Forum Discussion

Jason_19901's avatar
Jason_19901
Icon for Nimbostratus rankNimbostratus
Apr 22, 2014

APM iRule to send information to NITRO SIEM

looking for an iRule that will capture the username/IP address when someone logs into APM and sends that to the SIEM. Also should include auth failures so I can set an alert for number of failed logins

 

APM
application delivery
design
devops
iRules
security

2 Replies

Sort By
  • AP_129594's avatar
    AP_129594
    Icon for Nimbostratus rankNimbostratus
    Apr 02, 2015

    Kevin, Instead of having a pool of SIEM pool, how do I set my log to hit an individual SIEM IP address?

     

    set hsl [HSL::open -proto UDP -pool syslog-ubuntu-pool]

     

    Thanks

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Apr 04, 2015

    HSL doesn't support that, you could work with HSL::open -publisher from 11.3 if you can configure a publisher.

     

    but why cant you create that pool and put one member in it?