Listeners
| Transport | When to use |
|---|---|
| Syslog over TLS | Any sender that can do TLS. Required across untrusted networks. |
| Syslog over UDP or TCP | Legacy devices on a trusted segment. |
The deployment's listener ports are in its environment file. Senders using TLS must trust the ingest CA certificate from your bundle.
Formats
XenXDR recognises RFC 3164 and RFC 5424 framing, and within the message, CEF and LEEF payloads. Vendor-specific key-value formats are recognised for the sources in the catalog; anything else is kept as a message with the syslog header fields parsed.
Example: FortiGate
On the FortiGate, add a syslog server pointing at the deployment, choose reliable syslog with TLS if the firmware supports it, and use the default log format. Events arrive with event.module: fortigate, and the FortiGate response action can block addresses on the same device from a playbook. See Response actions.
Example: Linux host without the agent
Configure rsyslog or syslog-ng to forward auth and authpriv at minimum over TLS to the listener. For fuller coverage, install the agent; it adds process auditing and response.
Tenancy
Syslog carries no credential, so the listener assigns organization by sender address: map sender ranges to organizations in Settings › Integrations › Syslog sources. Unmapped senders land in the default organization and are flagged on the data-source health panel.