Darktrace

This article describes the steps to configure syslog forwarding for Darktrace.

Prerequisites

• Configure Darktrace to send logs.
• Ensure you are a Darktrace Administrator with access to the User Interface.

To configure syslog forwarding for Darktrace:

1. Log in to the Darktrace interface.
2. Expand the top left menu and select Admin. A second menu appears.
3. Select the System Config page.
   
   
   
   
4. In the Alerting section, click Verify Alert Settings.
5. Set the following parameters:
   • CEF Syslog Alerts as True.
   • The syslog server to the IP address of the DNIF Adapter.
   • Set a unique port.
   • CEF Syslog TCP Alerts as True.
     
     
     
     
6. Darktrace will automatically save your changes.
7. In the Alerting section, click Verify Alert Settings.
   
   
   
   
8. You will view 1 Alert Sent. IMAP settings are valid message, on validating.