Cyberoam monitoring with ManageEngine Log360

Overview

Cyberoam unified threat management appliances, now integrated into the Sophos XG Firewall portfolio, have been widely used for comprehensive network security, including firewalls, VPNs, intrusion prevention, and web filtering. The security logs generated by Cyberoam devices are vital for understanding network activity, detecting threats, and ensuring compliance. ManageEngine Log360, a robust SIEM solution, seamlessly integrates with Cyberoam devices to centralize, correlate, and analyze this critical log data. This integration provides security teams with real-time visibility, compliance-ready reporting, and proactive threat detection, all within a unified console.

How Log360 collects and analyzes Cyberoam logs

• Log collection: Log360 collects logs from Cyberoam devices using the syslog protocol. Simply configure your Cyberoam device to forward its logs to the Log360 syslog listener.
• Real-time monitoring: All relevant events—including those for traffic, authentication, firewall rules, and IDSs and IPSs—are monitored in real time and sent to the Log360 SIEM engine.
• Parsing and normalization: Once the logs are received, Log360 uses predefined rules specific to Cyberoam to parse and normalize the data.
• Metadata extraction: Key information like source and destination IP addresses, usernames, ports, and severity levels is extracted and indexed.
• Analysis and correlation: This structured data is then mapped to Log360's security event taxonomy, which enables both a detailed, granular analysis and high-level correlation of events.

Monitoring and analytics capabilities

With Cyberoam logs onboarded, Log360 provides layered monitoring and analytics through:

• Cyberoam event overviews: Aggregate and monitor all Cyberoam-generated log types in a unified view. Filter logs by severity, source, interface, and rule ID to assess firewall health quickly and activity trends.
• Logon reports: Track successful and failed login attempts to the Cyberoam management interface and user authentication portals. Identify unusual access patterns, such as logins during non-business hours or multiple failed attempts from the same IP—key indicators of brute-force or credential stuffing attempts.
• Firewall rule management: Monitor rule creation, deletion, modifications, and rule hits, ensuring a complete audit trail of all firewall policy changes and their impact.
• Account management: Audit admin user creation, role changes, and unauthorized configuration attempts on Cyberoam devices.
• Bandwidth monitoring and traffic analysis: Gain insights into network traffic patterns, bandwidth usage, and employee internet usage. Identify bandwidth-guzzling applications or users and fine-tune firewall policies for optimized performance.
• VPN monitoring: Track VPN connection trends, including successful and failed connections, to troubleshoot VPN issues and identify potential security risks.
• Long-term archival and compliance: Retain normalized logs for an extended duration to meet various compliance mandates, such as the PCI DSS, the GDPR, and HIPAA, with prebuilt and custom reports tailored to these standards.

Critical Cyberoam events monitored

Log360 continuously audits a range of Cyberoam event categories:

• Authentication events: Successful and failed user and administrator logon attempts, remote management access, and VPN authentication events
• Traffic events: Accepted and denied traffic by firewall policy, NAT translations, and protocol-specific patterns, providing visibility into network flow
• IDS and IPS events: Signature matches, packet inspections, and real-time intrusion detections, highlighting potential attack attempts
• System events: Device restarts, service failures, and disk usage thresholds, indicating operational health and potential vulnerabilities
• Device severity reports: Categorized events by severity (e.g., info, warning, critical, or emergency), aiding in prioritizing alerts and incident response.

Key benefits

• Centralized visibility: View Cyberoam logs alongside logs from other network and security devices within a single, unified interface.
• Faster threat detection: Quickly identify and respond to attacks, like brute-force attempts, unauthorized access, or policy violations.
• Audit trail of firewall activity: Gain accountability with detailed reports on rule changes, access attempts, and administrator activity.
• Regulatory compliance: Meet audit requirements with prebuilt and custom reports mapped to various compliance standards.
• Simplified investigation: Use incident timelines and context-rich log views to investigate security incidents with minimal effort.

Addressing key Cyberoam security challenges

Ready to enhance your Cyberoam security posture?

Discover the full range of Cyberoam monitoring capabilities and use cases within Log360.