The Data Forwarding feature lets Logsign forward selected logs to other security products, such as a PAM solution, over syslog. Logs are selected by their Windows event ID: when an incoming log carries one of the event IDs you choose, Logsign sends a copy of it to the host and port you define.
To add a forwarding destination, go to Settings › Data Management › Data Forwarding and click Add. In the Add Syslog Forwarding window, fill in the following fields and click Save:
- Host: IP address or hostname of the receiving product.
- Port: Port on which the receiving product listens for syslog. Logsign sends the logs over UDP.
- Event ID's: One or more event IDs to forward. You can only pick from the predefined list: 11, 13, 14, 550, 1100, 1102, 4618, 4624, 4649, 4657, 4697, 4698, 4699, 4700, 4701, 4702, 4713, 4720, 4723, 4724, 4732, 4768, 4769, 4772, 4777, 4954, 5025, 5031, 5152, 5153, 5155, 5447.
Saved destinations are listed on the Log Forwarding page with their Type (syslog), Host, Port, Format (json) and Event ID's.