We currently support several firewall integrations including Cisco, Palo Alto, Check Point and more. However, there are inconsistencies across the ingest options, such as supported protocols and syslog format (UDP/TCP/TCP+TLS) and syslog format (RFC3164 vs RFC5424). We need to ensure each integration is consistent across protocols and syslog format supported. Given how popular the firewall Beats modules are, we should consider enhancement to the modules as part of this effort too.

Cisco ASA/FTD/IOS

• UDP
• TCP
• TCP + TLS
• RFC3164
• RFC5424

Check Point

• UDP
• TCP
• TCP + TLS
• RFC3164
• RFC5424

Fortinet

• UDP
• TCP
• TCP + TLS
• RFC3164
• RFC5424

Juniper SRX

• UDP
• TCP
• TCP + TLS
• RFC3164
• RFC5424

Palo Alto

• UDP
• TCP
• TCP + TLS (IETF format recommended by PANW)
• RFC3164
• RFC5424 - [Palo Alto/panw.panos] Support Syslog RFC5424 beats#26430

Sophos XG

• UDP
• TCP
• TCP + TLS
• RFC3164
• RFC5424