Siemens SIMATIC S7-1500 System Manual page 55

Industrial cybersecurity
4.9 Secure operation of CPUs
Forwarding to a syslog server
From STEP 7 V19 and a CPU as of FW version V3.1, it is possible to transfer syslog messages
to a server, e.g. SINEC INS. The syslog messages are transferred to the syslog server via the
syslog protocol. The syslog server saves all syslog messages from its connected devices.
Messages of system and network events are stored centrally in a storage location in the
syslog server. At the syslog server interface, you can view the collected syslog messages and
thereby determine the source of potential security risks or problems.
Syslog messages are sent to the syslog server via port 514 (UDP) or port 6514 (TLS over TCP)
by default.
Note
If you are using UDP as the transport protocol, the data is transmitted unencrypted.
Authentication is also omitted with UDP.
Processing in a Security Information and Event Management system (SIEM system)
In order to be able to accept the incoming syslog messages, a SIEM-system must understand
the syslog protocol according to RFC 5424. Otherwise, the SIEM system cannot accept or
process the incoming messages.
54
S7-1500R/H redundant system
System Manual, 01/2024, A5E41814787-AF