category: Analytics & SIEM
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: Syslog Sender
  version: -1
configuration:
- display: IP Address (e.g., 127.0.0.1)
  name: address
  type: 0
  section: Connect
  additionalinfo: A Syslog server address must be provided. Note, the maximal supported length of a label inside an address is 64 characters.
  required: false
- defaultvalue: '514'
  display: Port
  name: port
  type: 0
  section: Connect
  additionalinfo: When using UDP or TCP, port 514 is the default. When using TLS, port 6514 is the default.
  required: false
- defaultvalue: UDP
  display: Protocol
  name: protocol
  options:
  - TCP
  - UDP
  - TLS
  type: 15
  section: Connect
  advanced: true
  additionalinfo: TLS versions supported are 1.2 and above.
  required: false
- name: certificate
  type: 9
  section: Connect
  displaypassword: Certificate
  hiddenusername: true
  additionalinfo: Required for TLS.
  required: false
- display: Self Signed Certificate
  name: self_signed_certificate
  type: 8
  section: Connect
  additionalinfo: Required for TLS. Check if the certificate is self signed.
  required: false
- defaultvalue: LOG_USER
  display: Facility
  name: facility
  options:
  - LOG_AUTH
  - LOG_AUTHPRIV
  - LOG_CRON
  - LOG_DAEMON
  - LOG_FTP
  - LOG_KERN
  - LOG_LPR
  - LOG_MAIL
  - LOG_NEWS
  - LOG_SYSLOG
  - LOG_USER
  - LOG_UUCP
  - LOG_LOCAL0
  - LOG_LOCAL1
  - LOG_LOCAL2
  - LOG_LOCAL3
  - LOG_LOCAL4
  - LOG_LOCAL5
  - LOG_LOCAL6
  - LOG_LOCAL7
  type: 15
  section: Connect
  advanced: true
  required: false
- defaultvalue: LOG_INFO
  display: Log level to send
  name: priority
  options:
  - LOG_DEBUG
  - LOG_INFO
  - LOG_WARNING
  - LOG_ERR
  - LOG_CRIT
  type: 15
  section: Collect
  advanced: true
  required: false
- defaultvalue: Low
  display: Minimum severity of incidents to send messages on
  name: severity
  options:
  - Unknown
  - Low
  - Medium
  - High
  - Critical
  type: 15
  section: Collect
  required: false
  hidden:
  - marketplacev2
  - platform
description: Use the Syslog Sender integration to send messages and mirror incident War Room entries to Syslog.
display: Syslog Sender
name: Syslog Sender
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      default: true
      defaultValue: all
      description: The mirroring type. Can be "all", which mirrors everything, "chat", which mirrors only chats (not commands), or "none", which stops all mirroring.
      name: type
      predefined:
      - all
      - chat
      - none
    description: Mirrors the investigation's War Room to Syslog.
    name: mirror-investigation
  - arguments:
    - default: true
      description: The message content.
      name: message
    - description: An entry ID to send as a link.
      name: entry
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to include a URL to the relevant component in Demisto. Can be "true" or "false". The default value is "false'.
      name: ignoreAddURL
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: The log level to send. Can be "DEBUG", "INFO", "WARNING", "ERROR", or "CRITICAL".
      name: level
      predefined:
      - DEBUG
      - INFO
      - WARNING
      - ERROR
      - CRITICAL
    description: Sends a message to Syslog. Used by the mirroring functionality.
    name: send-notification
  - arguments:
    - description: The message content.
      name: message
      required: true
    - auto: PREDEFINED
      description: The log level to send. Can be "DEBUG", "INFO", "WARNING", "ERROR", or "CRITICAL".
      name: level
      predefined:
      - DEBUG
      - INFO
      - WARNING
      - ERROR
      - CRITICAL
    - description: The Syslog server address.
      name: address
    - auto: PREDEFINED
      description: The protocol to use. Can be "TCP", "UDP", or "TLS".
      name: protocol
      predefined:
      - TCP
      - UDP
    - description: The Syslog server port.
      name: port
    - auto: PREDEFINED
      description: The Syslog facility.
      name: facility
      predefined:
      - LOG_AUTH
      - LOG_AUTHPRIV
      - LOG_CRON
      - LOG_DAEMON
      - LOG_FTP
      - LOG_KERN
      - LOG_LPR
      - LOG_MAIL
      - LOG_NEWS
      - LOG_SYSLOG
      - LOG_USER
      - LOG_UUCP
      - LOG_LOCAL0
      - LOG_LOCAL1
      - LOG_LOCAL2
      - LOG_LOCAL3
      - LOG_LOCAL4
      - LOG_LOCAL5
      - LOG_LOCAL6
      - LOG_LOCAL7
    description: Sends a message to Syslog.
    name: syslog-send
  dockerimage: demisto/syslog:1.0.0.10133006
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Test Syslog
fromversion: 5.5.0