Syslog

Syslog is a connector path for receiving infrastructure and security events from devices and services.

Planning questions

• Which sources should send events?
• Will transport be UDP, TCP, or TLS where supported?
• What retention and parsing rules are required?
• Which event categories should be visible in Desktop?

Operational guidance

Begin with a small source set and document message formats before enabling broad forwarding.