SyslogWebhooks

Datadog

Run the Datadog Agent with a TCP or UDP log listener, tag the source as securd, and build a monitor on the greywall action.

Integration steps for Datadog

Turn on syslog forwarding

In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.

Settings > Log Forwarding

Syslog host: collector.example.internal
Syslog port: 514

Agent log config

conf.d/securd.d/conf.yaml

logs:
  - type: udp
    port: 514
    service: securd
    source: cef
    tags: ["product:agent-dns"]

Webhooks for the events that matter

Send threat.detected to a Datadog webhook or to the Events API so an incident is created with the policy and hostname attached.

Verification

Two queries: one confirms ingestion, one lists first-seen destinations by policy.

Last 10 events arrived

text

service:securd

First-seen per source, last 24h

text

service:securd @action:greywall

Webhooks Splunk Microsoft Sentinel Elastic Google SecOps (Chronicle)IBM QRadar Sumo Logic Cribl Stream and OpenTelemetry Collector Splunk SOAR, Cortex XSOAR, Tines and Torq

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy and review them with your security team.

See It Live View Pricing