Add-PASPTASyslog
Add-PASPTASyslog
SYNOPSIS
Add a SYSLOG configuration to PTA
SYNTAX
Add-PASPTASyslog [-siem] <String> [-format] <String> [-host] <String> [-port] <Int32> [-protocol] <String>
[[-CertificateFile] <String>] [-syslogType] <String> [-tcpOctetCounting] <Boolean> [-WhatIf] [-Confirm]
[<CommonParameters>]
DESCRIPTION
Add a new SYSLOG configuration to PTA
This API is not officially documented, so this help file may not help 100%
EXAMPLES
Example 1
Add-PASPTASyslog -siem SomeSIEM -format CEF -host SOMEHOST.domain.com -port 514 -protocol UDP -syslogType SomeType -tcpOctetCounting $false
Adds the specified SYSLOG configuration to PTA
Example 2
Add-PASPTASyslog -siem 'CorpSIEM' -format LEEF -host syslog.cyberark.local -port 6514 -protocol TCP -syslogType RFC5424 -tcpOctetCounting $true
Adds a LEEF-formatted SYSLOG configuration named “CorpSIEM” that sends events to syslog.cyberark.local over TCP on port 6514, using RFC5424 framing with TCP octet-counting enabled
Example 3
Add-PASPTASyslog -siem 'SecureSIEM' -format CEF -host siem.cyberark.local -port 6514 -protocol TLS -CertificateFile C:\Certs\siem.cer -syslogType RFC3164 -tcpOctetCounting $false
Adds a SYSLOG configuration that connects to siem.cyberark.local over TLS on port 6514, presenting the specified certificate file for the connection
Example 4
[PSCustomObject]@{siem='RemoteSIEM'; format='CEF'; host='192.168.1.10'; port=514; protocol='UDP'; syslogType='SEMI_RFC5424'; tcpOctetCounting=$false} | Add-PASPTASyslog
Adds a SYSLOG configuration using property values supplied via the pipeline
PARAMETERS
-siem
A name for the SIEM configuration
Type: String
Parameter Sets: (All)
Aliases: Name
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-format
CEF or LEEF format
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 2
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-host
The SYSLOG host
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 3
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-port
The SYSLOG port
Type: Int32
Parameter Sets: (All)
Aliases:
Required: True
Position: 4
Default value: 0
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-protocol
The SYSLOG protocol
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 5
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-CertificateFile
The certificate file for SYSLOG connectivity
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 6
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-syslogType
The SYSLOG type
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 7
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-tcpOctetCounting
Whether to set TCP Octet Counting
Type: Boolean
Parameter Sets: (All)
Aliases:
Required: True
Position: 8
Default value: False
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-Confirm
Prompts you for confirmation before running the cmdlet.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.