Device Integration: ISILON

Table of Contents

• Overview
• Prerequisites
• Steps to Configure Syslog on Isilon
  • Using WebUI
• Verification (MSSP Only)
  • On CCE Server
  • On ADR UI

Overview

Dell EMC Isilon is a scale-out NAS storage system that provides enterprise-grade file storage. By integrating Isilon with ADR SIEM via syslog, administrators can centralize monitoring of system events, authentication attempts, and security logs. The logs are pushed directly from Isilon to the CCE (Collection and Control Engine) and processed by the APE (Analytics and Policy Engine) for visibility and proactive threat detection.

Prerequisites

• Administrative access to the Isilon OneFS WebUI or CLI.

• CCE IP address for log forwarding.

• Ensure UDP port 514 is open between Isilon and ADR CCE.

• ADR CCE server is reachable from the Isilon system.

Steps to Configure Syslog on Isilon

Using WebUI

1. Log in to Isilon OneFS WebUI as an administrator.

2. Navigate to:
   Cluster Management → Events and Alerts → Syslog Settings

3. Click Add Syslog Server.

4. Enter the following details:

   • Syslog Server: Enter the CCE IP address.

   • Protocol: UDP (default).

   • Port: 514 (default).

   • Facility: Choose an appropriate facility (e.g., local0).

   • Severity Level: Recommended → Informational or higher.

5. Save and apply the configuration.

Verification (MSSP Only)

On CCE Server

Run:

sudo tcpdump -i any port 514 and host <Isilon_IP> -s0 -AAA

You should see syslog packets arriving from the Isilon system.

On ADR UI

1. Log in to ADR UI.

2. Navigate to: System → Logs and Flows Collection Status.

3. Confirm the Source Device IP (Isilon) is visible and logs are ingested.