# Sonicwall firewall SIEM **URL:** \ **Category:** Elastic Security\ **Created:** [October 6, 2020, 10:18am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102 "2020-10-06T10:18:45Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![arturo.mj](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Post date:** [October 6, 2020, 10:18am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/1 "2020-10-06T10:18:45Z")
Hi there, I have already connected my Sonicwall firewall to Elastic Cloud (I'm in the trial). I can see the logs in Kibana, but Elastic Security SIEM doesn't recognize the Firewall as a host, so I it doesn't get the logs inside the security app. Here is a log seen from Kibana, I think the ECS format is correct. Any ideas? Thanks! ![Screenshot_2020-10-06 Discover - Elastic](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a9b5263612f08803aeed3dfc33102cf9853f45f.png) ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 6, 2020, 10:25am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/2 "2020-10-06T10:25:45Z")
Make sur your index pattern in included in SIEM default indexes ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67a631d12199916be5baeba28aa4935bf6ee2e90.png) ---
**Author:** ![arturo.mj](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Post date:** [October 6, 2020, 10:57am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/3 "2020-10-06T10:57:15Z")
Yes, I knew about that and I think I have it in the correct way: apm-_-transaction_, auditbeat-_, endgame-_, filebeat-_, logs-_, packetbeat-_, winlogbeat-_ As the Sonicwall log comes from Filebeat, with the "filebeat-\*" should be enought. Isn't it? ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 6, 2020, 11:06am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/4 "2020-10-06T11:06:55Z")
That should work, except if you are using differents spaces in Kibana ---
**Author:** ![arturo.mj](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Post date:** [October 6, 2020, 11:17am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/5 "2020-10-06T11:17:47Z")
As you can see, Filebeat is not getting logs from Sonicwall to the Security app, maybe there is some way to activate the Sonicwall module in order that sends the logs also here... ![Screenshot_2020-10-06 Overview - Kibana](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c59bbb3e22c59d01137ba136508ef73f901d868d.png) ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 6, 2020, 11:31am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/6 "2020-10-06T11:31:57Z")
Did you used [filebeat](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-sonicwall.html) module ? As per the first screenshot logs are already shiped to elasticsearch in ECS format with filebeat ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 6, 2020, 11:40am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/7 "2020-10-06T11:40:48Z")
You logs are already in the SIEM ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/164f6062e6ce2f8513c926afeb55c3f59f3e4bde.png) ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 6, 2020, 11:42am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/8 "2020-10-06T11:42:20Z")
The UI is static and show only 5 popular modules ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/0/603d5b410c4b0543283f5cbabb67a5c3da9603d9.png) ---
**Author:** ![arturo.mj](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Post date:** [October 6, 2020, 12:05pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/9 "2020-10-06T12:05:54Z")
Yes. But as you can see here it doesn't get the info in the right way. Here there is a failed login attemp log, and Elastic doesn't understand it as it should. ![Screenshot_2020-10-06 Hosts - Kibana](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4c1a0d494be21c68269a2a79841903cd29c7a7a4.png) ![Screenshot_2020-10-06 Hosts - Kibana(1)](https://us1.discourse-cdn.com/elastic/original/3X/d/b/db58a9f1d85e4f76b7515797dc080bab60318085.png) ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 6, 2020, 12:16pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/10 "2020-10-06T12:16:52Z")
I see your point, filebeat module is not dessecting the field "event.original" As the module is still not GA, you may need to add an ingest pipleline to parse correctly the field "event.original" into ECS schema ---
**Author:** ![arturo.mj](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Post date:** [October 6, 2020, 1:05pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/11 "2020-10-06T13:05:52Z")
Yep. I don't really know how to do that. It's a bit awkward that a brand like Sonicwall is not supported by default in the correct way... ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [October 7, 2020, 10:10am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/12 "2020-10-07T10:10:36Z")
Can you share the whole document in JSON format? ---
**Author:** ![arturo.mj](https://avatars.discourse-cdn.com/v4/letter/a/ee7513/32.png) [@arturo.mj](https://discuss.elastic.co/u/arturo.mj)\ **Post date:** [October 7, 2020, 10:24am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/13 "2020-10-07T10:24:49Z")
You mean a JSON from a log? ``` { "_index": "filebeat-7.9.1-2020.09.09-000001", "_type": "_doc", "_id": "OKKVAnUBaCqgQQ66e0OD", "_version": 1, "_score": null, "_source": { "rsa": { "internal": { "messageid": "745" }, "time": { "event_time": "2020-10-07T10:22:31.000Z" } }, "agent": { "hostname": "siem", "name": "siem", "id": "9b49d7b1-c42e-45d2-8316-6265a15f3edf", "type": "filebeat", "ephemeral_id": "25f87cfd-17d3-4a8e-a438-c6187df89f6f", "version": "7.9.1" }, "log": { "source": { "address": "XXXXX:514" }, "syslog": { "severity": { "code": 6 }, "priority": 110, "facility": { "code": 13 } } }, "fileset": { "name": "firewall" }, "tags": [ "sonicwall.firewall", "forwarded" ], "observer": { "product": "Firewalls", "vendor": "Sonicwall", "type": "Firewall" }, "input": { "type": "udp" }, "@timestamp": "2020-10-07T10:22:31.000Z", "ecs": { "version": "1.5.0" }, "service": { "type": "sonicwall" }, "event": { "code": "745", "original": "<110> id=firewall sn=XXXXX time=\"2020-10-07 10:22:31 UTC\" fw=XXXXX pri=6 c=16 m=745 msg=\"User login denied - LDAP authentication failure\" sess=\"Web\" n=10209 usr=\"admin\" src=XXXXX:63880:X1 dst=XXXXX:443:X1 proto=tcp/https note=\"admin\" fw_action=\"NA\"", "module": "sonicwall", "dataset": "sonicwall.firewall" } }, "fields": { "rsa.time.event_time": [ "2020-10-07T10:22:31.000Z" ], "@timestamp": [ "2020-10-07T10:22:31.000Z" ], "suricata.eve.timestamp": [ "2020-10-07T10:22:31.000Z" ] }, "highlight": { "event.code": [ "@kibana-highlighted-field@745@/kibana-highlighted-field@" ] }, "sort": [ 1602066151000 ] } ``` ---
**Author:** ![lahiru962](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@lahiru962](https://discuss.elastic.co/u/lahiru962)\ **Post date:** [May 6, 2022, 11:56am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/14 "2022-05-06T11:56:55Z")
I also have the same issue, is there any way to resolve this issue? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 10, 2022, 1:27pm UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/15 "2022-05-10T13:27:52Z")
We are currently working on an improved integration for Sonicwall firewalls that will solve these kind of issues. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:14am UTC](https://discuss.elastic.co/t/sonicwall-firewall-siem/251102/16 "2022-11-04T08:14:45Z")