Configure Cato SSE 360 for Arctic Wolf monitoring

You can configure Cato SSE 360® to send the necessary logs to Arctic Wolf® for security monitoring.

Folgende Ressourcen werden benötigt:

  • A Cato Management Application account administrator role with Editor permissions.
  • If you want to use a Service API Key, an existing Service Principal or the ability to create one.

Enable the events feed

  1. Sign in to the Cato Management Application.
  2. Click Resources.
  3. In the side navigation pane, click Event Integrations
  4. On the Event Integrations page, click the Enable integration with Cato events toggle to the on position.

Disable allowlist event tracking

Allowlist event tracking generates a high volume of data that is not security-relevant and too fast to be queried through the API, causing operational issues. You must disable allowlist event tracking to reduce noise and prevent polling timeouts.

  1. Sign in to the Cato Management Application.
  2. Click Security.
  3. In the side navigation pane, click IPS.
  4. Click the Allow List tab.
  5. For each entry on the Allow List tab:
    1. Click the name of the entry to open the Edit panel.
    2. In the Track menu, clear the Event checkbox.
    3. Click Apply.

      The Edit panel closes.

  6. Click Save.

Find the account ID

  1. Sign in to the Cato Management Application.
  2. In the URL, copy the integer, and then save it in a safe, encrypted location.
    This integer typically appears after /account/ in the URL. For example: organization_name.catonetworks.com/#/account/account_id/

    You will provide this value to Arctic Wolf later.

Provide Cato SSE 360 credentials to Arctic Wolf

Note:

Time-based events are polled with a delay to make sure that data is available. If API credentials fail, for example due to expired credentials, Arctic Wolf notifies you and requests a new set of credentials. Provide refreshed credentials promptly to ensure complete data polling and coverage.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. Klicken Sie im Navigationsmenü auf Datenerfassung > Cloud-Sensoren.
  3. Click Add Account +.
  4. On the Add Account page, click Cato Networks.
  5. Configure these settings:

    • Account Name — Enter a unique and descriptive name for the account.

    • Account ID — Enter the integer obtained in Find the account ID.

    • API Key — Enter the API key obtained in Create an API key.
    • API URL — Select the appropriate option based on your region.

    • Credential Expiry — Enter the credential expiration date, if applicable.

  6. Click Test and submit credentials.