Integrating with Ubiquiti UniFi

Overview

Blumira’s modern cloud SIEM platform integrates with Ubiquiti UniFi controllers via syslog to detect cybersecurity threats and provide an automated or actionable response to remediate when a threat is detected.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Note: This integration requires the Logger Module, which is included by default in all Blumira sensors upon installation.

Gather the IP address of your Blumira sensor to use when configuring the external service.

To find and copy the IP address of the sensor, do the following:

1. In Blumira, navigate to Settings > Sensors.
2. Click the sensor row to open the details page.
3. In the Overview section, next to Host Details, copy the IP address.

Enabling logging from the firewall

1. In the UniFi console, navigate to Settings > System > Integrations.
2. Next to Activity Logging, select SIEM Server.
3. Under Contents, ensure all options are selected for logging.
4. In Server address, type your Blumira sensor's IP address.
5. In Port, type 514.
6. Click Apply changes.