Filtering forwarded events

[HywelBurris]

Hi,

Trying to help the SIEM team out by limiting the amount of logs being sent from the ESXi servers. We only really require security events to be sent to SIEM but I think there are two options here which may work:-

• Only send security events
  • There isn't a great deal on info on the net about this, has anyone done this before and have a filter which I could copy?
• filter out the high volume messages.
  • I have started adding opID's to filter out but whilst the quantity of messages will reduce it doesn't really help out the SIEM team as they will still need the above security event information.

Any help would get greatly appreciated.

[MichaelRyom]

I think you first need to define what a security event is to you. Is it only login events ? or does it include what's been done inside ESXi console. Is it limited to ESXi only or to VMs also need to login event and what kind ?

[Dec1603]

Hi,

I need to do the same, did you ever get it set up ?

Dec