Orynexa — install & user guide

Every firewall, switch, access point, controller and server on your network writes a log of what it does — each in its own format. Orynexa collects all of them, recognises each device from the shape of its logs, and stores them in one record you can search in seconds, months later.

On top of that record it answers the questions a network team is asked: who was on this address, what did this user do, which device has stopped sending, who is scanning or guessing passwords — and it proves it to an auditor with scheduled reports. It runs on your own server; nothing is installed on the devices.

The dashboard — events per second, problems, whether every event is being stored, the busiest devices and open incidents. Addresses and names in this guide are demonstration data.

Every five minutes a security correlation runs over the logs of all devices, links what it finds to the user logged in on that address, and raises an incident when the risk is high.

Ports

1. Open https://your-server and sign in as admin.
2. Users & Roles — a named account per person: viewer, engineer or admin.
3. Alerts & Rules → Email & system alerts — your SMTP server, then send a test.
4. Alerts & Rules — switch on the ready rules you want and choose who receives them.
5. Point your devices at the server (next section) and watch them appear in Sources.
6. Settings → Time — your NTP servers, then Apply to system.
7. Reports — schedule the weekly analyzer report and the monthly compliance report.

Palo Alto Networks (PAN-OS)

1. Device → Server Profiles → Syslog: the Orynexa address, port 514, UDP or TCP, format BSD.
2. Objects → Log Forwarding: match lists for traffic, threat and url to that profile.
3. On each security rule: Log Forwarding = that profile, log at session end; URL categories you want reported set to alert.
4. Device → Log Settings: System, Configuration, User-ID and GlobalProtect to the same profile. Commit.

Fortinet FortiGate

Cisco switches and routers

Linux servers (rsyslog)

Sources → Unregistered senders: register one, several or all; vendor and type are filled in from the logs. A CSV of devices can also be uploaded.

To check a device, open Live Tail, choose it, and press Start: its lines appear within seconds.

Parsers → Coverage shows how well each source is understood. A source with many unknown lines needs a rule.

Log Explorer: time range, sources, message text, severity, event class, outcome, user, MAC, interface — and Add field filter for any field a device sends.

• Narrow time ranges come back fastest; field filters are faster than message text over long ranges.
• Save search keeps it for you or your team; Export writes CSV.
• Live Tail follows all sources, one device or any IP — the quickest way to check a device.

• Logins: brute force, password spraying, success after failures, a privileged account from a new address.
• Network: port scans, internal sweeps, worms scanning the internet, deny storms, floods, beaconing.
• Firewall threat and URL logs: attacks reported, bad website categories.
• Devices: a message type never seen before, sudden spikes in a message, errors or volume.

Each user and address has a risk score that fades over 24 hours. At 80, or on any critical finding, an incident opens and the right people are notified. Close or dismiss findings when handled; suppress known scanners so they never raise findings again.

Type a name or an address, or click one anywhere in Orynexa: risk and why, addresses or users seen together, logins and VPN, applications and websites, destinations, what was blocked, threats and findings.

Ready rules for brute force, critical events, deny storms, link flapping, silent sources and volume drops; build your own from any filter, group, window and threshold. Test shows what a rule would fire on your traffic before you switch it on. Alerts go by email, Telegram or webhook.

Configuration changes on devices: time, device, user, action, what changed and the administrator's machine.

Users & Roles → Audit log: every sign-in (failed ones too), change, search, export and investigation, with the client address. Passwords are never recorded. Download as CSV.

Set the total time logs are kept, and shorter periods for noisy events — for example traffic logs 30 days and everything else a year, which often halves the disk. Storage by source shows which devices use the space. Keep 20% of the disk free.

Collectors, buffer backlog, storage, database, disks, slow searches and every service with its supervisor — each check says what to do when it is not OK.

The script checks that the key matches and the certificate is valid, installs it for the console and syslog over TLS, and keeps the previous files. In Settings → Time, add your NTP servers and press Apply to system; the page shows the source and offset.

At 02:30 the configuration, users, rules, incidents, reports and rollups are backed up, restored into a scratch copy and compared row by row. Set BACKUP_COPY_TO to keep a copy on a NAS or another server.

It backs up, applies the new version, restarts only what changed and checks that logs are still being stored — rolling back by itself if not.

Settings → Cluster & HA shows what would stop or be lost if one server failed, and the fix. Add a server as a replica for high availability or a shard for capacity; it is checked over SSH before it joins.

Email info@opsec.co.in or call +91 95901 37009. Tell us the server's address, what you were doing, and a screenshot of System Health if something is red.