Stormshield SNS

<div class="condensed-table">
| | |
| --- | --- |
| Version | 1.0.1 (View all) |
| Compatible Kibana version(s) | 8.11.4 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Elastic |

</div>
Stormshield Network Security (SNS) firewalls are a stable and efficient security solution to protect corporate networks from cyberattacks. Real-time protection (intrusion prevention and detection, application control, antivirus, etc.), control and supervision (URL filtering, IP geolocation, vulnerability detection, etc.) and content filtering (antispam, antispyware, antiphishing, etc.) all guarantee secure communications. All Stormshield Network Security firewalls are based on the same firmware, and with their core features, Stormshield Network Security firewalls give you comprehensive security and high performance network protection.

Use the Stormshield SNS integration to ingest log data into Elastic Security and leverage the data for threat detection, incident response, and visualization.

The Stormshield SNS integration collects audit, traffic, and connection (including NAT) logs. Available log types are available here .

Logs help you keep a record of events happening in your firewalls. The SNS integration handles activity logs and firewall (filter and NAT) logs. SNS can send realtime events and also periodic statistics audit logs. The dashboard is tailored to display results of the realtime events and not the statistics logs.

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

The SNS integration ingests logs via a syslog parser, so the SNS appliance needs to be configured to send syslogs to a listening Agent. This is configured in the CONFIGURATION tab, in the NOTIFICATIONS / LOGS-SYSLOG-IPFIX section. Please review the Stormshield documentation for details on how to configure syslog: https://documentation.stormshield.eu/SNS/v4/en/Content/Description_of_Audit_logs/Configure_logs.htm.

For step-by-step instructions on how to set up an integration, see the Getting started guide.

SNS can be configured to store all its logs locally, or to send them through the syslog protocol to a configured listener, such as the Elastic Agent via policy update.

{
    "@timestamp": "2024-03-08T10:14:08.000Z",
    "agent": {
        "ephemeral_id": "fbc0ca2c-7300-45ce-84b1-6ece2bc46905",
        "id": "e0b60804-99ad-435e-865c-35384901d186",
        "name": "elastic-agent-45518",
        "type": "filebeat",
        "version": "8.14.1"
    },
    "data_stream": {
        "dataset": "stormshield.log",
        "namespace": "65295",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "e0b60804-99ad-435e-865c-35384901d186",
        "snapshot": false,
        "version": "8.14.1"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "stormshield.log",
        "ingested": "2024-09-18T14:01:36Z",
        "original": "id=firewall time=\"2024-03-08 10:14:08\" fw=\"stormy-1\" tz=+0000 startime=\"2024-03-08 10:14:08\" error=0 user=\"admin\" address=192.168.197.1 sessionid=1 msg=\"PKI SEARCH scope=local type=ca\" logtype=\"server\"",
        "start": "2024-03-08T10:14:08.000Z",
        "timezone": "+00:00"
    },
    "input": {
        "type": "tcp"
    },
    "log": {
        "source": {
            "address": "172.27.0.3:40024"
        },
        "syslog": {
            "appname": "serverd",
            "facility": {
                "code": 1,
                "name": "user-level"
            },
            "hostname": "stormy-1",
            "priority": 13,
            "severity": {
                "code": 5,
                "name": "Notice"
            },
            "version": "1"
        }
    },
    "message": "PKI SEARCH scope=local type=ca",
    "observer": {
        "name": "stormy-1",
        "type": "firewall",
        "vendor": "Stormshield"
    },
    "related": {
        "user": [
            "admin"
        ]
    },
    "stormshield": {
        "fw": "stormy-1",
        "logtype": "server",
        "metadata": {
            "address": "192.168.197.1",
            "error": "0",
            "id": "firewall",
            "sessionid": "1"
        },
        "startime": "2024-03-08 10:14:08",
        "time": "2024-03-08 10:14:08"
    },
    "tags": [
        "preserve_original_event",
        "forwarded"
    ],
    "user": {
        "name": "admin"
    }
}