# New log source onboarding — Acme NetGate Firewall (model NG-3500) # Format: CEF over Syslog (RFC5424), shipped via rsyslog → Splunk HEC ## Parser config (Splunk props.conf excerpt) [acme:netgate:cef] TIME_FORMAT = %b %d %H:%M:%S TIME_PREFIX = ^<\\d+> SHOULD_LINEMERGE = false LINE_BREAKER = ([\\r\\n]+)<\\d+> TRANSFORMS-strip = strip-syslog-header EXTRACT-cefv = (?CEF:\\d+)\\| EXTRACT-vendor = CEF:\\d+\\|(?[^|]+)\\| EXTRACT-product = CEF:\\d+\\|[^|]+\\|(?[^|]+)\\| ## Sample log lines (12 representative samples from prod) <134>Mar 14 09:23:11 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|100|Permit|3|src=10.0.1.45 dst=8.8.8.8 spt=51234 dpt=53 proto=udp act=allow <134>Mar 14 09:23:14 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|100|Permit|3|src=10.0.1.55 dst=151.101.65.69 spt=43210 dpt=443 proto=tcp act=allow <134>Mar 14 09:23:18 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|200|Deny|6|src=192.0.2.13 dst=10.0.1.10 spt=44444 dpt=22 proto=tcp act=deny rule=block-inbound-ssh <134>Mar 14 09:23:22 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|300|VPNAuth|5|user=alice@acme.example src=73.231.x.x action=auth-fail reason=invalid-password sessionid=sess-abc123 <134>Mar 14 09:23:25 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|300|VPNAuth|5|user=admin src=185.220.101.42 action=auth-success sessionid=sess-def456 password=Sup3rSecret! <134>Mar 14 09:23:31 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|400|IDSAlert|7|src=192.0.2.99 dst=10.0.1.20 sig=ET TROJAN suspect.malware.gen sigid=2034512 prio=high <134>Mar 14 09:23:35 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|100|Permit|3|src=10.0.1.45 dst=8.8.4.4 spt=51235 dpt=53 proto=udp act=allow <134>Mar 14 09:23:40 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|500|ConfigChange|4|user=root src=console action=rule-modified rule=block-inbound-ssh oldval='deny tcp/22' newval='allow tcp/22 src=any' <134>Mar 14 09:23:42 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|200|Deny|6|src=10.0.5.50 dst=10.0.1.10 spt=22222 dpt=445 proto=tcp act=deny rule=block-smb-lateral <134>Mar 14 09:23:50 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|300|VPNAuth|5|user=bob@acme.example src=73.231.x.x action=auth-success sessionid=sess-ghi789 mfa=push <134>Mar 14 09:23:55 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|600|Stats|2|interface=eth0 bytes_in=1234567 bytes_out=987654 <134>Mar 14 09:23:59 ng-prod-01 CEF:0|Acme|NetGate|3.5.2|100|Permit|3|src=10.0.2.30 dst=216.58.214.78 spt=44890 dpt=443 proto=tcp act=allow ## Retention + access policy - Splunk index: net-firewall — retention 30 days hot, 90 days cold - Org-wide legal-hold: 365 days for security-relevant logs (we are SOC 2 Type II in scope, healthcare customer base = HIPAA-applicable) - Index access: SOC tier-2+, no PII review process ## Integration mechanism rsyslog → Splunk HTTP Event Collector - Buffering: rsyslog disk queue 500MB - Acknowledgement: HEC ack tokens enabled - TLS: TLS 1.3 with mutual auth between rsyslog and HEC - Source identification: \`source = acme-netgate-prod\` set by rsyslog template

Log Source Onboarding Reviewer