Applies To: SonicWALL UTM SonicOS 5.8 and later.

Overview

SonicWALL's approach to UTM Unified Threat Management (UTM) is the security approach for small- to medium-sized businesses (SMBs). It uses for networking, security, threat prevention, and management to deliver predictable performance.

EventTracker gathers and examines acquired logs to identify malicious traffic, fatal threats, configuration changes, VPN activity and user behaviour. It generates reports for changes in firewall configuration, user management and its activities, detection of intrusion, virus and spyware. It alerts when user tries to access blocked URL and login fails.

SonicWALL UTM Logging

EventTracker Knowledge Pack for SonicWALL UTM firewall allows you to monitor following:-

• Operations:- High Availability Activity, Link monitoring, DHCP Relay Activity, User Activity and Content Filtering
• Security:- Anti-Spam Service, Wireless LAN Intrusion Detection System(IDS) Activity
• Compliance:- Authenticated Access Activity, Network Access Activity, Firewall Events Alerts, VPN Client activity having user authentication failed and success, VPN activity having IPsec, PKI, IKE information and VPN IPsec tunnel status changed activity.           

Previous Next

Once SonicWALL UTM is configured to deliver events to EventTracker Manager; alerts, dashboards and reports can be configured into EventTracker.

Some of the Knowledge Packs available in EventTracker are listed below. For more information, please refer Integration Guide.

Scope

The configurations detailed in this guide are consistent with EventTracker Enterprise version 7.X and later,SonicWALL UTM SonicOS 5.8 and later.

Documentation:

To configure Sonicwall UTM to send logs to EventTracker, refer the How to Guide.

For more information please refer the Integration guide