Forwarding Logs to External SIEM

It is advised that if logs from the ESA and Protectors need to be forwarded to an External SIEM, they should first be directed to the ESA. Utilizing the td-agent within ESA, these logs can then be forwarded concurrently to both the Insight in ESA and the external SIEM. This approach ensures a unified and efficient log management process while maintaining comprehensive audit trails and enhancing security monitoring capabilities.

For more information related to forwarding logs to External SIEM, refer to Sending logs to an external security information and event management (SIEM).

For a comprehensive understanding of the communication flows, refer to the architecture diagram Deployment with Audit logging flow to External SIEM. This diagram explains how logs are forwarded between Protectors, ESA, and the External SIEM.