SNMP Trap and Syslog Event Forwarding | BI

BeyondInsight, Discovery Scanner, Password Safe, and Endpoint Privilege Management products can forward the following:

• SNMP traps using versions 1, 2, or 3
• Events through a syslog daemon

With this forwarding function, it is feasible to integrate critical event information directly into a NMS, SIM, NAC, or other log consolidation, or event management systems.

A standard SNMP MIB, EEYE-REM_EVENT-MIB.MIB, is available for decoding traps at the destination and is located at C:\Program Files (x86)\BeyondTrust\BeyondInsight. On a U-Series Appliance with Server 2016, the path is slightly different: either C:\Program Files (x86)\eEye Digital Security\Retina CS, or C:\Program Files (x86)\Security Scanner\Help\Snmp\.

ℹ️

This MIB is valid for BeyondInsight and Discovery Scanner.

You can configure SNMP and syslog event forwarding settings from the Connectors page. Both protocols work for all data aggregated by BeyondInsight and Discovery Scanner.

Enable SNMP event forwarding (On-premises only)

1. In BeyondInsight, go to Configuration > General > Connectors.

2. From the Connectors pane, click Create New Connector.

   

3. Enter a name for the connector.

4. Select SNMP Event Forwarder.

5. Leave Active (yes) enabled.

6. Select an Available Formatters. Available options are: SNMP v1 Format, SNMP v2 Format, SNMP v3 Format.

7. Provide a Security Name.

8. Provide the Authentication Protocol. In version 26.2, SHA‑256 and SHA‑512 are available options.

9. Provide the Authentication Password.

10. Select a Privacy Protocol from the dropdown box.

11. Provide a Privacy Password.

12. Select the Event Filters you want to trap.

13. Click Test Connector to send a test event message.

14. Click Create Connector.

Enable Syslog event forwarding

1. In BeyondInsight, go to Configuration > General > Connectors.
2. From the Connectors pane, click Create New Connector.
3. Enter a name for the connector.
4. Select Syslog Event Forwarder under Connector Type.
5. Click Create Connector to open Syslog Event Forwarder pane.
6. Leave Active (yes) enabled.
7. Provide the required details for the syslog server:
   • Select the Available Output Pipeline:TCP, TCP-SSL, or UDP.
   • Enter Host Name and Port.
8. Select an output format: NewLine Delimited, Tab Delimited, or Comma Delimited.
9. Select an optional syslog Facility from the list.
10. Select Format Specification.
11. Select the events that you want to forward.
12. Click Test Connector to determine if event is successful.
13. Click Create Connector.

ℹ️

If an event is received from Password Safe Cloud, a Resource Zone can now be associated with any connector that sends data using syslog. If selected, Password Safe Cloud proxies the syslog data through the Resource Brokers associated with that Resource Zone.