Device Integration: Versa Analytics

TABLE OF CONTENTS

• Overview
• Prerequisites
• Step-by-Step Guide
  • Step 1 – Log in to Versa Director
  • Step 2 – Navigate to Logging Configuration
  • Step 3 – Configure Syslog Server in Versa Director
  • Step 4 – Apply and Commit Configuration
  • Step 5 – Configure Syslog in Versa Analytics
• Verification (MSSP Only)
  • On ADR CCE Server
  • On ADR UI

Overview

Versa Analytics is a component of Versa Networks’ SD-WAN solution that provides in-depth monitoring, reporting, and analysis of network data. By integrating with ADR SIEM using Syslog, you can centralize Versa logs for comprehensive visibility, security event correlation, and proactive threat detection through the Collection and Control Engine (CCE) and Analytics and Policy Engine (APE).

Prerequisites

• Versa Director and Versa Analytics are deployed and operational.

• Administrative credentials for Versa Director and Versa Analytics.

• ADR CCE IP address.

• Syslog server (CCE) reachable over UDP port 514 (or TCP/TLS if configured).

• Syslog service (rsyslog, syslog-ng, etc.) enabled on the CCE.

Step-by-Step Guide

Step 1 – Log in to Versa Director

1. Open browser → https://<Versa_Director_IP>

2. Login with admin credentials.

Step 2 – Navigate to Logging Configuration

• Go to: Configuration → System → Logging Settings.

• Select the organization/tenant where you want to apply the Syslog settings.

Step 3 – Configure Syslog Server in Versa Director

1. Click Add Syslog Server.

2. Fill in:

   • Name → e.g., ADR-CCE.

   • IP Address → ADR CCE IP.

   • Port → 514 (default UDP).

   • Protocol → UDP (or TCP/TLS if required).

   • Log Format → RFC5424 (recommended) or RFC3164.

   • Logging Level → INFO or WARNING for production; DEBUG for troubleshooting.

   • Categories → Select as:

     • ✔️ alarm-type

       ✔️ sla-path-violation-log

       ✔️ threat-log 

       ✔️ anti-virus-log

       ✔️ secure-access-log

3. Save changes.

Step 4 – Apply and Commit Configuration

• Click Apply → then Commit to push the configuration.

Step 5 – Configure Syslog in Versa Analytics

1. Log in to Versa Analytics console.

2. Navigate to: Administration → Syslog Configuration.

3. Add the same Syslog server (CCE) details as above.

4. Save and Apply.

Verification (MSSP Only)

On ADR CCE Server

Run the following tcpdump to check logs are received:

sudo tcpdump -i any port 514 and host <Versa_IP> -s0 -AAA

On ADR UI

1. Login with admin credentials.

2. Navigate to: System → Logs and Flows Collection Status.

3. Verify that Versa device IP appears under Source Device IP.