Syslog

Cribl Stream and OpenTelemetry Collector

For environments that route logs through a pipeline, Securd is an additional syslog source. Route by action: send greywall and threat events to the SIEM and alerting destinations, and route accepts to lower-cost storage if desired.

Integration steps for Cribl Stream and OpenTelemetry Collector

Turn on syslog forwarding

In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.

Settings > Log Forwarding

Syslog host: collector.example.internal
Syslog port: 514

OpenTelemetry Collector

otel-collector.yaml

receivers:
  syslog:
    udp:
      listen_address: "0.0.0.0:514"
    protocol: rfc3164
processors:
  attributes/securd:
    actions:
      - key: product
        value: securd-agent-dns
        action: insert
exporters:
  otlp:
    endpoint: otel-backend.example.internal:4317
service:
  pipelines:
    logs:
      receivers: [syslog]
      processors: [attributes/securd]
      exporters: [otlp]

Cribl route

Filter on the CEF action field. A common configuration routes accepts to cold storage and greywall and threat events to the SIEM and a chat channel.

route filter

__raw.startsWith('CEF:0|Securd|DNS|') && (__raw.includes('|greywall|') || __raw.includes('|block|'))

Verification

Two queries: one confirms ingestion, one lists first-seen destinations by policy.

Last 10 events arrived

text

Use the pipeline's live capture on the syslog source to confirm CEF:0|Securd|DNS lines are received.

First-seen per source, last 24h

text

Run the destination system's query from its integration page.

Splunk Elastic Splunk Microsoft Sentinel Elastic Datadog Google SecOps (Chronicle)IBM QRadar Sumo Logic Splunk SOAR, Cortex XSOAR, Tines and Torq

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy and review them with your security team.

See It Live View Pricing