Integrate Your Syslog Data Source with the Security Data Lake

Updated on 12 Nov 2024
1 Minute to read

Article summary

Did you find this summary helpful?

Thank you for your feedback

Any external data source that can be configured to forward logs from a Syslog receiver can forward data to the Red Canary Security Data Lake.

By integrating your security logs with the Red Canary Security Data Lake, you can meet data retention requirements, export logs when needed for investigation or reporting, and ensure greater visibility into your security infrastructure for your team and Red Canary. To integrate an external data source with Red Canary through Syslog, follow the procedure below from beginning to end.

Step 1: Red Canary–Create your Red Canary generated URL

From your Red Canary dashboard navigate to Integrations, click the split button to the right of Add Integration, and click Add Data Lake Integration.
Enter a name for your integration.
Under Ingest Format / Method, select Data Source via Syslog (Security Data Lake).
Select the desired data retention period in days (default: 90).
Click Save.
Click Edit Configuration.
Click Activate.
After a few minutes, Red Canary will generate a URL and Port that you will use to set up log forwarding in your external data source. Copy and then save these values. You will use them in a later step.
These configuration settings will not be generated until the Red Canary integration is saved and activated.

Step 2: External Data Source–Configure log forwarding

From your external data source, set up log forwarding using the URL and Port values noted in the previous section.
Ensure that the data source is configured to emit logs in a Syslog-compatible format.
Examples of Syslog-compatible formats: RFC 3164, RFC 5424, etc.

Was this article helpful?

What's Next

Integrate Your AWS S3 Data Source with the Security Data Lake

Table of contents

Step 1: Red Canary–Create your Red Canary generated URL
Step 2: External Data Source–Configure log forwarding