Sekoia and SonicWall: Unified Detection and agentic investigation Across Firewall and Remote Access Logs

Firewalls provide visibility into what is happening at the network perimeter, while remote access gateways show who is connecting from outside. When these logs are stored separately from other security data, security teams have to correlate them by hand. Sekoia, a SonicWall technology partner, removes that effort by bringing telemetry from SonicWall firewalls and SonicWall Secure Mobile Access (SMA) 1000 Series appliances into a single Agentic SOC Platform.

SonicWall firewalls and SMA 1000 Series at a glance

SonicWall next-generation firewalls protect the network perimeter from advanced threats. Their security features include intrusion detection and prevention, VPN, application control, advanced DNS filtering, and content and reputation-based filtering. DNS and reputation-based content filtering help block malicious websites and applications. The firewalls are designed to deliver this protection without causing performance bottlenecks.

SonicWall firewalls are available in several families:

• NSsp: for large distributed enterprises, data centers, and MSSPs
• NSa: for mid-sized networks, branch offices, and distributed enterprises
• TZ: for small and medium organizations and SD-Branch deployments
• NSv: virtual firewalls for public and private cloud infrastructure

SonicWall SMA 1000 Series secures remote access. It delivers Zero Trust secure access for organizations of all sizes, and is designed for environments where sensitive assets cannot be moved to the cloud. The SMA 1000 Series has been SonicWall’s enterprise remote access solution since 2007.

How it works

Sekoia collects logs from both products through Syslog and normalizes the data. For SonicWall firewalls, the integration requires the ArcSight Syslog format. Security teams can then use the data for investigation by human analysts or AI agents, threat hunting, correlation, and detection.

Benefits for SonicWall firewall customers

• Broad network visibility: Firewall traffic, application control, intrusion prevention, web activity, DNS records, file transfers, and VPN access events are available in one platform.
• Investigation with context: Normalized and enriched firewall data supports threat hunting and correlation alongside other security data.
• Detection support: Sekoia built-in detection rules and CTI combinemultiple sources of telemetry to raise alerts

Supported for SMA 1000 Series events

Sekoia supports the following SMA 1000 Series event types:

• VPN activity: Full visibility into VPN activity
• System and administrative: Events from appliance operations and administrator actions
• Access, tunnel, and flow: Events from user access, tunnels, and traffic flows
• Web proxy: Events from web proxy sessions
• Device and Workplace: Unregistered-device and Workplace events

Benefits across both products

Sekoia applies built-in analytics and cyber threat intelligence (CTI) to the normalized data to support detection and response across SonicWall-protected environments. Sekoia also enriches events, connects related events across the security stack, and helps identify false positives. Analysts can review the evidence behind Sekoia’s AI reasoning before responding. 

Get started

Deployment steps are available in the Sekoia integration guides:

• Integration Guide: SonicWall Firewall to Sekoia: https://docs.sekoia.com/integration/categories/network_security/sonicwall_fw/
• Integration Guide: SonicWall SMA 1000 Series to Sekoia: https://docs.sekoia.com/integration/categories/network_security/sonicwall_sma_1000_series/

For more information, visit the Sekoia page in the SonicWall Technology Partners directory: https://www.sonicwall.com/partners/technology-partners/sekoia

Please share your feedback related to Technology Alliance and Integration to - thirdpartyintegrations@SonicWall.com .