[pfsense] update pfsense docs #15969
Conversation
vinit-chauhan
added
documentation
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
🚀 Benchmarks reportTo see the full report comment with |
mjwolf
left a comment
mjwolf
left a comment
There was a problem hiding this comment.
Could you add a service_info file for this as well?
| # pfSense Integration for Elastic | ||
|
|
||
| ## Overview | ||
| The pfSense integration for Elastic enables the collection of logs from pfSense and OPNsense firewalls. It parses logs received over the network via syslog (UDP, TCP, or TLS), providing visibility into network traffic, security events, and system health. |
There was a problem hiding this comment.
(UDP, TCP, or TLS) - TLS isn't a transport, this should probably change to (UDP or TCP) or UDP or TCP, using TLS
| 1. On a host connected to the pfSense network, generate traffic that will trigger a firewall log event. For example, attempt a connection that you know will be blocked by a firewall rule. | ||
| 2. Check the pfSense system logs to confirm that new event data is being written. In the pfSense web interface, navigate to **Status > System Logs > Firewall**. | ||
| 3. In Kibana, navigate to the **Discover** tab or open the pre-built **Firewall - Dashboard [pfSense]** dashboard. | ||
| 4. Filter for pfSense data by using the KQL query `event.dataset : "pfsense.log"`. |
There was a problem hiding this comment.
This could be a bit confusing, you don't need to filter, if you choose to open the dashboard
There was a problem hiding this comment.
In step 3 it says Navigate to discover or Open dashboard. If user opens discover then they have to add the query. And for dashboards, I think the query would most likely be there or adding it won't change anything.
I did not use |
💚 Build Succeeded
History
|
3 participants
Proposed commit message
Update readme for PfSense
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots