configuring integration of SentinelOne to NXLog via SSL/TLS

View thread

jake

Hi we wanted to send logs coming from SentinelOne to Google Chronicle using SSL/TLS NXlog. We are just using the Community Edition and based on the documentation SSL/TLS is supported for CE. But we are not sure if this is going to work or how to configure the “CAFile", “CertFile”, “CertKeyFile” thing for this to work or how do we install it? Is it free or paid? Please check the configuration we wanted to implement below.

 

<Input ssl> 

Module im_ssl 

Host localhost 

Port 6514 

CAFile %CERTDIR%/ca.pem 

CertFile %CERTDIR%/client-cert.pem 

CertKeyFile %CERTDIR%/client-key.pem 

KeyPass secret 

InputType Syslog_TLS 

Exec parse_syslog_ietf(); 

</Input>