← Integrations
SyslogCEF exportWebhooks
Splunk
Forward to a syslog input on a heavy forwarder or to Splunk Connect for Syslog. Assign a sourcetype and extract the CEF fields for per-policy first-seen reporting.
Integration steps for Splunk
Turn on syslog forwarding
In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.
Settings > Log Forwarding
Syslog host: collector.example.internal
Syslog port: 514
Sourcetype and extractions
The CEF header carries the action and hostname; the extension carries source IP, category and reason. The Splunk CEF add-on handles the header; the props below extract the extension fields.
props.conf
[securd:dns]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
EXTRACT-cef = ^CEF:0\|Securd\|DNS\|[^|]+\|(?<action>[^|]+)\|(?<dns_q_name>[^|]+)\|(?<severity>\d+)\|
EXTRACT-ext = src=(?<client_ip>\S*)\s+dhost=(?<dhost>\S*)\s+cat=(?<category>\S*)\s+reason=(?<reason>.*)$
Sample events
What arrives on the wire.
securd.cef
CEF:0|Securd|DNS|2.0|greywall|api.newai-svc.xyz|5|src=10.40.3.17 dhost=api.newai-svc.xyz cat= reason=first-seen
CEF:0|Securd|DNS|2.0|block|exfil-data.click|7|src=10.40.3.17 dhost=exfil-data.click cat=malware reason=blacklist
CEF:0|Securd|DNS|2.0|accept|api.openai.com|1|src=10.40.3.17 dhost=api.openai.com cat=ai-services reason=policy
Verification
Two queries: one confirms ingestion, one lists first-seen destinations by policy.
Last 10 events arrived
spl
sourcetype="securd:dns" | head 10 | table _time action dns_q_name client_ip category reasonFirst-seen destinations per source, last 24h
spl
sourcetype="securd:dns" action=greywall earliest=-24h
| stats count min(_time) as first_seen by client_ip dns_q_name
| sort -countEvaluate Agent DNS with your own agent traffic
Forward events from a single policy and review them with your security team.