Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configuring an SSH CryptoAuditor Appliance to Communicate with JSA

To collect SSH CryptoAuditor events, you must configure your third-party appliance to send events to JSA.

  1. Log in to SSH CryptoAuditor.
  2. Go to the syslog settings in Settings >External Services >External Syslog Servers.
  3. To create server settings for JSA, click Add Syslog Server.
  4. Type the JSA server settings: address (IP address or FQDN) and port in which JSA collects log messages.
  5. To set the syslog format to Universal LEEF, select the Leef format check box.
  6. To save the configuration, click Save.
  7. Configure SSH CryptoAuditor alerts in Settings >Alerts. The SSH CryptoAuditor alert configuration defines which events are sent to external systems (email or SIEM/syslog).

    1. Select an existing alert group, or create new alert group by clicking Add alert group.

    2. Select the JSA server that you defined earlier in the External Syslog Server drop box.

    3. If you created a new alert group, click Save. Save the group before binding alerts to the group.

    4. Define which alerts are sent to JSA by binding alerts to the alert group. Click [+] next to the alert that you want to collect in JSA, and select the alert group that has JSA as external syslog server. Repeat this step for each alert that you want to collect in JSA.

    5. Click Save.

  8. Apply the pending configuration changes. The saved configuration changes do not take effect until you apply them from pending state.