Syslog (CEF / LEEF)
Leak events are sent to your SIEM collector in CEF or LEEF format over an encrypted syslog connection.
How it works
This is the widest-reaching SIEM route. Nearly every enterprise SIEM — QRadar, ArcSight, LogRhythm, Securonix, Exabeam and Rapid7 among them — accepts one of these two formats, so no product-specific integration is needed.
The connection runs over TLS (6514) or TCP. Framing is octet-counting: the byte count precedes every message, so the collector knows exactly where a message ends.
Syslog returns no acknowledgement. A delivery counts as successful once the connection is made and the write completes; that does not mean the SIEM indexed the event.
Severity mapping
| Dark Radar | CEF / LEEF | Syslog |
|---|---|---|
| Critical | 10 | 2 |
| High | 8 | 3 |
| Medium | 5 | 4 |
| Low | 3 | 5 |
| Info | 1 | 6 |
Limits
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.