Log Aggregators

A log aggregator is not an event source itself, but a place from which event source data can be pulled from the original source. Think of a SIEM like a "middle man" between InsightIDR and the original event source. If you already have logs going into a log aggregator on a network (e.g. SIEM or Splunk), you can use the aggregator to forward logs to InsightIDR.

Requirements for Log Aggregators

InsightIDR requires the following:

• The logs must be split up into separate streams into the collector so that each parser will only have logs going to it that it knows how to parse.
  • For example, AD logs can be sent to UDP port 6000 while firewall logs can be sent to port 6001, IDS logs to port 6002, etc.
• Logs must be sent to the collector before they are processed by the SIEM so they look the same to the collector as if they came from the original network appliance.

Supported Log Aggregators

InsightIDR supports the following log aggregators:

• HP ArcSight
• LogRhythm
• IBM QRadar
• Splunk

InsightIDR also supports:

• McAfee Enterprise Security Manager (formally known as Nitrosecurity)
• FireEye Threat Analytics Platform (TAP)

Event Sources that support Log Aggregators

You can configure the following event sources to use log aggregators as their collection method: