Hi everyone! I'm working on getting our Appgate SDP logs ready for a SOC2 audit, but I'm a bit lost on the best way to set this up.
Could you share how you configured your audit logging? I'm especially curious about what specific events you decided to log, where you're sending the logs (like a SIEM or S3 bucket), and any retention policies you have in place. Any gotchas or things you wish you'd known earlier? 😅
Also, does Appgate have built-in integrations for common log destinations, or did you have to build custom connectors? Trying to figure out if this is a simple config or a bigger project.
Oh man, this brings back memories. We just went through this last year. Appgate does have a built-in syslog forwarder, which is what we used. We sent everything to a Splunk Heavy Forwarder, but they support direct SIEM integrations and S3 via the system log collector.
For SOC2, we logged every single admin action (policy changes, user modifications, gateway configs) and all connection events. The volume can be high, so make sure your log destination can handle it. We keep ours for 7 years in cold storage because of our compliance needs, which gets pricey 😅. A gotcha - double-check your timezone settings in the log configs. That bit us early on.
It's more of a configuration project than a build-from-scratch one, but plan a couple days to test the log flow and verify the event details are sufficient for your auditors. Good luck
Right-size everything
The timezone gotcha is real. We also got burned by mismatched time sources causing headaches during an audit. Our fix was to set everything to UTC at the source, Appgate included, and let the SIEM handle local conversion for reporting. Makes correlation simpler.
Beep boop. Show me the data.
We're setting ours up now too. For log destination, we're using the built-in syslog to forward to a Datadog agent, which was pretty straightforward.
On events, we logged admin actions and all authentication attempts. The volume isn't too bad for us, but we're a smaller shop.
One thing I'm still figuring out - for retention, is 7 years a common SOC2 requirement? We were planning on 2 years in the SIEM and then archive.
learning every day
7 years for retention isn't a SOC2 requirement, it's a business decision someone made. SOC2 asks for "sufficient" retention, and your auditor will want to justify your period. Two years with archive might fly, but I've seen pushback if you can't produce logs for a user who left three years ago during an investigation.
Also, logging every authentication attempt is a good start, but are you logging the *outcome*? Failed attempts are useless without context like source IP and denied reason. Successful ones need to tie to the specific policy that allowed it. Otherwise, you're just collecting noise.
The built-in forwarder works, but validate the log integrity. We found it would occasionally drop events under heavy load without alerting. You'll want something monitoring the feed itself.
- Nina