USM Anywhere™

Dell SonicWALL

When you configure Dell SonicWALL to send log data to USM Anywhere, you can use the Dell SonicWALL plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:

Plugin Information
Device Details
Vendor Dell
Device Type Firewall
Connection Type Syslog

Integrating Dell SonicWALL

Before you configure the Dell SonicWALL integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Dell SonicWALL to send log data to USM Anywhere

  1. After logging into the SonicWALL console as the administrator, go to Firewall > Address Objects.
  2. Select Add New Address Object.
  3. In the Add Address Object dialog, complete the following and click OK:

    1. Name — USM Anywhere
    2. Zone Assignment — LAN
    3. Type — Host
    4. IP Address — IP address of the USM Anywhere Sensor
  4. Go to LOG > Settings.
  5. Under SYSLOG Servers, select ADD.

    1. Name or IP address should match the USM Anywhere Sensor.
    2. Port should be 514.
    3. For Bind to VPN Tunnel and Create Network Monitor Policy in NDPP Mode, select the appropriate local and outbound interfaces.
  6. Click OK and Done.

Plugin Enablement

For plugin enablement information, see Adding AlienApps to an Asset.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. The USM Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

  • bytes_in
  • bytes_out
  • content_category
  • destination_address
  • destination_hostname
  • destination_port
  • device_event_category
  • device_inbound_interface
  • device_outbound_interface
  • event_description
  • event_name
  • event_severity
  • policy
  • rep_device_address
  • rep_device_rule_id
  • request_url
  • response_code
  • session
  • source_address
  • source_mac
  • source_port
  • source_username
  • timestamp_occured
  • transport_protocol


For troubleshooting, refer to the vendor documentation: