1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Audit
    6. Syslog and stdout integration
    End-of-Life (EoL)

    Syslog and stdout integration

    You can configure Prisma Cloud to send audit event records (audits) to syslog and/or stdout for Console and Defender based on whether you have Prisma Cloud Compute Edition or Prisma Cloud Enterprise Edition.
    With the Prisma Cloud Compute Edition, you can configure Prisma Cloud to send audit event records (audits) to syslog and/or stdout.
    Syslog integration must be turned on manually. Open Console, go to
    Manage > Alerts > Logging
    , then set
    Syslog
     to
    Enabled
    . Prisma Cloud connects to the syslog socket on /dev/log. Stdout integration can be enabled from the same tab.
    When you enable syslog or stdout integration, you can optionally enable verbose output. Verbose output records vulnerability and compliance issues in your environment. It also records all process activity.
    In general, enabling verbose output is not recommended because of the substantial overhead. You can retrieve this data much more efficiently from the Prisma Cloud API. Nevertheless, sometimes this capability is expressly required for integration with SIEM tools.
    Do not enable both syslog and stdout on hosts with systemd. With systemd, anything sent to stdout gets logged to syslog. With both syslog and stdout enabled, you would get duplicate messages in syslog.

    Sending syslog messages to a network endpoint

    Writing to /dev/log sends logs to the local host’s syslog daemon. The syslog daemon can then be optionally configured to forward those logs to a remote syslog or SIEM server. If you don’t have access to the underlying host, you can configure Prisma Cloud Console to send log messages directly to your remote system.
    In most cases, you won’t need to specify a network endpoint in order to send syslog messages to your SIEM tool. If you already have log collectors on your hosts, simply enable syslog. Your log collectors will stream Prisma Cloud syslog messages to your SIEM tool.
    Some things to keep in mind:
    • Console sends logs directly to your remote server. When configuring Console with the remote server, validate that the address you enter is actually reachable from the host where Console runs. Otherwise, you risk losing log messages.
    • Because Console sends messages directly to your remote server, and not through the local syslog daemon, you don’t get some of syslog’s built-in benefits, such as buffering, which protects against network outages and service failures.
    • The classic syslog implementation sends logs over UDP. This is considered a bad practice if your logs have any value. UDP is connectionless. Packets are sent to their destination without confirming that they were received. TCP’s stateful connections and retransmission capabilities make it more appropriate for shuttling logs to a SIEM.
    1. Log into Console.
    2. Go to
      Manage > Alerts > Logging
      .
    3. Set
      Syslog
       to
      Enabled
      .
    4. In
      Send syslog messages over the network to
      , click
      Edit
      , and then specify a destination.

    Appending custom strings to syslog messages

    You can configure Prisma Cloud Compute to append a custom string to all Console and Defender syslog messages.
    Custom strings are set in the event message as a key-value pair, where the key is "id", and the value is your custom string. The following screenshot shows a Defender event, where the custom string is "koko".
    Configuring a custom string is useful when you have multiple Prisma Cloud Compute deployments (i.e. multiple Compute Consoles) and you’re aggregating all messages in a single log management system. The custom string serves as a marker that lets you correlate specific events to specific deployments.
    1. Open Console.
    2. Go to
      Manage > Alerts > Logging
      .
    3. Set
      Syslog
       to
      Enabled
      .
    4. For
      Identifier
      , click
      Edit
      , and enter a string.

    Console events

    Both Console and Defender emit messages. Console syslog messages are tagged as Twistlock-Console in the logs.
    The data emitted to syslog and stdout is exactly the same.

    Console syslog event types

    The following table describes each message type and sub-type.
    Syslog Type
    Sub Type
    Description
    image_scan
     — 
    This represents an image scan.
     — 
    containerCompliance
    This represents any Compliance findings within the image scan.
     — 
    vulnerability
    This represents any Vulnerability findings within the image scan.
    container_scan
     — 
    This represents a Container scan.
     — 
    container
    This represents any Compliance findings within the container scan.
    vm_scan
     — 
    This represents a VM scan.
     — 
    containerCompliance
    This represents any Compliance findings within the vm scan.
     — 
    vulnerability
    This represents any Vulnerability findings within the vm scan.
    host_scan
     — 
    This represents a Host scan.
     — 
    containerCompliance
    This represents any Compliance findings within the host scan.
     — 
    vulnerability
    This represents any Vulnerability findings within the host scan.
    scan_summary
     — 
    This represents a scan summary. The type of summary is dependent upon subtype below.
     — 
    image
    This represents a summary of image Vulnerability and Compliance issues.
     — 
    container
    This represents a summary of container Vulnerability and Compliance issues.
     — 
    vm
    This represents a summary of vm Vulnerability and Compliance issues.
     — 
    host