The SIEM gateway Docker container (portnox-siem)

The portnox-siem Docker container lets you forward Portnox Cloud alerts and activity log data to an on-premises SIEM solution, without needing a public IP address or open inbound port on your network. The container works by polling Portnox Cloud for new events over an outbound TLS connection, and then forwarding them to the syslog listener or SIEM collector you specify, on your local network. It is available in the public Docker repository as portnox/portnox-siem. It has no virtual machine equivalent.

• To learn what alert and activity data is sent to SIEM platforms and in what format, see the following topic: Format and content of alert information for SIEM.

• To configure which types of alerts are sent, see the following topic: Portnox Cloud alerts.

• The container can run on Linux, or on Windows or macOS via Docker Desktop. If running in a VM environment, we recommend Linux for the best results, since Windows and macOS would require double virtualization.

• Follow the firewall rules in How to set up the firewall for Portnox Docker containers to connect to Portnox Cloud. The container may not work correctly if any of those rules are missing. The host running the container must also be able to reach, over your local network, the syslog listener or SIEM collector you are forwarding data to.

You don’t have to build the docker run command for portnox-siem manually. Portnox Cloud generates the complete command for you, already filled in with the unique APIUSER, APIKEY, and GWID values for your integration, so you only need to copy and run it.

For step-by-step instructions on creating the SIEM integration and deploying the container for a specific platform, see one of the following topics:

• To forward alerts to NXLog Community Edition, see the following topic: Configure Portnox Cloud with the portnox-siem Docker container.

• To forward alerts to SolarWinds Kiwi Syslog Server, see the following topic: Configure Portnox Cloud with the portnox-siem Docker container.

• To forward alerts to a generic SIEM solution or syslog listener not listed here, see the following topic: Integrate with a generic SIEM.

To collect Docker container logs for troubleshooting, see the following topic: How to collect Portnox Docker container logs for support.

• If you use a Docker container running on a local Docker host, it does not update automatically, unless you also use the autoupdate container. The autoupdate container updates all Portnox Docker containers when new versions are available. Updating requires recreating the Docker container, so there may be a short service interruption.

• If you deploy the Docker container in a cloud environment, you cannot use the autoupdate container, because it requires direct access to the local Docker engine, which these managed cloud services do not expose. You must update containers deployed this way manually by redeploying them with the latest image.