---
title: 8.8 SIEM Configuration
slug: singleconnect-2-16/88-siem-configuration
description: Learn how to set up and configure Single Connect to send logs to a SIEM system with this comprehensive guide. Follow step-by-step instructions, configure server and log parameters, enable/disable log settings, and monitor logs. Includes helpful screenshot
docTags: 
createdAt: 2020-08-04T14:22:28.000Z
---

Single Connect can send logs to SIEM systems. 
RFC\_5424 and RFC\_3164 formats are supported. 
SIEM host IP address, port, RFC format and content format are configurable.

**Setting SIEM Server and Log Parameters**

1. Log in to the Single Connect GUI
2. Navigate to Administration > System Config Management
3. Set the server address, log type etc.
4. Save





| **Parameter**                 | **Default value** | **Possible Values**  |
| ----------------------------- | ----------------- | -------------------- |
| syslog.server.hostName        | -                 |                      |
| syslog.server.port            | 514               |                      |
| syslog.message.rfcFormat      | RFC\_5424         | RFC\_5424, RFC\_3164 |
| syslog.message.content.format | KEY\_VALUE        | KEY\_VALUE, CEF      |

**SIEM Log Configuration**

1. Log in to the Single Connect GUI
2. Navigate to SIEM Configuration
3. Select Log Type and Maximum Record Limit
4. Save

::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/bw5T8SGA-JBNd3vs9Pjo4_image.png" size="84" position="center" showCaption="false"}





**SIEM Log Disable/Enable Property**

Recording the logs can be stopped and then started again manually.

1. Log in to the Single Connect GUI
2. Navigate to SIEM Configuration
3. Click the “Options” drop-down menu button of the Log Configuration 
4.  Select “Disable” or “Enable” 



::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/irc1KiKBgRagFs7_KR6gi_image.png" size="54" position="center" showCaption="false"}



**SIEM Log Monitoring**

1. Log in to the Single Connect GUI,
2. Navigate to SIEM Configuration, 
3. Open the “Monitoring” tab,
4. Enter in fields to filter, and Search



::Image[]{src="https://api.archbee.com/api/presign/g9cApVza9NIhSh0pjZYtA/rVMZNRxw5oSsyaoom-FYI_image.png" size="84" position="center" showCaption="false"}