Focus

SaaS Security

Syslog Integration on Data Security

Table of Contents

Configure Syslog Monitoring on Data Security

Configure syslog monitoring on Data Security and discover the supported log types and fields available.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Strata Cloud Manager) Prisma Access (Managed by Strata Cloud Manager)	Data Security license Or any of the following licenses that include the Data Security license: CASB-X CASB-PA

Syslog is a standard log transport mechanism that enables the aggregation of log data from different sources into a central repository for archiving. Data Security can forward every type of log it generates to an external syslog server. This syslog feature requires TLS 1.0 (and above) communications protocol for connections between Data Security and the external syslog server. This topic describes how to configure syslog monitoring and includes a description of supported log types and log fields (LF).

LF denotes Log Fields.

Syslog Field Descriptions
Incidents LF
Remediation Activity LF
Policy Violations LF
Activity Monitoring LF
Admin Audit LF

Syslog Field Descriptions

Learn about the different log fields available for each log type on Data Security.

The following topics list the standard fields of each log type Data Security can forward to an external server, as well as the security levels, custom formats, and escape sequences. To help parsing, the delimiter is a comma and each field is a comma-separated value (CSV) string.

Incidents Log Fields

The descriptions and names of available log fields in a Data Security incident log.

The incident log is generated when an incident is detected. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.

Fields are listed in the order that they are needed for push mode.

Field Name	Description
timestamp	Time the incident was discovered in YYYY-MM-DD HH:MM:SS format with Augmented Backus-Naur Form (ABNF) to indicate the timezone.
serial	Serial number of the organization using the service (tenant).
log_type	Type of log. In this case, incident.
cloud_app_instance	Instance name of the cloud application (not the type of cloud application).
severity	Severity of the incident valued between 0 and 5.
incident_id	Unique ID number for the policy rule that created the incident.
asset_id	Unique ID number for the asset associated with the incident.
item_name	Name of the file, folder, email subject, or user associated with the incident.
item_type	Values are File, Folder, or User
item_owner	User who owns the asset identified in the incident.
container_name	Value of bucketname for AWS S3, Google Cloud Platform, and Microsoft Azure assets. The value is null for the remaining apps.
item_creator	User who created the asset identified in the incident.
policy_rule_name	Names of one or more policy rules (not policy type) that were matched.
exposure	The type of exposure associated with the incident. Values are Public, External, Company, or Internal.
occurrences_by_rule	Value is null.
future_use	Not currently implemented
future_use2	Not currently implemented
additional_notes	Any notes added by the administrator (first 20 bytes).
collaborators	Any external or internal collaborators with access to view, edit, or download an asset.
datetime_edited	Last time the asset associated with the incident was updated on the cloud app.
incident_category	Category of the incident. For example, Personal or Business Justified.
incident_owner	Administrator assigned to the incident.
item_creator_email	Email address of the item creator.
item_owner_email	Email address of the item owner or sender of email.
item_cloud_url	File URL associated with the incident and used to download or view the asset.
item_owner_group	AD groups to which the asset owner belongs.
item_sha256	sha256 hash as reported by WildFire cloud service.
item_size	Size of the file as reported by WildFire cloud service .
item_verdict	Verdict as reported by WildFire cloud service: either malware, benign, or not available.
asset_create_time	Time the asset associated with the incident was created on the cloud app or initially uploaded from local drive to the cloud app.

Remediation Activity Log Fields

The descriptions and names of available log fields in a Data Security remediation log.

A remediation log is generated when an incident is manually remediated or if automatic remediation has been applied. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.

Fields are listed in the order that they are needed for push mode.

Field Name	Description
timestamp	Time the remediation action occurred. Values are in YYYY-MM-DD HH:MM:SS format.
serial	Serial number of the organization using the service (tenant).
log_type	Type of log. In this case, remediation.
cloud_app_instance	Instance name of the cloud application (not the type of cloud application) associated with the remediation of the incident.
severity	Policy violation or incident severity valued between 0 and 5.
incident_id	Unique ID number for the incident. Can be null (no value).
asset_id	Unique ID number for the asset associated with the remediation of the incident.
item_name	Name of the file, folder, or user associated with the remediation of the incident.
item_type	Values are File, Folder, or User.
item_owner	User who owns the asset associated with the remediation.
container_name	Value is the bucketname for AWS S3, Google Cloud Platform, and Microsoft Azure assets. The value is null for the remaining applications.
item_creator	User who created the asset associated with the remediation.
policy_rule_name	Names of one or more policy rules (not policy type) that were matched.
future_use	Not currently implemented.
action_taken	Remediation action taken on Data Security. (Admin Quarantine, User Quarantine, or Remove Public Links).
action_taken_by	User who performed the remediation. For automated remediation, the value is Aperture.
item_creator_email	Email address of the item creator.
item_owner_email	Email address of the item owner.

