Forum Discussion
Jason_19901
Nimbostratus
NimbostratusAPM iRule to send information to NITRO SIEM
looking for an iRule that will capture the username/IP address when someone logs into APM and sends that to the SIEM. Also should include auth failures so I can set an alert for number of failed logins
2 Replies
AP_129594Kevin, Instead of having a pool of SIEM pool, how do I set my log to hit an individual SIEM IP address?
set hsl [HSL::open -proto UDP -pool syslog-ubuntu-pool]
Thanks
- boneyard
MVP
HSL doesn't support that, you could work with HSL::open -publisher from 11.3 if you can configure a publisher.
but why cant you create that pool and put one member in it?
