Listeners
| Transport | When to use |
|---|---|
| Syslog over TLS | Any sender that can do TLS. Required across untrusted networks. |
| Syslog over UDP or TCP | Legacy devices on a trusted segment. |
The deployment's listener ports are in its environment file. Senders using TLS must trust the ingest CA certificate from your bundle.
Formats
XenXDR recognises RFC 3164 and RFC 5424 framing, and within the message, CEF and LEEF payloads. Anything else is kept as a message with the syslog header fields parsed. Syslog events carry event.module: syslog.
Example: FortiGate
On the FortiGate, add a syslog server pointing at the deployment, choose reliable syslog with TLS if the firmware supports it, and use the default log format. Separately, the FortiGate response action lets a playbook block addresses on the same device. See Response actions.
Example: Linux host without the agent
Configure rsyslog or syslog-ng to forward auth and authpriv at minimum over TLS to the listener. For fuller coverage, install the agent; it adds process auditing and response.
Tenancy
Syslog carries no credential, so every syslog event lands in the deployment's default organization. To send a customer's syslog into their own organization, forward it through a relay that posts to the HTTP JSON endpoint with that organization's ingest key.