IDS/IPS - Remote Syslog Contents

[eljeffeg]

Would be nice to have an option in the Remote Syslog Contents for the IDS/IPS sending to Syslog if possible.

[fichtner]

Yupp, we've recently enabled syslog by default in IDS... it's been a longer journey on this front due to the focus on eve logging. I'll add this as separate option... although sending all logs should already work on 18.1.4 and up if enabled in IDS.

[eljeffeg]

It would also be cool if we could get the IDS Alerts in a Dashboard Widget.

[tuwid]

@jeffg2k I was testing it manually and its possible to send the contents of /var/log/suricata/eve.log via syslog but this would require manually changing the config file here /etc/syslog.conf which suricata can potentially override.