Hi All,
I'm new to PS but have been running RS for over a year now, we export syslog via webhooks on RS and PRA to our Rapid7 SIEM and it is working well, but I cannot seem to get it to work with PS. Any ideas?
Question
Export PS syslog to Rapid7 IDR
+4
You will need to the the “Universal Connector” as PS cannot send a webhook:
Universal Event Forwarder | BI
+4I have tried this and just get a failed to open connection.
Any ideas?
That's because you are using a webhook URL. The correct approach is to create an HTTP Connector within Rapid7 and associate a port, let's say 8085, with it. You would then use that port information in the connector settings. Webhooks have too many intricacies for the universal connector to work reliably.
You can check as well if the Resource Brokers associated with the “Default Zone” are able to connect to that url on that port as well, that might be your problem.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.