source options:
        Graylog: A popular open-source log management platform with a user-friendly interface and powerful filtering and analysis capabilities.
        Logsene: Another open-source platform that offers centralized log collection, storage, and visualization.
        Fluentd: A flexible data collector that can forward logs to various destinations, including Elasticsearch.

    Commercial options:
        Elasticsearch Cloud: Hosted Elasticsearch solution from Elastic.co with built-in Kibana.
        Splunk: Popular commercial log management platform with rich analytics and reporting features.

Community Experiences:

    Check out this Sangfor community forum thread for some user experiences and helpful tips on sending NGAF logs to Elasticsearch: https://community.sangfor.com/plugin.php?id=info:index
    You can also find online tutorials and blog posts with detailed instructions on configuring the process.

Hi, you can achieve this by getting syslog logs from ngaf.

Configure the Syslog server.
and add option for elastic search..

Just add the IP address Elk Stack or Elasticsearch to the "Logging and Archiving" tab

you can follow these steps when sending logs from Sangfor NGAF to ELF Stack

1. enable logging on Sangfor NGAF
   - log in to NGAF console
   - configure NGAF to send logs to a remote syslog server
2. Setup Syslog server
   - deploy syslog server that can receive logs from Sangfor NGAF. this can be the same server where ELK staff is installed or you can create a separate syslog server
3. Configure Logstash:
   - logstash is a log processing pipeline that can ingest logs from various sources, including syslog
   - configure logstash to receive logs from syslog server and process them, you may consider creating logstash input configurations to listen for incoming syslog messages
4. install Elasticsearch
   - install and configure Elasticsearch which will store and index the logs
5. Setup Kibana
   - install and configure Kibana for visualizing and analyzing the logs stored in Elasticsearch
6. Send Logs from Logstash to Elasticsearch
   - Configure Logstash to send processed logs to Elasticsearch
7. Testing and monitoring
   - verify and test if logs from Sangfor NGAF are reaching Elasticsearch
8. Troubleshooting
   - monitor logs and troubleshoot any issues you might encounter during integration process
   - if all else fail, you may try reaching out to Sangfor support for assistance

It is typical practice for centralized log management to transmit Sangfor NGAF logs to Elasticsearch or the ELK Stack (Elasticsearch, Logstash, and Kibana). You may accomplish this by gathering, filtering, and forwarding Sangfor NGAF syslog data to Elasticsearch using Logstash. Use an output plugin to transmit the processed logs to Elasticsearch after configuring Logstash with an input plugin to receive syslog messages and filters to parse and arrange the data. Make that Elasticsearch's mappings are configured appropriately and that the required ports are open in order to receive the NGAF log data. For open-source substitutes for Kiwi Syslog, you may want to look at programs like Fluentd, Graylog, or syslog-ng, according on your needs and preferences.