Device Integration: GTB DLP

TABLE OF CONTENTS

• Overview
• Pre-Requisites
• Steps to Configure Syslog on GTB DLP
• Verification
  • On CCE Server
  • On ADR SIEM UI

Overview

This guide provides step-by-step instructions to configure GTB DLP (Data Loss Prevention) to forward logs to the ADR Collection and Control Engine (CCE) using Syslog.
Syslog integration ensures that GTB DLP events are forwarded in real-time for centralized monitoring, compliance, and proactive threat detection within ADR SIEM.

Pre-Requisites

• Administrative access to the GTB DLP console.

• ADR CCE server deployed and reachable.

• UDP port 514 allowed between GTB DLP and the ADR CCE server.

• Syslog push mechanism (no configuration required on ADR UI for Syslog ingestion).

Steps to Configure Syslog on GTB DLP

1. Log in to GTB DLP Admin Console

   • Open a browser and log in with administrator credentials.

2. Navigate to Syslog Configuration

   • From the dashboard, go to:
     Administration → System Settings → Syslog Settings

3. Enable Syslog Forwarding

   • Check Enable Syslog option.

4. Add Syslog Server Details

   • Enter the following details:

     • Syslog Server IP: Enter the ADR CCE IP.

     • Protocol: Select UDP.

     • Port: Enter 514.

     • Facility: Select appropriate facility (default = LOCAL0).

     • Severity/Level: Recommended = Informational or Warning.

5. Select Event Categories

   • Enable the event types you want to forward:

     • Policy violations

     • Endpoint violations

     • Network events

     • Alerts/Incidents

6. Save and Apply

   • Click Save and then Apply Changes.

7. Test Connection

   • Use the Test Syslog button (if available) to verify that logs can be forwarded successfully.

Verification (MSSP O

On CCE Server

Run the following command to confirm that logs are arriving:

sudo tcpdump -i any port 514 and host <GTB_DLP_IP> -AAA

On ADR SIEM UI

1. Log in to ADR UI with administrative rights.

2. Navigate to: System → Logs and Flows Collection Status.

3. Verify that the Source Device IP (GTB DLP IP) is visible and logs are being ingested.