Syslog / CEF

The syslog sink transmits events over RFC 5424 syslog (UDP or TCP) with the message body in either raw ECS JSON or CEF (Common Event Format). It's the universal adapter: rsyslog relays, the Wazuh manager's syslog listener, Microsoft Sentinel's AMA/CEF connector, ArcSight, QRadar — anything that speaks syslog.

Configuration#

SIEM_SINKS=syslog
SIEM_SYSLOG_HOST=siem.internal
SIEM_SYSLOG_PORT=514
SIEM_SYSLOG_PROTOCOL=udp     # udp | tcp
SIEM_SYSLOG_FORMAT=json      # json | cef

Key	Env	Default	Description
`sinks.syslog.host`	`SIEM_SYSLOG_HOST`	`127.0.0.1`	Receiver host
`sinks.syslog.port`	`SIEM_SYSLOG_PORT`	`514`	Receiver port
`sinks.syslog.protocol`	`SIEM_SYSLOG_PROTOCOL`	`udp`	`udp` or `tcp` (TCP uses RFC 6587 octet framing)
`sinks.syslog.format`	`SIEM_SYSLOG_FORMAT`	`json`	Message body: `json` (ECS document) or `cef`
`sinks.syslog.facility`	—	`13` (log audit)	Syslog facility for the PRI calculation
`sinks.syslog.app_name`	`SIEM_SYSLOG_APP`	`gatekeeper`	APP-NAME header field
`sinks.syslog.timeout`	—	`5`	Socket connect timeout (seconds)

Frame format#

Each event is one RFC 5424 frame. Severity maps to the syslog level (critical → 2, high → 3, medium → 4, low → 5, info → 6, debug → 7):

<109>1 2026-07-11T09:14:23.187Z web-01 gatekeeper 4321 honeypot_route_hit - {"@timestamp":...}

The MSGID field carries the event type, so receivers can filter before parsing the body.

CEF format#

With format=cef, the body is a CEF record — the lingua franca of syslog SIEM pipelines:

CEF:0|Inqaba|gatekeeper|1.0|honeypot_route_hit|Honeypot route accessed|8|src=203.0.113.9 requestMethod=GET request=https://shop.example/wp-login.php suid=7 outcome=failure app=shop cs1=T1595.003 cs1Label=MitreTechniqueId

CEF extension mapping:

CEF key	ECS source
`rt`	`@timestamp` (epoch millis)
`src`	`source.ip`
`suser` / `suid`	`user.name` / `user.id`
`requestMethod`	`http.request.method`
`request`	`url.full`
`requestClientApplication`	`user_agent.original`
`outcome`	`event.outcome`
`app`	`service.name`
`deviceFacility`	`service.environment`
`externalId`	`event.id`
`cs1` (+ `cs1Label`)	MITRE technique ID

Sentinel via AMA/CEF#

If your organization ingests CEF through the Azure Monitor Agent pipeline instead of the Logs Ingestion API, point the sink at your CEF collector:

SIEM_SYSLOG_HOST=cef-collector.internal
SIEM_SYSLOG_FORMAT=cef
SIEM_SYSLOG_PROTOCOL=tcp

Events arrive in Sentinel's CommonSecurityLog table with the vendor/product pair Inqaba | gatekeeper.

UDP vs TCP#

UDP is fire-and-forget: no delivery guarantee, but zero back-pressure. Fine on a reliable LAN.
TCP guarantees the frame reached the receiver and uses RFC 6587 octet counting so receivers can delimit messages. Prefer it across networks — and since delivery runs on the queue with retries, a briefly unreachable receiver self-heals.