Syslog / CEF
The Syslog / CEF connector (syslog_cef, category network) pulls generic syslog + ArcSight CEF and normalizes each into the AiSOC alert shape, mapping the source severity onto the five-tier ladder (info | low | medium | high | critical).
Setup
- In Connectors -> Add connector, choose Syslog / CEF.
- Fill in the connection fields shown in the wizard (endpoint URL + API token; secrets are stored in the credential vault, never in plaintext).
- Click Test connection to verify credentials, then Save. The in-process scheduler begins polling on the default cadence.
Events flow through ingest (OCSF normalize) -> Kafka -> fusion, where detections fire and alerts are auto-triaged (copilot).
Configuration reference
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
spool_url | Spool URL | string | yes | — | — |
api_token | Spool token | secret | yes | — | encrypted at rest |
verify_tls | Verify TLS certificate | boolean | no | True | — |
Credential handling
api_token is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API. See credential vault.