Device Integration: Netwrix

TABLE OF CONTENTS

• Overview
• Prerequisites
• Steps for Syslog Integration
• Verification (MSSP Only)
  • Using ADR UI
  • Using CCE CLI
• References

Overview

Netwrix is an IT security and compliance solution that delivers visibility into changes, configurations, and access across hybrid IT environments. Integrating Netwrix with ADR SIEM provides centralized visibility, correlation, and proactive threat detection by ingesting security and audit logs into the ADR platform.

Prerequisites

• Administrative access to ADR UI.

• ADR CCE (Collection and Control Engine) deployed and accessible.

• Proper network connectivity and firewall rules to allow:

  • Syslog over UDP 514 (if using Syslog forwarding).

Steps for Syslog Integration

1. Log in to the Netwrix Console.

2. Navigate to: Log Forwarding / Syslog Settings.

3. Add a new Syslog server:

   • Server IP: Enter ADR CCE IP.

   • Protocol: UDP.

   • Port: 514.

   • Format: RFC 5424 or CEF (preferred).

4. Save and apply the configuration.

Verification (MSSP Only)

Using ADR UI

1. Log in to ADR UI.

2. Navigate to:
   System → Logs and Flows Collection Status.

3. Confirm that the Netwrix device IP appears under SOURCE DEVICE IP.

Using CCE CLI

Run the following commands on the CCE server:

• For Syslog logs:

  sudo tcpdump -i any port 514 and host <Netwrix_IP> -AAA