SIEM
Syslog TLS (CEF or JSON)
TechWatchAlert security events in your syslog collector, encrypted over TLS, in CEF or JSON.
What the connector does
TechWatchAlert sends your organization's security events to your syslog collector as they happen, over TLS-encrypted TCP: a CVE hitting an asset, a decision tier going up, reported exploitation, a machine fixed, a case reopened, a compliance or external attack surface finding. The body is in CEF (ArcSight, QRadar…) or JSON.
What comes into TechWatchAlert
- Detected vulnerabilities, tier and status changes, reported exploitation, reopened cases and verified fixes
- Machines that became exposed or were fixed, compliance and external attack surface findings
- Optionally, the actions in your organization's audit log
- A stable, versioned schema, timestamped in UTC, with a stable event ID for deduplication
Setup
- In Organization settings › Security › SIEM, choose Syslog (TLS)
- Enter your collector's host and port (6514 by default), the CEF or JSON format and, if needed, your internal certificate authority
- Choose the event types, minimum severity and projects, then “Test and save”: a test event is sent
In the same family
SplunkTechWatchAlert security events in Splunk through the HTTP Event Collector, ready to correlate.View connector →Microsoft SentinelTechWatchAlert security events in a table of your Log Analytics workspace, queryable in KQL.View connector →ElasticTechWatchAlert security events in an Elasticsearch data stream, with ECS fields.View connector →
Connectors
Plug in your tools in minutes
Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.
Free plan, no credit card · hosted in France