Managing SIEM connections

Connect your SIEM system to VK Cloud so that Cloud Audit can send it information about security events coming from your cloud services and virtual machines.

You can connect several SIEM systems to VK Cloud, and also set up several connections to the same SIEM system, for example, to receive data from VK Cloud in different formats. However, only one of these connections can be active at a time.

In your management console, you can change parameters and activity status of connections, as well as delete unnecessary connections.

1. Open the port of your SIEM system to receive messages from VK Cloud. For more information about other necessary settings, read the documentation of the SIEM system.

2. Go to your VK Cloud management console.

3. Go to the Monitoring → Event log section.

4. Click the Settings button and go to the SIEM tab.

5. Click the Create connection button.

6. Specify the connection parameters:

   • Name: enter a name for the connection.
   • Connection point: enter the IP address of your SIEM system and the port open to receive messages from VK Cloud.
   • Data transfer protocol: select the protocol for transferring data to the SIEM system. Available options: TCP, UDP, TCP over TLS. To use data encryption, select TCP over TLS.
   • TLS key: enter the TLS key value from your provider in PEM format. This option is available when TCP over TLS is selected.
   • Message format: select the format in which data will be provided to the SIEM system. Available options: RAW (Syslog RFC5424), CEF (Common Event Format.

7. (Optional) Select the type of message filtering:

   • Disabled: getting information about all events.
   • General filters: filtering events by Status or Source parameters. Available options: Disabled, Send only selected, Send all except.
   • Query filter: filtering events by creating your own filter using query language.

8. Click the Create button.

9. Wait for the connection check to complete and click the Activate or Save as inactive button.

1. Go to your VK Cloud management console.

2. Go to the Monitoring → Event log section.

3. Click the Settings button and go to the SIEM tab.

4. Click for the required connection and select Configure. A page with the settings of the selected SIEM connection will open.

5. Change the connection parameters as needed:

   • Name: enter a name for the connection.
   • Connection point: enter the IP address of your SIEM system and the port open to receive messages from VK Cloud.
   • Data transfer protocol: select the protocol for transferring data to the SIEM system. Available options: TCP, UDP, TCP over TLS. To use data encryption, select TCP over TLS.
   • TLS key: enter the TLS key value from your provider in PEM format. This option is available when TCP over TLS is selected.
   • Message format: select the format in which data will be provided to the SIEM system. Available options: RAW (Syslog RFC5424), CEF (Common Event Format.

6. (Optional) Select the type of message filtering:

   • Disabled: getting information about all events.
   • General filters: filtering events by Status or Source parameters. Available options: Disabled, Send only selected, Send all except.
   • Query filter: filtering events by creating your own filter using query language.

7. Click the Create button.

8. Wait for the connection check to complete and click the Activate or Save as inactive button.

1. Go to your VK Cloud management console.

2. Go to the Monitoring → Event log section.

3. Click the Settings button and go to the SIEM tab.

   The connection status is displayed by the icon in the Status column:

   • Gray icon — inactive connection.
   • Green icon — active connection.

4. To activate a connection, use one of the following methods:

   • Click for the connection and select Start.
   • Set the checkbox for the connection and click the Start button.

5. To make a connection inactive, use one of the following methods:

   • Click for the connection and select Stop.
   • Set the checkbox for the connection and click the Stop button.

This is a group operation: if necessary, you can delete several connections at once by setting the checkboxes.

1. Go to your VK Cloud management console.

2. Go to the Monitoring → Event log section.

3. Click the Settings button and go to the SIEM tab.

4. Delete the SIEM connection in one of the following ways:

   • Click for the connection and select Delete.
   • Set the checkbox for the connection and click the Delete button.

5. Confirm the deletion.