Device Integration: Nutanix

TABLE OF CONTENTS

• Overview
• Prerequisites
• Steps to Configure Syslog on Nutanix
• Verification (MSSP Only)

Overview

Nutanix provides a hyper-converged infrastructure platform that consolidates compute, storage, and virtualization. By integrating Nutanix with ADR SIEM via syslog, administrators can centralize monitoring of events, security alerts, and system activity for better visibility, compliance, and proactive threat detection.

Prerequisites

• Nutanix Prism Element or Prism Central with administrative access.

• ADR CCE IP address.

• Ensure Syslog server port 514/UDP (or configured port) is open between Nutanix and ADR CCE.

• Firewall rules adjusted to allow syslog traffic.

Steps to Configure Syslog on Nutanix

1. Login to Prism (Element or Central) with an administrator account.

2. Navigate to:
   Settings → Syslog Server Configuration.

3. Click + Add Syslog Server.

4. Enter the details:

   • Server Address: Enter the ADR CCE IP.

   • Port: 514 (default, or as configured).

   • Protocol: UDP (recommended) or TCP if required.

   • Format: RFC 5424 

5. Select the type of logs to forward (System, Audit, Alerts, Security Events).

6. Save and Apply the configuration.

Verification (MSSP Only)

On CCE Server

Run the following command to check if logs are reaching:

sudo tcpdump -i any port 514 and host <Nutanix_IP> -s0 -AAA

On ADR UI

1. Log in to ADR UI with admin rights.

2. Navigate to: System → Logs and Flows Collection Status.

3. Verify that the Nutanix Source Device IP appears in the list and logs are being ingested.