Yes, it is possible to send the logs of a MikroTik device to a security information and event management (SIEM) system. This process helps centralize log management and perform deeper analysis of security events and other network data.

We explain how to do it:

Settings in MikroTik

1. Enable the Log System:
   • In MikroTik RouterOS, first make sure that the logging system is configured to capture the desired events. This can be done from System > Logging. Here you can adjust which log topics you want the system to record.
2. Configure Log Shipping:
   • Remote Logging: MikroTik allows you to send logs to a remote server using the Syslog protocol. Set this option to System > Logging adding a new action (Action) of type remote.
   • Configuration Details:
     • Name: Assigns a name to the action.
     • Target: Specifies the IP address of the SIEM server.
     • Remote Port: Configures the remote port, usually 514 for Syslog.
     • Facility: Choose the corresponding facility according to the classification of the logs on the SIEM server.
3. Associate Log Rules with the Submission Action:
   • Link the specific logging rules with the remote logging action created, so that the logs are sent to the SIEM server.

Considerations for the SIEM

1. SIEM Configuration:
   • Make sure your SIEM system is configured to receive and process logs from MikroTik. This may include configuring appropriate parsers to interpret MikroTik-specific log formats.
2. Security and Reliability:
   • Consider the security of log transport. Although Syslog is common, its standard version does not encrypt data, which could be a risk if the logs contain sensitive information. Evaluate the use of Syslog over TLS if your SIEM supports it.
   • Make sure the network between MikroTik and the SIEM is reliable to avoid loss of log data.
3. Analysis and Correlation:
   • Once the logs are being received by the SIEM, you can use its tools to perform analysis, event correlation, and alerts based on abnormal traffic patterns or other indicators of compromise.

Sending MikroTik logs to a SIEM is an excellent practice for improving network security visibility and incident response. This not only centralizes log management but also enhances threat detection and response capabilities in your network infrastructure.