Support of Work with Security Information and Event Management Systems

Foresight Analytics Platform supports work with security information and event management systems (SIEM systems).

A ready solution based on Foresight Analytics Platform can be integrated via an application system using a tool for real time analysis of running events and timely response to security threats in information systems.

NOTE. SIEM systems are not included in the software package of Foresight Analytics Platform.

SIEM systems are based on the concept that information system security data is collected from different sources, and the result of data processing is displayed in an unified interface that is available for security data analysts, which makes it easier to analyze characteristics that are inherent to security incidents.

One of the main objectives of SIEM systems use is increasing information security in the existing architecture by ensuring the ability to operate security information and execute anticipatory management of incidents and security events almost in real time.

Work with security information and event management systems is aimed at solving the following tasks:

• Collection, processing and analysis of security events received by the system from various sources.

• Detection of attacks and violations of security criteria and policies in real time.

• Timely assessment of degree of security of information, telecommunication and other critically important resources.

• Analysis and management of security risks.

• Investigation of incidents.

• Taking effective information protection solutions.

• Creation of reporting documents.

An access protocol can be used for integration.

A security information and event management system is installed and set up by the system administrator.

A security information and event management is deployed in the environment. When planning and deploying an application, the environment system administrator must use administrator guides provided by corresponding SIEM system vendors.

Integration with third-party SIEM systems is supported via CEF files and forwarding CEF security event messages in real time via the syslog protocol.

Security Auditing Log Import to SIEM Systems

The security auditing log of Foresight Analytics Platform is stored in a database in internal format.

To export the file, use the security manager or the task scheduler.

• In the security manager:

1. Open the security manager as an administrator.

2. Go to the Access Protocol tab.

3. Save the access protocol to file:

• In the desktop application select the Access Protocol > Save to File > Full Protocol/Current View main menu item.

• In the web application click the Export button on the toolbar.

The standard dialog box opens, in which specify:

• File name.

• File type. To export the full protocol, select the Access Protocol Files (*.cef) type. To export the current view, select the CEF (*.cef) type.

• File location.

4. Click the Save button.

• In the task scheduler:

1. Create a Fore unit using the IAuditLog.Archive or IAuditLog.ArchiveToDate methods.

2. Create a assembly execution task, specify the created unit and set up task execution frequency.

3. Start the task for execution.

Then set up file import by means of SIEM server.

For details about creating an event parsing decoder see the Example of Data Import to Wazuh article.

Forwarding CEF Security Event Messages in Real Time via the syslog Protocol

To forward auditing messages to syslog server, set up:

• The settings.xml file.

• System registry.

The priority of settings search:

1. settings.xml.

2. The [HKEY_CURRENT_USER] key.

3. The [HKEY_LOCAL_MACHINE] key.

If the SysLogServer section has been found during the search in the source, it is assumed that settings are read successfully event if the section is empty or contains incorrect records. Other sources are not searched. If any of parameters is absent in the source, default values are taken:

Active = False

Host = 127.0.0.1

Port = 514

Protocol = 0

CEF Event Format used in Foresight Analytics Platform

The CEF file consists of a set of events, each event is written as a text string. An event corresponds to a certain operation executed in the repository. An event string consists of a title and a set of fields. The title starts from CEF:0| and ends with |AuditLog|Unknown|. Depending on the executed operation, one can use a full or short list of fields. The following fields are available in operations:

• act. Event (operation).

• cs1Label. It is always set to MetabaseId.

• cs1. Repository identifier.

• rt. Date and time of event generation.

• outcome. Operation execution result. Available values: Success, Failure.

• shost. Workstation.

• suser. OS user.

• cs2Label. It is always set to PlatformUser.

• cs2. Foresight Analytics Platform user. The field is empty if the logon failed, the field value: outcome = Failure.

• cs3Label. It is always set to IPAddresses.

• cs3. Set of IP addresses.

• cs4Label. It is always set to ObjectName.

• cs4. Object name.

• cs5Label. It is always set to ObjectId.

• cs5. Object identifier.

• cs6Label. It is always set to AccessLevel. The field is available if mandatory access control method is enabled.

• cs6. Access level. The field is available if mandatory access control method is enabled.

• msg. Event comment. The field can be empty.

List of available operations:

See also:

System Requirements

Copy page URL

Back to top

To report a found bug, please select the text with the bug and click Report a Bug or CTRL+ENTER.

Help system 10.9 of 26/11/2025, © FORESIGHT