Starting with artica-siem 1.0.20, the SIEM firewall ingestion pipeline understands the CEF (Common Event Format) stream produced by UniFi Network Application 9.x and later. A UniFi gateway (UDM, UDM Pro, UDM Pro Max, UCG, Cloud Gateway Fiber…) can stream its firewall and intrusion-prevention events straight into the same dashboards, event journal and alerting rules already used for FortiGate and iptables devices.
UDR, UDR7, UDR 5G Max, Express, Express 7, UDM, UCG-Ultra and UXG-Lite are excluded, see this procedure to send events to SIEM
This page covers the UniFi side (enabling the SIEM integration), the Artica side (declaring the gateway as a syslog source), how the events are normalized, and what to check when something does not show up.
Appliances used in the examples:
- Artica SIEM appliance —
192.168.90.66, listening for firewall syslog on port514(UDP and TCP) - UniFi gateway —
UDM-Pro-Max, console reachable on the same network
¶ Why stream UniFi events to the SIEM
- One dashboard for a mixed firewall fleet.
UniFi sites, FortiGate appliances and Linux iptables gateways land in the same normalized store. The firewall dashboard counts them together, ranks them against each other, and a single filter narrows any view to one device.
- Retention beyond the UniFi console.
The UniFi console keeps a limited window of system logs. On the SIEM, every event is stored in ClickHouse and compacted into rollup tiers — a question about last quarter is still answerable, without loading the gateway.
- Blocked traffic is counted as blocked.
UniFi verdicts (Blocked, rule descriptions such as “Block SSH from WAN”, IPS “Threat Detected and Blocked”) are folded onto the SIEM’s canonical action set, so the Denied requests KPI, the Blocked traffic tab and the alerting rules see UniFi blocks exactly as they see FortiGate denies.
- Alerting on UniFi traffic.
The SIEM detection rules (port scan, deny spikes, host sweeps, per-country traffic) evaluate the normalized store — they apply to a UniFi gateway the day it starts streaming, with no extra configuration.
- Your logs stay on your premises.
The stream is plain syslog from your gateway to your own appliance. No cloud relay, no third-party retention policy.
¶ Use cases
- Perimeter watch on small sites. Branch offices equipped with UniFi gateways report into the same SIEM as the datacenter FortiGates: one “blocked traffic by country / port / source” view covers the whole company.
- Intrusion-prevention follow-up. UniFi IPS events (“Threat Detected and Blocked”) become
denysessions with source, destination and port — searchable in the event journal, rankable in the tops, and eligible for threshold alerts (e.g. more than N IPS blocks in 10 minutes). - Audit of firewall policies. Enable syslog logging on the UniFi rules you care about (inter-VLAN isolation, IoT containment, WAN exposure) and the journal shows every match with the rule name — evidence that a policy actually fires, and when.
- Incident investigation. Search the event journal by IP (source or destination) with the
<ip> <port>grammar, zoom on an address to get its destinations, ports and countries, and correlate with the proxy side of the SIEM on the same time range.
¶ How it works
UniFi Network Application 9.x can stream its activity log to a SIEM server in CEF format (an ArcSight-originated standard: a pipe-delimited header followed by key=value extensions). The Artica SIEM syslog receiver auto-detects the format of each incoming message by content: a message carrying the CEF: marker and the |Ubiquiti|UniFi vendor header is parsed as UniFi CEF, and stored with format = unifi_cef. Detection is deliberately vendor-scoped: CEF from another vendor is not guessed at.
Two families of UniFi events become firewall sessions:
- Firewall rule matches — the rule description gives the verdict (“Block …”, “Allow …”).
- Intrusion prevention — “Threat Detected and Blocked” events from the UniFi IPS engine.
Every other CEF event UniFi streams (client connected, admin logins, configuration changes…) carries no src/dst pair: the SIEM counts it as ignored — recognized, deliberately out of the firewall scope — not as an error.
¶ Requirements
- Artica SIEM appliance running artica-siem 1.0.20 or later (check with
/usr/local/bin/artica-siem -version). - UniFi Network Application 9.0 or later (the SIEM/CEF integration does not exist in 8.x).
- Network path from the UniFi console to the SIEM appliance on port
514(UDP or TCP).
¶ Step 1 — Enable the SIEM stream on the UniFi console
On the UniFi Network application:
- Open
Settings > Control Plane > Integrations. - Next to Activity Logging (Syslog), choose the SIEM Server option.
- Point it at the Artica SIEM appliance: address
192.168.90.66, port514. Select the CEF log format. - Select at least the Security / Firewall event categories (names vary slightly across 9.x releases; anything else is accepted and simply ignored by the firewall pipeline).
