Connect a UniFi Network gateway to the Artica SIEM

• Back to main Artica SIEM page

Starting with artica-siem 1.0.20, the SIEM firewall ingestion pipeline understands the CEF (Common Event Format) stream produced by UniFi Network Application 9.x and later. A UniFi gateway (UDM, UDM Pro, UDM Pro Max, UCG, Cloud Gateway Fiber…) can stream its firewall and intrusion-prevention events straight into the same dashboards, event journal and alerting rules already used for FortiGate and iptables devices.

UDR, UDR7, UDR 5G Max, Express, Express 7, UDM, UCG-Ultra and UXG-Lite are excluded, see this procedure to send events to SIEM

This page covers the UniFi side (enabling the SIEM integration), the Artica side (declaring the gateway as a syslog source), how the events are normalized, and what to check when something does not show up.

Appliances used in the examples:

• Artica SIEM appliance — 192.168.90.66, listening for firewall syslog on port 514 (UDP and TCP)
• UniFi gateway — UDM-Pro-Max, console reachable on the same network

Why stream UniFi events to the SIEM

• One dashboard for a mixed firewall fleet. 
  UniFi sites, FortiGate appliances and Linux iptables gateways land in the same normalized store. The firewall dashboard counts them together, ranks them against each other, and a single filter narrows any view to one device.
   
• Retention beyond the UniFi console. 
  The UniFi console keeps a limited window of system logs. On the SIEM, every event is stored in ClickHouse and compacted into rollup tiers — a question about last quarter is still answerable, without loading the gateway.
   
• Blocked traffic is counted as blocked. 
  UniFi verdicts (Blocked, rule descriptions such as “Block SSH from WAN”, IPS “Threat Detected and Blocked”) are folded onto the SIEM’s canonical action set, so the Denied requests KPI, the Blocked traffic tab and the alerting rules see UniFi blocks exactly as they see FortiGate denies.
   
• Alerting on UniFi traffic. 
  The SIEM detection rules (port scan, deny spikes, host sweeps, per-country traffic) evaluate the normalized store — they apply to a UniFi gateway the day it starts streaming, with no extra configuration.
   
• Your logs stay on your premises. 
  The stream is plain syslog from your gateway to your own appliance. No cloud relay, no third-party retention policy.

Use cases

• Perimeter watch on small sites. Branch offices equipped with UniFi gateways report into the same SIEM as the datacenter FortiGates: one “blocked traffic by country / port / source” view covers the whole company.
• Intrusion-prevention follow-up. UniFi IPS events (“Threat Detected and Blocked”) become deny sessions with source, destination and port — searchable in the event journal, rankable in the tops, and eligible for threshold alerts (e.g. more than N IPS blocks in 10 minutes).
• Audit of firewall policies. Enable syslog logging on the UniFi rules you care about (inter-VLAN isolation, IoT containment, WAN exposure) and the journal shows every match with the rule name — evidence that a policy actually fires, and when.
• Incident investigation. Search the event journal by IP (source or destination) with the <ip> <port> grammar, zoom on an address to get its destinations, ports and countries, and correlate with the proxy side of the SIEM on the same time range.

How it works

UniFi Network Application 9.x can stream its activity log to a SIEM server in CEF format (an ArcSight-originated standard: a pipe-delimited header followed by key=value extensions). The Artica SIEM syslog receiver auto-detects the format of each incoming message by content: a message carrying the CEF: marker and the |Ubiquiti|UniFi vendor header is parsed as UniFi CEF, and stored with format = unifi_cef. Detection is deliberately vendor-scoped: CEF from another vendor is not guessed at.

Two families of UniFi events become firewall sessions:

• Firewall rule matches — the rule description gives the verdict (“Block …”, “Allow …”).
• Intrusion prevention — “Threat Detected and Blocked” events from the UniFi IPS engine.

Every other CEF event UniFi streams (client connected, admin logins, configuration changes…) carries no src/dst pair: the SIEM counts it as ignored — recognized, deliberately out of the firewall scope — not as an error.

