WatchGuard XTM
WatchGuard XTM is a firewall that produces data about what is happening between your network and the rest of the world, and can monitor things such as how much data is being sent from which computer, where the data is going, and who is receiving the data.
Before You Begin
You must configure WatchGuard to send its log to a syslog server. Instructions on how to do so can be found at the following links:
- https://www.watchguard.com/help/docs/fireware/12/en-US/Content/en-US/logging/send_logs_to_syslog_c.html?Highlight=syslog
- https://www.watchguard.com/help/docs/fireware/12/en-US/Content/en-US/logging/set_up_logging_on_device_wsm.html
Make sure your Network Interface Card (NIC) does not have spaces
WatchGuard Firewalls print the name of the NIC handling your data in syslog. If the name of the NIC in the firewall has a space in it, it will break the parser because syslog parsers are space-delimited and the names are not escaped in any way, and InsightIDR will not be able to parse your data.
Configure InsightIDR to collect data from the event source
After you complete the prerequisite steps and configure the event source to send data, you must add the event source in InsightIDR.
To configure the new event source in InsightIDR:
- From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.
- Do one of the following:
- Search for Watchguard XTM Firewall & Web Proxy in the event sources search bar.
- In the Product Type filter, select Firewall.
- Select the Watchguard XTM Firewall & Web Proxy event source tile.
- Choose your collector and event source. You can also name your event source if you want.
- Choose the timezone that matches the location of your event source logs.
- Optionally choose to send unparsed logs.
- Configure your default domain and any Advanced Event Source Settings.
- Select a collection method and specify a port and a protocol.
- Optionally choose to Encrypt the event source if choosing TCP by downloading the Rapid7 Certificate.
- Click Save.