Veeam SIEM logs

[jround]

Does Veeam B&R provide the functionality to export logs to a SIEM system (We have recently implemented Logpoint) other than the basic ones logged under Windows Event Viewer?

We are currently running Veeam v10, not sure if v11 offers anything different

[chris.childerhose]

As far as I am aware there is no export option to SIEM or others like that. You can export logs but it is exported to ZIP format for attaching to cases, etc.

Would be very interesting to have this though.

[HannesK]

Hello,
what software are you using? Does that software have some "log file agent" that can just send everything from c:\programdata\veeam\... to your software? I used filebeat some time ago and would assume that similar options exist "everywhere".

Best regards,
Hannes

[chris.childerhose]

That is interesting and will check out that app. Need to find a way to move logs and this might be it.

[wishr]

Hi Chris,

Currently, there is no interface allowing you to get a complete security-related data, but this is something we are keeping in mind for the next product versions.

Thanks

[chris.childerhose]

That is great to hear. If this app works to get some logs over to a server to analyze that works for me for now. I typically use the log location anyway to look in to when I need.

[wishr]

Chris,

You should be good because as far as I see Logpoint is capable of consuming Windows Event Logs and for us it's a go to interface to providing that type of data.

The solution Hannes mentioned above may also work, but you may need to configure rules and parsing on your own to get security-specific information from the generic text logs. Also, keep in mind that we can change text logs in any version, which may break the existing rules.

Thanks

[chris.childerhose]

Thanks. I will look in to Logpoint as well.

[HangTen]

Hello. I just found this thread and am looking to see if the answers have changed in the past year. Thanks.

[Gostev]

Hello, we're working on adding syslog integration in the next minor release. Thanks!

[chris.childerhose]

That is going to be great Gostev. Looking forward to that for sure.

[haarloser]

Hello, we're working on adding syslog integration in the next minor release. Thanks!

Any idea when this will be released?
Kind Regards

[Gostev]

We plan to ship it before the end of this year.

[eeberg]

FYI to close the loop: syslog support shipped in 12.1 on December 5, 2023. Details and release notes available in KB4510: Release Information for Veeam Backup & Replication 12.1 and Updates.

Other details are available in a new section of the user guide.