sending logs to SIEM

for both SPP and SPS if i configure the sending logs to SIEM is it only the Primary node of SPP and Central Management node of SPS that send it to SIEM or are all single nodes that can send it externally?

Eventually is it possible to set only the primary node and central amnagmenent to send it?

Also: is it possible to export these events for SPP? from swagger with API's? what method?

for SPS is not possible to choose any specific event but SPS send all the system activities events, right? In which way i can know these events? (i have to specify to the customer that is asking me)

thank you very much!

0 Tawfiq.Ahmad 1 month ago

Hi Dario,

While the configuration is created from only the SPP Primary and SPS Central Management node, however, the events can be sent to the SIEM target from any node in the cluster.

Currently there is no option to force only the Primary & the Central management node to send SIEM data

For SPP, audit log events can be exported from Reports > Activity Center

For SPS, Universal SIEM will send session data mentioned in the guide under this topic Message types forwarded to SIEMs here:

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/7.4/administration-guide/30#TOPIC-2065505

Thanks!
Cancel
Up 0 Down

Reply

Verify Answer

Cancel

Endpoint Privilege Management

sending logs to SIEM