QuestionQ19

VerifiedLog Management

You work as an L2 SOC analyst on the Cyber Security team at Global Solutions Inc., a multinational corporation. The corporation uses syslog for centralized logging throughout its geographically diverse network. Your team must ensure that security logs are reliably transmitted from various remote sites to the central logging server, including over potentially unreliable network connections and diverse network infrastructure. To ensure consistent, dependable log delivery in the syslog infrastructure, which syslog architectural layer should the team primarily optimize and harden?

Explanation

The syslog transport layer is responsible for placing syslog messages on the network and delivering them to the receiving system. Reliability across unreliable connections is addressed by selecting and hardening an appropriate transport mapping, such as a reliable, secure TLS/TCP-based syslog transport instead of UDP, which does not provide loss detection or retransmission. RFC 5424 defines the syslog transport layer as the layer that puts messages on the wire, and RFC 5426 documents UDP transport reliability limitations.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!