SyslogJSON export

Elastic

The Filebeat syslog input receives the stream and the CEF processor decodes it. For backfill, export JSON from the API and bulk-index it.

Integration steps for Elastic

Turn on syslog forwarding

In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.

Settings > Log Forwarding

Syslog host: collector.example.internal
Syslog port: 514

Filebeat

filebeat.yml

filebeat.inputs:
  - type: syslog
    protocol.udp:
      host: "0.0.0.0:514"
    processors:
      - decode_cef:
          field: message
          target_field: cef
output.elasticsearch:
  hosts: ["https://es.example.internal:9200"]
  index: "securd-dns-%{+yyyy.MM.dd}"

Backfill with JSON export

backfill.sh

curl -s "https://control.securd.com/api/v1/gateway/dashboard/logs/export?format=json&start=now-7d/d" \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" \
  | jq -c '.[] | {index:{_index:"securd-dns"}}, .' \
  | curl -s -H "Content-Type: application/x-ndjson" -XPOST https://es.example.internal:9200/_bulk --data-binary @-

Verification

Two queries: one confirms ingestion, one lists first-seen destinations by policy.

Last 10 events arrived

json

GET securd-dns-*/_search
{ "size": 10, "sort": [{ "@timestamp": "desc" }] }

First-seen destinations per source, last 24h

json

GET securd-dns-*/_search
{
  "size": 0,
  "query": { "bool": { "filter": [
    { "term": { "cef.name": "greywall" } },
    { "range": { "@timestamp": { "gte": "now-24h" } } }
  ]}},
  "aggs": { "by_src": { "terms": { "field": "cef.extensions.sourceAddress", "size": 50 },
    "aggs": { "hosts": { "terms": { "field": "cef.extensions.destinationHostName", "size": 20 } } } } }
}

Event reference Splunk Microsoft Sentinel Datadog Google SecOps (Chronicle)IBM QRadar Sumo Logic Cribl Stream and OpenTelemetry Collector Splunk SOAR, Cortex XSOAR, Tines and Torq

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy and review them with your security team.

See It Live View Pricing