Overview
StormShield Network Security (formerly known by its original NETASQ product line) is a UTM/next-generation firewall appliance. This article explains how to forward StormShield NETASQ firewall logs to Logsign Unified SecOps Platform via syslog for security analytics and forensic purposes.
Prerequisites
- All Logsign versions support this integration.
Configure On StormShield NETASQ
Unverified: the exact console menu path for enabling remote syslog has not been verified against a live StormShield console during this research. Consult StormShield's own administration guide for your firmware version.
- In the StormShield administration console, enable log forwarding to a remote syslog server and point it at your Logsign collector's IP address and port.
- Leave the log format at the appliance's default key=value syslog output; Logsign's parser expects this default layout rather than a custom log format.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select StormShield as the vendor, and NETASQ as the product.
| Field | Description |
|---|---|
| Host | IP address of the StormShield appliance sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once StormShield is forwarding syslog to the configured host/port, events should begin appearing under Search.
Log Format and Supported Events
Logsign recognizes StormShield's default key=value syslog line, identified by a leading id=firewall time=... header, for illustration only (not a captured live sample):
id=firewall time="2026-08-01 12:00:00" fw=FIREWALL01 pri=5 logtype="filter" action=block ruleid=42 srcif=eth0 srcname=LAN src=192.168.1.10 srcport=51234 dstif=eth1 dst=8.8.8.8 dstport=443 proto=tcp sent=120 rcvd=340 msg="Blocked by filter policy"The parser recognizes and classifies a range of StormShield event types out of the box, including firewall filter/ACL decisions, alarm and IPS events, SSL/TLS inspection decisions, VPN and authentication activity, and periodic system/counter statistics. Each event carries source and destination IP (with city/country geo enrichment), port, and interface, MAC address, rule ID and name, protocol, byte/packet counts, and the classifying rule's action. Event type combinations not individually covered by the mapping library still resolve to a generic classification rather than being left uncategorized.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search to confirm parsed fields (Source IP, Destination IP, Rule ID, Event Info, etc.) are populating correctly.