Documentation Center
AlienVault® USM Appliance™

FreeIPA

When you configure FreeIPA to send log data to USM Appliance, you can use the FreeIPA plugin to translate the raw log data into normalized events for analysis.

Device Details
Vendor FreeIPA
Device Type Network Access Control
Connection Type Syslog
Data Source Name freeipa
Data Source ID 1886

Integrating FreeIPA

Before you configure the FreeIPA integration, you must have the IP Address of the USM Appliance Sensor.

To configure FreeIPA to send Syslog messages to USM Appliance

  1. Add a new configuration file to be used by rsyslog in /etc/rsyslog.d/alienvault.conf.
  2. Open the file for editing and add the following line:

    *.* @<<USM-Appliance-Sensor-IP-Address>>:514

  3. Restart rsyslog.

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Additional Resources and Troubleshooting

https://www.freeipa.org/page/Howto/Centralised_Logging_with_Logstash/ElasticSearch/Kibana

For troubleshooting, refer to the vendor documentation:

https://www.freeipa.org/page/Troubleshooting