RDS Proxy and the Artica SIEM

• Back to the RDS Proxy main page

The RDS Proxy can send its access events to an Artica SIEM in real time: 
Successful and failed authentications, second-factor challenges, session openings and closings, and sessions disconnected by an administrator or by a detection pattern.

Connect the RDS Proxy

1. On the Artica SIEM, create a client certificate for the bastion and download it (.tar.gz).
2. On the appliance, open RDS Proxy » SIEM and click Connect this proxy to a SIEM.
3. Upload the certificate bundle and enter the SIEM host. 
   The appliance tests the connection before saving.

SIEM connection

Read the page

• SIEM endpoint: 
  The address events are sent to.
• SIEM client certificate: 
  The certificate the bastion authenticates with.
• Send RDP access events: 
  Turn the streaming on or off without disconnecting.
• RDP Proxy authenticator: Status: 
  Synchronized when the policy engine has loaded the current settings.
• Last acknowledged sending / Waiting to be sent: 
  Events are queued on disk when the SIEM is unreachable and sent when it comes back.

Test checks the connection; Disconnect stops the streaming and removes the certificate.