A10 SSL device integration to SIEM

[NijoDavid]

I want to integrate the A10 SSL device logs to RSA SA is there any way to do that??

[HamedTorabi]

Not Supported. You either need to write your own parser using the Netwitness Log Parser tool or seek Professional Services.  For your reference, see the Supported Event Sources link  below

 https://community.rsa.com/community/products/netwitness/parser-network/event-sources

[JacobDorval]

What version of RSA NetWitness are you on?  If you're on v11.X you can leverage the dynamic log parsing capabilities that come out of the box which parse out many of the key parts of a log message for you.  This feature was added in v11.x to reduce the requirement of creating a custom parser for every single log event source.  If parsing out the critical parts of the logs (IP, host names, usernames, etc.) will suffice for you, give it a try.  However, if you need to parse out every single field from the log message then you'd still need an actual parser for the event source.  

[NijoDavid]

I am using 11.1. But I don't know how to integrate this device. This is also something that concerns me.

[Anonymous]

If you contact your local Sales Engineer, I'm sure they can help you build a parser. Building a parser only takes a few minutes. You can watch Dave Glover's video on how to do it here - RSA ESI Beta 3 - YouTube - but again, your SE can help you build this or determine if the Default Parser is a better avenue.