Device Integration: LinkProof

TABLE OF CONTENTS

• Overview
• Pre-requisites
• Configuration Steps on LinkProof
  • Step 1: Access the LinkProof Device
  • Step 2: Configure Syslog Forwarding
  • Step 3: Enable Relevant Events
  • Step 4: Save and Apply Configuration
• Verification of Configuration (MSSP Only)
  • On ADR CCE Server
  • On ADR SIEM UI

Overview

This guide provides the steps to integrate Radware LinkProof with ADR SIEM for centralized log collection and monitoring. Logs are forwarded directly from LinkProof to the Collection and Control Engine (CCE) via Syslog (UDP 514), enabling comprehensive visibility and proactive threat detection.

Pre-requisites

• Administrative access to Radware LinkProof GUI/CLI.

• ADR CCE server IP address.

• Ensure UDP port 514 is open between LinkProof and CCE.

• ADR SIEM platform deployed and reachable.

Configuration Steps on LinkProof

Step 1: Access the LinkProof Device

• Log in to the LinkProof management console (CLI or GUI) with admin privileges.

Step 2: Configure Syslog Forwarding

1. Go to Administration → Syslog Configuration.

2. Add the ADR CCE IP address as the Syslog server.

3. Set parameters:

   • Protocol: UDP

   • Port: 514

   • Facility: Local7 (recommended)

   • Severity Level: Informational (or as required)

Step 3: Enable Relevant Events

• Enable forwarding of security and system-related events.

• Ensure the following categories are enabled (recommended):

  • Authentication logs

  • Connection logs

  • System alerts

  • Failover events

Step 4: Save and Apply Configuration

• Save the changes in LinkProof.

• Restart the syslog service if required.

Verification of Configuration (MSSP Only)

On ADR CCE Server

Run the following command to check if logs are reaching:

sudo tcpdump -i any port 514 and host <LinkProof_IP> -n -vvv -A

If logs are visible, the syslog forwarding is successful.

On ADR SIEM UI

1. Log in to ADR UI with administrative rights.

2. Navigate to: System → Logs and Flows Collection Status.

3. Check that the LinkProof device IP appears under Source Device IP.