Syslog

Sumo Logic

Add a syslog source to an installed collector and set the source category to securd/dns.

Integration steps for Sumo Logic

Turn on syslog forwarding

In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.

Settings > Log Forwarding

Syslog host: collector.example.internal
Syslog port: 514

Verification

Two queries: one confirms ingestion, one lists first-seen destinations by policy.

Last 10 events arrived

text

_sourceCategory=securd/dns | limit 10

First-seen per source, last 24h

text

_sourceCategory=securd/dns "|greywall|" | parse "src=* dhost=*" as src, dhost | count by src, dhost | sort by _count

Event reference Splunk Microsoft Sentinel Elastic Datadog Google SecOps (Chronicle)IBM QRadar Cribl Stream and OpenTelemetry Collector Splunk SOAR, Cortex XSOAR, Tines and Torq

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy and review them with your security team.

See It Live View Pricing