Dell PowerFlex Appliance with PowerFlex 4.x Administration Guide

Define the audit policy notification policy

Use this procedure to define a notification policy to forward events in the PowerFlex system to the rsyslog-forwarder (also known as the syslog-listener). Then, the rsyslog-forwarder forwards the events to the external destinations that are defined in the policy.

1. Create a source:
   1. Click Add a source and from the Source Type drop-down menu, select auditlog.
   2. Add the name and description.
2. Create a destination:
   1. Go to Settings > Events and Alerts > Notification Policies.
      You can also use the following REST API: dispatch-destinations~1/post
   2. Enter the destination name and description.
   3. From the Destination Type menu, select Audit Log.
   4. Click Next and enter the IP address, port, and protocol (TCP) of the target SIEM. Ensure that the SIEM IP address, port, and protocol are reachable.
3. Create a new policy:
   1. Go to Settings > Events and Alerts > Notification Policies.
      You can also use the following REST API: dispatch-policies~1/post
   2. Click Create New Policy.
   3. Enter a name and a description for the notification policy. For the policy name, you can enter: Powerflex audit events to external Syslog
   4. Set the Source Type to Auditlog.
   5. Set the Resource Domain to All (all resource domains must be selected).
   6. For Severity, select all the check boxes (all severity levels must be selected).
   7. Select one or more of the destinations you created above.