Graylog
Leak events are sent to Graylog in GELF format.
How it works
The connection runs over a GELF HTTP input. If the input requires authentication a username and password are supplied; if not, they are left empty.
Delivery is one-way. No search is run in Graylog.
Fields delivered
| Field | Content |
|---|---|
short_message | Event title |
full_message | Summary |
level | Syslog severity: critical 2 · high 3 · medium 4 · low 5 · info 6 |
_event_id | Event identifier |
_severity | Severity |
_kind | Event type |
_source | dark-radar |
_link | The event’s address in the panel |
In GELF custom fields start with an underscore; Graylog silently drops the ones that do not. The event identifier is therefore sent as _event_id — _id is forbidden in GELF.
Limits
Records are written only to the named input.
The leaked value itself is not in the record.
Turning the connection off stops delivery.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.