A local IT can have a Security Information and Event Management (SIEM) system that collects and analyzes events within the network, to gain insight into what is happening within the factory. The IXON edge gateway can be configured to send its system events to a syslog server so that it can be used in such SIEM system.

Which events are sent and how?

Once it's configured, the edge gateway will send any new system event in real-time to the configured syslog server. System events that already happened will not be sent. The syslog protocol standard RFC 5424 is used.

The following types of events are sent:

• Network events: DHCP leases, wireless reconnects, etc.
• Connection events to IXON Cloud: VPN and MQTT (re)connects.
  • This does not include users that remotely connect to the edge gateway. Those type of events are not events in the edge gateway and are therefore not included.
• Audit events: Digital Input events and local web interface events including login, configuration changes, user management, and downloading the log archive.
• Cloud event: configuration changes pushed from the IXON Cloud.
• Machine data logging errors.

The messages are unstructured, meaning one message may have a different structure than another.

Events that are not listed above are NOT sent. This includes but is not limited to Docker container logs.

Instructions

1. Make sure that your edge gateway meets the supported hardware at the top of this article.
2. In your SIEM system, create an ingestion endpoint for the syslog protocol.
   • If you wish to encrypt the communication, arrange for a TLS certificate chain. The corresponding CA certificate will be needed later.
3. Connect locally to one of the LAN ports of the edge gateway or set up a VPN connection.
   • The local web interface is not accessible from the WAN side (Cloud port and also OT/LAN port when it's configured as WAN2).
4. Open a new browser tab, go to the edge gateway's LAN IP address, and log in.
   • The default LAN IP address is 192.168.140.1.
   • If you're connecting locally, make sure that your laptop has an IP address in the same range. You may need to configure this manually. There are many online guides on this if you need a step by step guide.
   • The default username is admin.
   • The default password (PW) is printed on the side of the edge gateway.
   • The number of login attempts is limited per time window, in compliance with cybersecurity standard IEC 62443-4-2. By default, the number of login attempts is limited to 5 per 1 minute, replenishing a login attempt every 1 minute. We recommend you configure this to align with your corporate security policy. Do so by logging in and going to Administration > Authentication.
   • You can change the password by logging in and going to Administration > Change password.
5. Go to Logs.
6. Under Remote syslog, enter the requested information (details below) and click on Submit changes.

   Field	Description
   Host	Enter the IP address or hostname of your syslog server.
   Port	Enter the port of your syslog server.
   Certificate	(optional) If you created a TLS certificate chain earlier at step 2, open the corresponding CA certificate in a text editor and enter the content here.