Sidewinder Firewall

Release Details

Package Details

The application consists of the following components:

1. Dashboard Package
   
   • LP_Sidewinder Firewall 
2. Normalization Package
   
   • LP_Sidewinder Firewall 
3. Compiled Normalizer
   • SidewinderFirewallCompiledNormalizer

Enhancement

A minor update has been done in the application’s normalizer for better signature handling. 

Installation 

Follow these steps to install the Sidewinder Firewall v3.3.0 plugin:

1. Download the  Sidewinder Firewall package from the Download section above.
2. Add  Sidewinder Firewall as the required device in LogPoint.
3. Create a collection policy with the Syslog collector and appropriate processing policy. 
4. Assign the policy to the device.
5. Add the Dashboard.

Screenshots

Supported Device

The supported device of Sidewinder Firewall with LogPoint in this configuration is:

• Sidewinder Firewall 

Log Format

Expected Log Format

Key = Value separated by a comma

Log Sample

Oct 24 03:03:55 hostname.com.au auditd: date="Oct 23 17:03:55 2008 GMT",fac=f_mail,area=a_server,type=t_attack,pri=p_major,pid=11945,ruid=0,euid=0,pgid=1787,logid=0,cmd=sendmail,domain=mta1,edomain=mta1,hostname=hostname.com.au,event=access deny,srcip=1.1.1.1,srcburb=outside,attackip=2.2.2.2,attackburb=outside,queueid=m9NH3tOH011945,reason="Sendmail determined that this session is not allowed.",information="550 5.7.1 TrustedSource determined this IP address is untrusted. Reputation value: 0.0.0.10

To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.