SIEM Integration

AD360 allows you to integrate its components with SIEM solutions so that the logs generated by its components can be forwarded to the SIEM solution in syslog format for further analysis. Once forwarded, you can use your SIEM solution to correlate logs from the AD360 components with other logs in the network, as well as process, analyze, and generate reports and alerts for critical security incidents.

Note: Currently, you can integrate only the ADSelfService Plus component with SIEM tools using AD360. A centralized SIEM integration option for other components is in the works and will be available soon.

Integration steps

1. Log in to AD360 as an administrator.
2. Navigate to Admin → Administration → SIEM Integration.
3. You’ll see a table in which each row contains the SIEM integration details of a component.
4. To integrate a component with a SIEM tool for log forwarding, click the respective Configure Now link or the edit icon.



5. Select a Server Type from the drop-down. You can choose from the following SIEM tools:
• Syslog
• Splunk

Based on the server type you choose, the steps may vary.

Integration with Syslog servers

1. Enter the Syslog Server Name or IP Address.
2. Enter the Port number.
3. Select a Protocol from the drop-down.
4. Select the format in which you want to forward the logs to the syslog server from the Syslog Standard drop-down.
5. If needed, click Advanced to configure the severity, facility, and the date format of the logs.



6. Click Configure to finish the integration.

Integration with Splunk

1. Collect the HTTP event collector token of your Splunk Enterprise.
• Log in to Splunk as an administrator.
• Navigate to Settings → Data Inputs → HTTP Event Collector.
• Click New Token.
• Specify a name for the token and retain the default values for the other fields.
• Click Save to generate the authentication token.
2. Back in AD360 SIEM Integration configuration page, enter the Server Name or IP Address of your Splunk server.
3. Enter the HTTP Event Collector Port number.
4. Choose whether SSL is enabled or disabled in the SIEM tool from the drop-down.
5. Enter the Authentication Token you generated from step 1.e.



6. Click Configure to finish the integration.