Policy Violation Log Fields

The descriptions and names of available log fields in a Data Security policy violation log.

The policy violation log is generated when an asset matches a policy rule. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.

Fields are listed in the order that they are needed for push mode.

Field Name	Description
timestamp	Time the policy violation occurred. Values are in YYYY-MM-DD HH:MM:SS format.
serial	Serial number of the organization using the service (tenant).
log_type	Type of log. In this case, policy_violation.
cloud_app_instance	Instance name of the cloud application (not the type of cloud application) associated with the policy violation.
severity	Policy violation severity valued between 0 and 5.
incident_id	Unique ID number for the incident. Can be null (no value).
asset_id	Unique ID number for the asset associated with the policy violation.
item_name	Name of the file, folder, or user associated with the policy violation.
item_type	Values are File, Folder, or User.
item_owner	User who owns the asset associated with the policy violation.
item_creator	User who created the asset identified in the policy violation.
policy_rule_name	Name of the policy rule that triggered the violation.
future_use	Not currently implemented.
action_taken	Action taken to remedy the policy violation. For example, Log only, or Send Administrator Alert.
action_taken_by	Cloud app user who took action to remediate the policy violation. For automated remediation, the value is Aperture.

Activity Monitoring Log Fields

The descriptions and names of available log fields in a Data Security activity monitoring log.

The activity monitoring log is generated when a user activity policy is matched.

Field Name	Description
timestamp	Time the activity occurred. Values are in YYYY-MM-DD HH:MM:SS format.
serial	Serial number of the organization using the service (tenant).
log_type	Type of log. In this case, activity_monitoring.
cloud_app_instance	Instance name of the cloud application (not the type of cloud application) associated with the activity.
severity	Policy violation or incident severity valued between 0 and 5.
item_name	Name of the file, folder, or user associated with the activity.
item_type	Values are File, Folder, or User.
user	Cloud app user who performed the activity.
source_ip	Source IP address where the activity was performed.
location	Location where the activity was performed.
action	Activity that occurred. For example, Login or Upload.
target_name	Field name updated or target of the activity.
target_type	Target type. For example, FieldName, Report, or File.
item_unique_id	Unique ID number for an asset’s related asset.

Admin Audit Log Fields

The descriptions and names of available log fields in a Data Security administration activity log.

The admin audit log is generated when a Data Security administrator performs an action such as the remediation of an incident, creating a new policy rule, or adding internal or external collaborators. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.

Fields are listed in the order that they are needed for push mode.

Field Name	Description
timestamp	Time the incident was discovered in YYYY-MM-DD HH:MM:SS format with Augmented Backus-Naur Form (ABNF) to indicate the timezone.
serial	Serial number of the organization using the service (tenant).
log_type	Type of log. In this case, admin_audit.
admin_id	Email account associated with the Data Security administrator.
admin_role	Role assigned to the administrator: super_admin, admin, limited_admin, or read_only
ip	IP address of the administrator who performed the action.
event_type	Type of configuration change: settings, policy, remediation, or login.
item_name	Name of the item that changed in the configuration.
item_type	Type of item in the configuration that changed: user, apps, settings, content_policy, file, risk, or general_settings.
field	Name of the field associated with the configuration change.
action	Configuration change activity that occurred: create, edit, delete, login, or logout.
resource_value_old	Value before the configuration change occurred.
resource_value_new	Value after the configuration change occurred.
future_use	Not currently implemented.
future_use2	Not currently implemented.

Configure Syslog Monitoring on Data Security

API Client Integration on Data Security

SaaS Security Docs

Syslog Integration on Data Security

SaaS Security Docs