Skip to main content

AQUILA - Varonis (DLP) Integration

Purpose

This document outlines the procedure to integrate Varonis DatAlert or DatAdvantage with a SIEM platform using Syslog (CEF). The integration provides visibility into sensitive data access, permissions changes, and threat alerts.

Prerequisites

  • Admin access to Varonis DatAlert Console

  • IP address and port of your SIEM/syslog collector

  • Network/firewall access from Varonis to SIEM (UDP or TCP port open)

  • (Optional) CEF parsing support in your SIEM

Step 1: Configure Varonis DatAlert for Syslog Server in Varonisforwarding

  1. Log in to the Varonis DatAlert Console.

  2. Navigate to:
    Tools → DatAlert → Configuration → Syslog

  3. Click Add Syslog Server.

  4. Input the following:

    • Server Name: Descriptive name (e.g., CinchSyslog)AquilaSyslog)

    • IP Address: Your SIEMAQUILA or Cinchlog collector IP

    • Port: Common options: 514, 9035, or 1165610514

    • Protocol: Choose UDP or TCP (enable encryption if needed)

    • Message Format: Choose CEF

  5. Click SaveApply.

Step 2: Set Up anCreate Alert Template in Varonis DatAlert

  1. Go to:
    Tools → DatAlert → Templates

  2. Click New Template or edit an existing one..

  3. Enter:

    • Template Name: e.g., “AQUILA Syslog CEF Export”Export”

    • Description: Template for sending alerts to SIEMAQUILA

  4. In the Alert Outputs section:

    • Check Syslog Message

    • Choose the syslog server created in Step 1

  5. Set the Message Format to External system default template (CEF)

  6. Click Save TemplateOK.

Step 3: Enable Alerts to Send via Syslog

  1. Navigate to:
    DatAlert → Rules

  2. Select a rule (e.g., “Mass file access” or “Sensitive File Access”)

  3. Click Edit on the rulerule.

  4. Go to the Outputs section:

    • Check Syslog Message

    • Assign your custom template (e.g., “Syslog CEF Export”)

  5. Click SaveSave.

  6. Repeat for each alert rule you want to forward to your SIEM

Step 4: Configure Your SIEM to Ingest LogsAQUILA.

  1. Create a new log source or syslog input:

    • Source Type: Syslog (TCP/UDP)

    • Port: Match what you configured in Varonis

    • Log Format: CEF (or Custom parser for Varonis CEF)

  2. Create a parser to extract CEF fields:

    • Example fields: suser, src, filePath, act, deviceSeverity

    • Many SIEMs (like Splunk, Elastic, QRadar) include CEF parsers

Step 5: Test and Validate

  1. Simulate an alert in Varonis (e.g., access a sensitive file or trigger a test alert).

  2. Check your SIEM/Cinch logs for messages like: 
    CEF:0|Varonis|DatAlert|1.0|100|Sensitive File Access|10|src=10.0.1.15 suser=john.doe filePath=\\server\hr\payroll.xls act=access

  3. Confirm:

    • Syslog message is received

    • Parsed fields are correct

    • Alerts or dashboards are populating as expected

(Optional) Step 6: API Integration for Enrichment

Varonis also offers a REST API for:

  • User activity reports

  • File system access logs

  • Sensitive data classification results

For enrichment:

  1. Obtain API credentials from Varonis admin portal

  2. Poll /api/alerts, /api/files, or /api/permissions

  3. Ingest results into your SIEM/Cinch as contextual data

Please provide the following information to CyTech Support: 

  • IP Address

  • Port Address

  • Protocol (TCP or UDP)

 

 

If you need further assistance, kindly contact our support at support@cytechint.com for prompt assistance and guidance.

 

Back to top