These docs are for Cribl Stream 4.13 and are no longer actively maintained.
See the latest version (4.20).
Syslog TLS to Cribl.Cloud (Palo Alto Example)
This guide explains how to securely forward syslog data to your Cribl.Cloud instance using Transport Layer Security (TLS). Properly configured TLS encryption ensures that sensitive log data is protected during transmission across networks.
Benefits of TLS-Encrypted Syslog
- Data Security: Encrypts sensitive log data during transmission.
- Integrity Verification: Ensures data hasn’t been tampered with during transit.
- Compliance: Helps meet security requirements for regulated industries.
- Authentication: Verifies the identity of your Cribl.Cloud instance.
General Configuration Steps
Follow these steps to set up your connection.
Determine Your Cribl.Cloud Ingest Address
Before configuring your syslog sender, you’ll need to identify your Cribl.Cloud ingest address:
- Log into your Cribl.Cloud portal.
- From the top nav, select Workspace.
- In the sidebar, select Access.
- Note the Public Ingress address (for example,
default.main.<organizationId>.cribl.cloud).
Obtain Cribl.Cloud CA Certificates
Cribl.Cloud uses Google Trust Services (GTS) certificates to secure connections. You have the following two options.
Use Trusted Public Certificate Authorities (Recommended)
Most systems already trust Google Trust Services certificates, so no additional certificate configuration may be necessary if your system’s trust store is up to date.
Manually Import Google Trust Services Certificates
Google Trust Services publishes the necessary certificates in a user-friendly repository. Follow these steps to download the required certificates:
- Visit the Google Trust Services Root Repository.
- Download the following certificates: