Syslog (CEF)

Google SecOps (Chronicle)

Point syslog forwarding at a Chronicle forwarder with a syslog collector. CEF parses into UDM with the action in security_result and the hostname in target.hostname.

Integration steps for Google SecOps (Chronicle)

Turn on syslog forwarding

In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.

Settings > Log Forwarding

Syslog host: collector.example.internal
Syslog port: 514

Forwarder collector

forwarder.conf

collectors:
  - syslog:
      common:
        enabled: true
        data_type: CEF
        batch_n_seconds: 10
      udp_address: 0.0.0.0:514

Verification

Two queries: one confirms ingestion, one lists first-seen destinations by policy.

Last 10 events arrived

text

metadata.vendor_name = "Securd"

First-seen per source, last 24h

text

metadata.vendor_name = "Securd" AND security_result.action_details = "greywall"

Event reference Splunk Microsoft Sentinel Elastic Datadog IBM QRadar Sumo Logic Cribl Stream and OpenTelemetry Collector Splunk SOAR, Cortex XSOAR, Tines and Torq

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy and review them with your security team.

See It Live View Pricing