What is a SIEM; what does sending TR7 logs to a SIEM provide?

Short answer

SIEM (Security Information and Event Management) is the system that collects security and event logs coming from different sources in a single center, relates them to each other with correlation rules and produces alarms (NIST CSRC); Splunk, QRadar and ArcSight are products of this kind. Sending TR7 logs to a SIEM provides central monitoring and correlation together with other systems, real-time alerts with SIEM rules, long-term retention independent of the device capacity, and a separate copy of the audit trails outside the device (Log Forwarding · What Is It For?). In TR7, device logs are sent with Log Forwarding, vService access and WAF logs with the Logs profile assigned to the vService, and AGS audit events with the AGS Log Forwarding profile, all over Syslog. The fields with which WAF attack information is sent are determined in the SIEM & Attack Details card in WAF Management.

Where It Is Used in TR7

Where	Field / label	What for
Settings → General Settings → Log Forwarding	Log Sources (User Logs, Notification Logs, GTM Logs, Health Check Logs), Message Format	Sending user, notification, GTM and health check logs to the SIEM
Load Balancer → Profiles → Logs	Line Format: CEF Format, TR7 JSON Format, TR7 WAF Log	Sending vService access logs and WAF attack information in a format the SIEM can parse
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management	SIEM & Attack Details card: Attack Details in WAF Info, Attack Payload in WAF Info, WAF Info Language	Determining the fields, the payload and the language of the attack information (WAF info) added to the log line
AGS → Integrations → Log Forwarding	Log Forwarding profile	Sending AGS audit events (login, MFA, lockout, session) to the SIEM

• Sending WAF logs to a SIEM: How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)? · Only attack records: Can I send only attack records to the SIEM?
• Log formats: What is CEF (Common Event Format); which TR7 logs can be sent in CEF format?

Common Misconceptions

• "TR7 is a SIEM in itself." TR7 produces logs, shows them on the device and sends them; the correlation of different sources and long-term analysis are done on the SIEM side.
• "A single setting sends all logs to the SIEM." Device logs, vService access and WAF logs, and AGS audit events are sent from three separate screens.
• "The SIEM & attack details card sends logs to the SIEM." The card determines only the content of the attack information; the sending is done by the Logs profile assigned to the vService, and if no profile is assigned, the attack information goes nowhere.

How it is done in the documentation

• Log Forwarding · What Is It For?
• Logs profile · SIEM Integration
• SIEM & Attack Details
• AGS · Log Forwarding

Related questions

• How do I send logs to a SIEM (Syslog)?
• How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?