Firewall rules only log if you ask them to. On each firewall policy you want to see in the SIEM, enable its Syslog logging toggle in the rule’s advanced options. A rule that does not log produces no event — on the console or anywhere else. Keeping the verdict (“Block …” / “Allow …”) at the start of the rule description makes the SIEM classification unambiguous.
¶ Step 2 — Declare the gateway on the Artica SIEM
The SIEM attributes each syslog sender to a tenant, server-side, from its source IP. Open Statistics/SIEM > Firewall sources, click New source and declare the UniFi console’s IP address with a device label and the tenant that should own the events:
Declaring an active source automatically starts the syslog listener on port 514 — there is no separate service to enable. The moment the UniFi console starts streaming, events are parsed, attributed and durably queued to ClickHouse.
¶ Step 3 — Check the events arrive
Open Statistics/SIEM > Firewall events. UniFi sessions show up with the gateway name (taken from the CEF UNIFIhost field), the normalized action, and the source/destination pair. The search field accepts an IP — matched on either side — optionally followed by a destination port (<ip> <port>):
On the firewall dashboard, the collapsible Filters panel narrows every KPI, curve and ranking to the gateway — type its device name in the Device field and apply:
Without the filter, the same dashboard aggregates the whole firewall fleet — UniFi gateways, FortiGates and iptables devices side by side (the Firewall devices tab ranks them):
¶ How UniFi fields are mapped
| UniFi CEF field | SIEM column | Notes |
|---|---|---|
src / dst |
Source / destination IP | Required — events without the pair are ignored |
spt / dpt |
Source / destination port | |
proto |
Protocol | Normalized to lowercase (tcp, udp…), numeric values accepted |
act, or the CEF event name |
Action | See the normalization table below |
UNIFIhost / dvchost / dvc |
Device | Falls back to the syslog sender IP |
smac / dmac |
Source / destination MAC | Shown only to operators holding the raw role |
app |
Service | |
| CEF event class ID / name / severity | Log ID / Subtype / Level | Visible in the event detail |
rt or start, else the syslog timestamp |
Event time | Epoch in s/ms/µs/ns accepted; falls back to receive time |
externalId |
Session ID | Part of the deduplication fingerprint |
Country enrichment (GeoIP) and reverse-DNS hostnames are applied by the SIEM at ingestion time, exactly as for the other firewall formats.
¶ Action normalization
Dashboards count blocked traffic on a canonical verb set. UniFi verdicts are folded onto it — including when the event carries no act key and the verdict only appears in the event name or in the firewall rule description:
| UniFi verdict (act key or event name) | Stored action |
|---|---|
Blocked, block, Denied, “Block …” rule names, “Threat Detected and Blocked” |
deny |
Dropped, drop |
drop |
Rejected, reject |
reject |
Allowed, accept, pass, permit, “Allow …” rule names |
accept |
| Anything else | Kept as-is, lowercased (never silently folded onto accept or deny) |
¶ Known limitations
- No byte counters. UniFi rule and IPS logs do not carry per-session byte counts, so volume-oriented views (bandwidth tab, traffic volume KPI) legitimately show
0 Bfor a pure-UniFi scope. Session counts, actions, ports, countries and rankings are unaffected. - No interface names. The inbound/outbound interface columns show
unknownunless the gateway sends the corresponding CEF keys. - Only firewall-shaped events are stored. Client roaming, admin logins and configuration changes streamed over the same CEF channel are counted as ignored by design.
- UDP is fire-and-forget. On a lossy path, prefer pointing the UniFi console at TCP port 514 — the SIEM listens on both.
¶ Troubleshooting
- Nothing shows up. On the SIEM appliance, check the ingestion counters:
curl -s http://127.0.0.1:9130/metrics | grep unifisyslog_received_total{format="unifi_cef"}increasing means the stream arrives and is recognized. - Events counted as
unknown_format. The console is sending its legacy syslog format — re-check that the SIEM Server integration with CEF format is selected on the UniFi side, not plain Activity Logging. - Events counted as
no_tenant. The sender IP is not declared (and the appliance is configured to reject unknown sources). Declare the console’s IP inFirewall sources— mind NAT between the console and the SIEM: the declared IP must be the one the SIEM actually sees. - Rule matches missing. The rule’s Syslog logging toggle is off, or the rule simply never fires. IPS events, on the other hand, are streamed as soon as the Security category is selected.
- Binary too old.
/usr/local/bin/artica-siem -versionmust report1.0.20or later; earlier releases reject UniFi CEF asunknown_format.