Integrating WatchGuard Firebox Firewall

To integrate WatchGuard Firebox Firewall, do one of the following procedures, below:

To configure your Firebox to send log messages to a syslog or QRadar server, from Fireware Web UI
To configure your device to send log messages to a syslog or QRadar server, from Policy Manager

Then:

To use WatchGuard's instructions, click here.

In Fireware Web, select System > Logging.
The Logging page appears.
Click the Syslog Server tab.
Select the Send log messages to these syslog servers check box.
Click Add.
The Syslog Server dialog box appears.
In IP Address text, type the server IP address.
In Port, type the default syslog server port (514).
In the Log Format drop-down list, select Syslog.
The details you can include in the log messages depend on the log format you select.

The Syslog Server settings for the syslog log format.
(Optional) In Description, type a description for the server.
(Syslog log format only) To include the date and time that the event occurs on your Firebox in the log message details, select the The time stamp check box.
To include the serial number of the Firebox in the log message details, select the The serial number of the device check box.
In the Syslog Settings section, for each type of log message, leave the default syslog facility from the drop-down list.
For high-priority syslog messages, such as alarms, these would be considered Local0 (lower numbers have greater priority).
To restore the default settings, click Restore Defaults.
Click Save.

To use WatchGuard's instructions, click here.

In Policy Manager, select Setup > Logging.
The Logging Setup dialog box appears.
Select the Send log messages to these syslog servers check box.
Click Add.
The Configure Syslog dialog box appears.
In IP Address, type the Barracuda XDR Sensor IP address.
In Port, leave the default syslog server port (514).
From the Log Format drop-down list, select Syslog.
The details available to include in the log messages depend on the log format you select.

The Configure Syslog dialog box for the Syslog log format.
(Syslog log format only) To include the time stamp information from your Firebox in the log message details, select the The time stamp check box.
To include the serial number of the Firebox in the log message details, select the The serial number of the device check box.
For each type of log message, select a syslog facility.
For high-priority syslog messages, such as alarms, these would be considered Local0 (lower numbers have greater priority).
To restore the default settings, click Restore Defaults.
Click OK to close the Configure Syslog dialog box.
Click OK to close the Logging Setup dialog box.
Save the configuration file.