Configure SIEM Destinations

For supported software information, click here.

You can configure a Versa SASE gateway to send security events and logs to destinations that provide security information and event management (SIEM). 

When SIEM is enabled, logs are also sent to the Versa advanced logging service (ALS).

To configure the gateway to stream events and logs to SIEM destinations:

1. Go to Configure > Settings.
   
   
    
2. Click SIEM Integration, and then enter information for the following fields.
   
   
    

   Field	Description
   SIEM Enabled	Click the slider bar to enable SIEM.
   Primary Destination FQDN/IP Address (Required)	Enter the fully qualified domain name (FQDN) or IP address of the primary SIEM destination. For example, 1.1.1.12 or acme.com.
   Secondary Destination FQDN/IP Address	Enter the FQDN or IP address of the secondary SIEM destination. For example. 1.1.1.14 or bakery.acme.com.
   Destination Port (Required)	Enter the destination port at the SIEM destination.
   Transport Protocol (Required)	Select the transport protocol. The options are TCP and UDP.
   VPN Name (Required)	Select the name of the VPN to use to connect to the SIEM destination.

3. Click Save.