Omnissa Access Syslog Integration

You can configure the syslog SIEM adapter in Omnissa Access to automatically stream Omnissa Access audit events to external syslog servers. All syslog servers that meet the requirements listed in this documentation are supported.

Requirements

• The syslog server must be accessible from the Internet.
  See KB article 68035 for the Omnissa Access domains and IP addresses to add to your allowlist.
• Mutual TLS (mTLS) is required between the syslog server and Omnissa Access.
• The syslog server must allow inbound traffic over port 6514 (TCP). If the syslog server uses a different port for TLS, you must enter the port number in the Omnissa Access syslog SIEM adapter.
  See the Omnissa Ports and Protocols site for the latest port requirements.

Prerequisites

Mutual TLS requires both the server and client to present certificates. Before you can configure the syslog SIEM adapter in Omnissa Access, you must create two self-signed certificate-private key pairs. One pair will be used to identify the syslog server and the other your Access tenant (the client). See the documentation for your syslog server to configure it with the server certificate and private key pair and the Access client certificate. Then configure the Syslog SIEM adapter in Omnissa Access with the Access client certificate and private key pair and the syslog server certificate, as described below.

The certificates must be X.509 certificates in PEM format.

Configure the Syslog SIEM Adapter

1. In the Omnissa Access console, navigate to Integrations > SIEM.

2. Select the toggle to enable the syslog adapter.

   Note: Only one SIEM integration can be active at a time.

3. Configure the syslog adapter. All fields are required.

   Field	Description
   Appname	The app name that all logged events will be assigned.
   Facility	The category that all logged events will be assigned.
   Severity	The severity level that all logged events will be assigned by default.
   Hostname	The fully-qualified domain name (FQDN) of the syslog server, for example, syslogserver.example.com. The FQDN must be externally resolvable.
   Port	The port on which the syslog server is listening for TLS (RFC-5425) messages. By default, Omnissa Access communicates with the syslog server on port 6514 (TCP).
   Client Certificate	Paste the client certificate you created for Omnissa Access to authenticate to your publicly-available syslog system. The certificate must be an X.509 certificate in PEM format. Include the ----BEGIN CERTIFICATE---- and ----END CERTIFICATE---- lines.
   Client Private Key	Paste the private key for the Omnissa Access client certificate. Include the ----BEGIN RSA PRIVATE KEY---- and ----END RSA PRIVATE KEY---- lines.
   Syslog Certificate	Paste the syslog server's PEM-format X.509 certificate. Include the ----BEGIN CERTIFICATE---- and ----END CERTIFICATE---- lines.

4. Select Enable to complete the syslog integration.

If your configuration fails, you can find troubleshooting options in Troubleshooting TLS Encrypted Message Transfer.