Requirements

• Artica SIEM appliance running artica-siem 1.0.20 or later (check with /usr/local/bin/artica-siem -version).
• UniFi Network Application 9.0 or later (the SIEM/CEF integration does not exist in 8.x).
• Network path from the UniFi console to the SIEM appliance on port 514 (UDP or TCP).

Step 1 — Enable the SIEM stream on the UniFi console

On the UniFi Network application:

1. Open Settings > Control Plane > Integrations.
2. Next to Activity Logging (Syslog), choose the SIEM Server option.
3. Point it at the Artica SIEM appliance: address 192.168.90.66, port 514. Select the CEF log format.
4. Select at least the Security / Firewall event categories (names vary slightly across 9.x releases; anything else is accepted and simply ignored by the firewall pipeline).

Firewall rules only log if you ask them to. On each firewall policy you want to see in the SIEM, enable its Syslog logging toggle in the rule’s advanced options. A rule that does not log produces no event — on the console or anywhere else. Keeping the verdict (“Block …” / “Allow …”) at the start of the rule description makes the SIEM classification unambiguous.

Step 2 — Declare the gateway on the Artica SIEM

The SIEM attributes each syslog sender to a tenant, server-side, from its source IP. Open Statistics/SIEM > Firewall sources, click New source and declare the UniFi console’s IP address with a device label and the tenant that should own the events:

Declaring an active source automatically starts the syslog listener on port 514 — there is no separate service to enable. The moment the UniFi console starts streaming, events are parsed, attributed and durably queued to ClickHouse.

Step 3 — Check the events arrive

Open Statistics/SIEM > Firewall events. UniFi sessions show up with the gateway name (taken from the CEF UNIFIhost field), the normalized action, and the source/destination pair. The search field accepts an IP — matched on either side — optionally followed by a destination port (<ip> <port>):

On the firewall dashboard, the collapsible Filters panel narrows every KPI, curve and ranking to the gateway — type its device name in the Device field and apply:

Without the filter, the same dashboard aggregates the whole firewall fleet — UniFi gateways, FortiGates and iptables devices side by side (the Firewall devices tab ranks them):

How UniFi fields are mapped

Country enrichment (GeoIP) and reverse-DNS hostnames are applied by the SIEM at ingestion time, exactly as for the other firewall formats.

Action normalization

Dashboards count blocked traffic on a canonical verb set. UniFi verdicts are folded onto it — including when the event carries no act key and the verdict only appears in the event name or in the firewall rule description:

Known limitations

• No byte counters. UniFi rule and IPS logs do not carry per-session byte counts, so volume-oriented views (bandwidth tab, traffic volume KPI) legitimately show 0 B for a pure-UniFi scope. Session counts, actions, ports, countries and rankings are unaffected.
• No interface names. The inbound/outbound interface columns show unknown unless the gateway sends the corresponding CEF keys.
• Only firewall-shaped events are stored. Client roaming, admin logins and configuration changes streamed over the same CEF channel are counted as ignored by design.
• UDP is fire-and-forget. On a lossy path, prefer pointing the UniFi console at TCP port 514 — the SIEM listens on both.

Troubleshooting

• Nothing shows up. On the SIEM appliance, check the ingestion counters:
  curl -s http://127.0.0.1:9130/metrics | grep unifi
syslog_received_total{format="unifi_cef"} increasing means the stream arrives and is recognized.
• Events counted as unknown_format. The console is sending its legacy syslog format — re-check that the SIEM Server integration with CEF format is selected on the UniFi side, not plain Activity Logging.
• Events counted as no_tenant. The sender IP is not declared (and the appliance is configured to reject unknown sources). Declare the console’s IP in Firewall sources — mind NAT between the console and the SIEM: the declared IP must be the one the SIEM actually sees.
• Rule matches missing. The rule’s Syslog logging toggle is off, or the rule simply never fires. IPS events, on the other hand, are streamed as soon as the Security category is selected.
• Binary too old. /usr/local/bin/artica-siem -version must report 1.0.20 or later; earlier releases reject UniFi CEF as unknown_format.