Hi everyone, lately i had a doubt that maybe you could sort out. What is the difference between implementing the universal siem forwarder via the SPS Web interface ( Basic Settings > Management > Universal SIEM forwarder ) by using thie API procedure ( POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/management/universal_siem_forwarder endpoint) Would i have the same result? Would i be able to see the same configuration in the SPS Web interface if i would have used the API method? Is that the only way to implement SIEM Forwarder via API? Thank you, Simone

Yes correct, both ways are for the same Universal SIEM forwarder setting whether configured via API or WEB UI This is the only endpoint for U niversal SIEM forwarder correct: /api/configuration/management/universal_siem_forwarder Thanks!

Difference between configuring SIEM forwarder from SPS Web console and from SPS REST API

simone tabacchi 3 days ago

Hi everyone,

lately i had a doubt that maybe you could sort out.

What is the difference between implementing the universal siem forwarder

via the SPS Web interface ( Basic Settings > Management > Universal SIEM forwarder)
by using thie API procedure (POST the JSON object to the https://<IP-address-of-SPS>/api/configuration/management/universal_siem_forwarder endpoint)

Would i have the same result? Would i be able to see the same configuration in the SPS Web interface if i would have used the API method?

Is that the only way to implement SIEM Forwarder via API?

Thank you,

Simone

Top Replies

+1 Tawfiq.Ahmad 3 days ago

Yes correct, both ways are for the same Universal SIEM forwarder setting whether configured via API or WEB UI

This is the only endpoint for Universal SIEM forwarder correct: /api/configuration/management/universal_siem_forwarder

Thanks!
Cancel
Up +1 Down

Reply

Reject Answer

Cancel
0 simone tabacchi 3 days ago in reply to Tawfiq.Ahmad

Hi Tawfiq,

thank you for the answer, i would like to ask another one:

the universal SIEM forwarder is able to send data only via Syslog?

Or is it possible to send data via API to those SIEMs who support it?

Thank you
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Tawfiq.Ahmad 2 days ago in reply to simone tabacchi

That is correct. No option to send data via API as per the Admin guide:

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/7.5/administration-guide/30#TOPIC-2157553

Thanks!
Cancel
Up +1 Down

Reply

Verify Answer

Cancel