SOCFortress Integrations — Ubiquiti Networks

4 min readApr 17, 2024

Intro

SOCFortress integration and visualization tools allow security analysts the visualization and triage of UniFI (Ubiquiti Networks) logs and security events using a single pane of glass.

About UniFI (Ubiquiti Networks)

UniFi Networks is a line of networking equipment and software developed by Ubiquiti Networks, a company known for its innovative networking solutions. UniFi Networks offers a comprehensive range of products and services designed to provide reliable, high-performance networking infrastructure for businesses, enterprises, and service providers.

UniFi Networks include:

Unified Network Management: UniFi Networks provides a centralized management platform that allows administrators to configure, monitor, and manage all UniFi devices from a single interface. This includes access points, switches, routers, security gateways, cameras, and other network components.
Wireless Access Points (APs): UniFi APs are designed to deliver high-speed wireless connectivity and seamless roaming across indoor and outdoor environments. They support the latest Wi-Fi standards, including 802.11ac and 802.11ax (Wi-Fi 6), and feature advanced technologies such as beamforming, MU-MIMO, and band steering.
Switching Solutions: UniFi switches offer enterprise-class features such as PoE (Power over Ethernet), VLAN support, link aggregation, and QoS (Quality of Service) to meet the needs of modern networks. They come in various form factors, including desktop, rack-mount, and outdoor enclosures.
Routing and Security Gateways: UniFi routers and security gateways provide routing, firewall, VPN, and intrusion detection/prevention capabilities to secure and optimize network traffic. They are designed to handle high-throughput, low-latency networking tasks and support advanced routing protocols such as OSPF and BGP.
Network Management Software: UniFi Network Controller is a powerful software application that enables centralized management of UniFi devices. It provides features such as device discovery, configuration management, monitoring, reporting, and firmware updates. It can be deployed on-premises or in the cloud.
Scalability and Flexibility: UniFi Networks are highly scalable and flexible, allowing organizations to deploy and expand their network infrastructure as needed. Whether it’s a small office, campus environment, or multi-site enterprise network, UniFi can accommodate diverse networking requirements.
Integration with Other UniFi Products: UniFi Networks seamlessly integrates with other UniFi products such as UniFi Protect (for video surveillance), UniFi Access (for access control), and UniFi Talk (for VoIP communications), providing a comprehensive solution for converged network services.
Community and Support: Ubiquiti Networks has a large and active user community that provides support, troubleshooting tips, and best practices for deploying and managing UniFi Networks. In addition, Ubiquiti offers professional support services and training programs for organizations that require assistance.

UniFi Networks is widely used by businesses, educational institutions, government agencies, and service providers worldwide to build reliable and cost-effective network infrastructures. With its intuitive management interface, advanced features, and competitive pricing, UniFi Networks offers a compelling solution for organizations seeking to modernize their network infrastructure.

Ingesting Ubiquiti Logs and Events

Configure remote syslog:

Log in to the UniFi Controller’s web interface.
Click Settings (the gear icon) in the bottom left corner.
Under the Site heading, navigate to the Remote Logging section.
Select the checkbox beside Enable remote syslog server. Leave the Enable debug logging box unchecked.
Enter the Syslog Collector IP address.
Enter the syslog Port field.

Visualizations

Landing Page:

Logs Summary:

Kernel Logs:

System daemon logs:

System Daemon errors:

User-Level Logs (+Ttraffic Logs):

Need Help?

The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.

Website: https://www.socfortress.co/