Syslog over TLS
Sends events as syslog messages over a TLS-encrypted TCP connection. This is the recommended integration for SIEM systems.
Standards
| Standard | Description |
|---|---|
| RFC 5424 | The Syslog Protocol -- message format |
| RFC 5425 | TLS Transport Mapping for Syslog -- octet-counted framing over TLS |
TLS 1.2 or higher is required. The receiver's certificate must be issued by a publicly trusted CA and match the configured host name. The default port is 6514 (IANA standard for syslog over TLS).
Configuration
| Field | Required | Description |
|---|---|---|
| Name | Yes | A descriptive name for this forwarder |
| URL | Yes | Syslog server address as host:port (e.g. siem.company.com:6514) |
| Framing | Yes | Octet counting (RFC 5425), the default, or Newline-delimited -- see below |
| Event Filters | No | Select which event categories or types to forward |
Framing
RFC 5425 prescribes octet-counted framing: every message is prefixed with its length in bytes. rsyslog, syslog-ng, Wazuh and other spec-compliant receivers expect it.
Some receivers treat TLS syslog as plain TCP syslog and expect one message per line instead. Choose Newline-delimited for Splunk, Graylog, Logstash and similar receivers: the length prefix is dropped and each message ends with a line feed.
Message Format
Each event is sent as an individual RFC 5424 message:
<LEN> <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID STRUCTURED-DATA MSG
<LEN> is the octet count and is absent with newline-delimited framing.
Field mapping:
| Syslog Field | Value |
|---|---|
| Facility | local0 (16) |
| Severity | informational (6) |
| PRI | <134> |
| VERSION | 1 |
| TIMESTAMP | Event creation time: RFC 3339, UTC, millisecond precision (2026-04-09T11:49:44.123Z) |
| HOSTNAME | Tenant UUID |
| APP-NAME | xplicittrust |
| PROCID | - (nil) |
| MSGID | <event_class>.<event_type> |
| STRUCTURED-DATA | [xplicittrust tenant="..." event_id="..." session_id="..." event_class="..." event_type="..." session_type="..." remote_addr="..."] |
| MSG | JSON object containing all event fields |
Example Message
<134>1 2026-04-09T11:49:44.123Z a1b2c3d4-e5f6-7890-abcd-ef1234567890 xplicittrust - authentication.session_refresh [xplicittrust tenant="a1b2c3d4-e5f6-7890-abcd-ef1234567890" event_id="12345" session_id="f0e1d2c3-b4a5-6789-0abc-def123456789" event_class="authentication" event_type="session_refresh" session_type="client" remote_addr="198.51.100.42"] {"asn":1234,"asn_organization":"Example ISP","auth_type":"azure_ad_oidc","city":"Berlin","client_name":"laptop-jdoe","client_version":"1.132.6001","country":"DE","created_at":"2026-04-09T11:49:44.123Z","event_class":"authentication","event_id":12345,"event_type":"session_refresh","message":"jdoe@example.com session_refresh","os":{"name":"windows","platform":"10 Pro","version":"10.0.19045"},"remote_address":"198.51.100.42","session_id":"f0e1d2c3-b4a5-6789-0abc-def123456789","session_type":"client","tenant_name":"Acme Corp","user_email":"jdoe@example.com"}
JSON Message Fields
The message body is a JSON object with every event field, so decoders that discard the syslog header and the structured data still see everything. Keys are in alphabetical order.
| Field | Description | Present |
|---|---|---|
event_id |
Event id: an integer, unique and increasing. The same value as event_id in the structured data. Deduplicate on it |
Always |
event_class |
Event category (authentication, client_status, etc.) | Always |
event_type |
Event subtype (logged_in, access_denied, etc.) | Always |
session_type |
Session type (command_console, partner_portal, asset, client, web_app) | Always |
message |
Human-readable event description | Always |
created_at |
Event creation time (RFC 3339, UTC, millisecond precision) -- the same value as the syslog header TIMESTAMP | Always |
remote_address |
Source IP address, without a port; unknown for events the server raises on its own |
When available |
session_id |
Session UUID for correlation | When available |
client, user, host |
UUIDs of the device, the user and the device's host record | Events with client context |
auth_type |
Authentication method (azure_ad_oidc, api_key, asset, etc.) | Auth events |
role |
User role | Console/partner sessions |
user_email |
User email address | User sessions |
client_name |
Client hostname | Client/asset events |
tenant_name |
Tenant name | Most events |
city, country |
Client geolocation | Auth/status events with client context |
os |
OS info as object (name, platform, version) |
Auth/status events with client context |
client_version |
XTNA agent version | Auth/status events with client context |
asn, asn_organization |
Network/ISP information | Auth/status events with client context |
object_type, object_id, object_name |
Affected object | Configuration events, notifications |
reason |
Denial reason | Authorization events |
client_ip |
Blocked client IP address | Access control events |
login_ip |
Original login IP address | Session IP mismatch events |
| per-class fields | See the Event Reference | Network monitoring, client resources, notifications |
The event creation time is carried twice: in the syslog header TIMESTAMP and as created_at inside the JSON body. The JSON copy exists for receivers that discard the syslog header during decoding (e.g. Wazuh) -- see Wazuh: Original Event Time for how to index alerts at the time the event actually occurred.
SIEM Compatibility
XplicitTrust sends RFC 5424 messages, by default with octet-counted framing (RFC 5425). Not every receiver supports that framing over TLS; for those, switch the forwarder to Newline-delimited.
| SIEM | Native Support | Notes |
|---|---|---|
| Splunk | Yes | TCP input with SSL; use Newline-delimited framing |
| Elastic / Logstash | Yes | tcp input with TLS; use Newline-delimited framing |
| Graylog | Yes | Syslog TCP input with TLS; use Newline-delimited framing |
| rsyslog | Yes | imtcp with TLS; octet-counted framing is supported out of the box |
| syslog-ng | Yes | syslog() source with transport(tls) |
| QRadar | Yes | TLS Syslog log source; switch to Newline-delimited framing if messages do not parse |
| Wazuh | No | Requires TLS termination and format conversion. See Wazuh for decoder and rules. |
For receivers without TLS support, place a TLS termination proxy (e.g. stunnel) and, if needed, a format translator (e.g. rsyslog) in front of the receiver.
Connection Behavior
- One persistent TLS connection per forwarder, re-established automatically. Connecting is limited to 10 seconds.
- A batch of events is written in one go with a 10-second deadline. If the write fails, the connection is re-established once and the batch written again. If that fails too, the delivery counts as failed and is retried later with a smaller batch (see Delivery).
- Syslog has no application-level acknowledgement. A successful write is treated as successful delivery, so messages written into a connection the receiver has silently dropped are lost, and messages the receiver discards after accepting them are invisible to the forwarder. Receivers should deduplicate on
event_id, because a batch can also be delivered twice.