Up
Previous Next

Sheriff CSM™

WatchGuard XCS

When you configure WatchGuard XCS to send log data to Sheriff CSM, you can use the WatchGuard XCS plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:

Plugin Information

Device	Details
Vendor	WatchGuard
Device Type	Mail Server
Connection Type	Syslog
Data Source Name	Watchguard-xcs-mg
Data Source ID	1900

Integrating WatchGuard XCS

Before you configure the WatchGuard XCS integration, you must have the IP Address of the Sheriff CSM Sensor (Deputy).

To configure WatchGuard XCS to send log messages to Sheriff CSM

1. From the WatchGuard XCS web UI, select Configuration > Network > Interfaces.

2. In the Syslog Server field, enter the Sheriff CSM IP address.

3. Click Apply.

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Additional Resources and Troubleshooting

http://www.watchguard.com/help/docs/xcs/10/en-us/xcs_v10_0_userguide.pdf

For troubleshooting, refer to the vendor documentation:

http://www.watchguard.com/help/docs/xcs/10/en-US/xcs/index.html