category: Analytics & SIEM
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: Syslog v2
  version: -1
configuration:
- name: creds_certificate
  display: Certificate
  type: 9
  section: Connect
  displaypassword: Private Key
  required: false
- display: Certificate
  additionalinfo: Required for TLS
  name: certificate
  type: 12
  section: Connect
  hidden: true
  required: false
- display: Private Key
  name: private_key
  type: 14
  additionalinfo: Required for TLS
  section: Connect
  hidden: true
  required: false
- display: Message Regex Filter For Incidents Creation.
  additionalinfo: Creates an incident in Cortex XSOAR for every received log message that matches this regex.
  name: message_regex
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: "514"
  display: Port mapping
  name: longRunningPort
  required: true
  type: 0
  section: Connect
  additionalinfo: In the format <port> or <host port>:<docker port>. Port 6514 is the default when using TLS.
- defaultvalue: "true"
  display: Long Running Instance
  name: longRunning
  type: 8
  hidden: true
  section: Connect
  advanced: true
  required: false
description: A Syslog server enables automatically opening incidents from Syslog clients. This integration supports filtering logs to convert to incidents, or alternatively converting all logs.
display: Syslog v2
name: Syslog v2
script:
  commands:
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type. This command should be used for debugging.
  runonce: false
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/syslog:1.0.0.10133006
  longRunning: true
  longRunningPort: true
  isFetchSamples: true
  ismappable: true
fromversion: 6.0.0
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
triggers:
  - conditions:
      - name: engine
        operator: not_exists
      - name: isEngineGroup
        operator: not_exists
    effects:
      - name: longRunningPort
        action:
          hidden: true
          required: false