Syslog CEF over TLS

The Syslog CEF sink delivers Alphyn events as ArcSight Common Event Format (CEF) records wrapped in an RFC 5424 syslog frame over TLS. CEF is the native format for Micro Focus / OpenText ArcSight and is accepted by most syslog-based SIEMs, which makes this sink the broadest way to bring Alphyn telemetry into an existing collector.

Configure it in the Alphyn dashboard under Integrations, using integration key syslog_cef.

Configuration

Field	Required	Default	Description
host	Yes	-	Hostname or IP of the syslog / CEF collector.
port	No	6514	TLS syslog port on the collector.
ca_cert	No	-	PEM certificate used to pin the SIEM’s CA and validate the server.
client_cert	No	-	PEM client certificate for mutual TLS.
client_key	No	-	PEM private key paired with client_cert for mutual TLS.
framing	No	octet_counting	Frame delimiting: octet_counting (RFC 6587) or newline.

TLS is always required for this sink. Provide ca_cert to pin the collector’s issuing CA, and supply the client_cert and client_key pair when the collector requires mutual TLS.

Note

Use octet_counting framing with collectors that follow RFC 6587 length-prefixed framing (the ArcSight Syslog NG and TLS connectors do). Choose newline framing for collectors that expect one record per line.

Record format

Each event is a CEF record inside a standard syslog header:

CEF:0|Byteria|Alphyn|<schemaVersion>|<signatureId>|<name>|<severity>|<extension>

The signatureId, name, and severity (0-10) reflect the event, and the extension carries the Alphyn field set. THREAT and AUDIT records use different extension keys; the full key tables are on the Parsing and field mapping page.

THREAT example

<134>1 2026-07-16T09:41:22.000Z alphyn.byteria.dev alphyn - - - CEF:0|Byteria|Alphyn|1|ROOT-V1|Root detected|9|externalId=evt_8f21a0 deviceExternalId=dev_5521 cat=ROOT msg=Root management binary present src=203.0.113.24 cs1Label=Package cs1=com.acme.banking cs2Label=AppVersion cs2=4.8.1 cs3Label=AppHash cs3=9ad1f0c4 cs4Label=OS cs4=Android 14 cs5Label=EventType cs5=SECURITY_SIGNAL cs6Label=TenantId cs6=acme deviceCustomDate1Label=OccurredAt deviceCustomDate1=2026-07-16T09:41:21.880Z

AUDIT example

<134>1 2026-07-16T09:42:05.000Z alphyn.byteria.dev alphyn - - - CEF:0|Byteria|Alphyn|1|API_KEY_REVOKED|API key revoked|5|externalId=aud_2b70e1 suid=usr_104 suser=jsmith src=198.51.100.9 requestClientApplication=Mozilla/5.0 cs1Label=ActorEmail [email protected] cs2Label=ResourceType cs2=ApiKey cs3Label=ResourceId cs3=key_7781 cs4Label=Category cs4=API_KEY cs5Label=EventType cs5=API_KEY_REVOKED cs6Label=TenantId cs6=acme deviceCustomDate1Label=OccurredAt deviceCustomDate1=2026-07-16T09:42:04.900Z

Setup on the SIEM side

1. Stand up a TLS syslog receiver on your collector (for ArcSight, a Syslog NG Daemon or TLS SmartConnector; for a generic SIEM, a TLS syslog input) listening on the port you will set as port.
2. Note the receiver’s TLS certificate chain. Export the issuing CA certificate as PEM if you want Alphyn to pin it via ca_cert.
3. If the receiver requires client authentication, issue a client certificate and key for Alphyn and set client_cert and client_key.
4. In the Alphyn dashboard, add a Syslog CEF over TLS integration, enter host, port, and any certificate fields, and set the delivery filter.
5. Choose framing to match your collector: octet_counting for RFC 6587 length-prefixed input, newline otherwise.
6. Click Test connection to deliver a synthetic event through the real TLS transport, then confirm it arrives and parses. ArcSight recognizes the CEF header natively; other SIEMs may use the CEF field map on the Parsing and field mapping page.