Syslog Sources¶

Some security platforms push their events to WitFoo Conductor as syslog instead of being polled through an API. They send to the Conductor Signal Server, which listens for syslog on TCP and UDP 514 and on port 6514. Port 6514 uses TLS when TLS is enabled on the Conductor node (the configuration wizard's default); plain TCP otherwise (see Log Server Configuration).

This is different from the pull-based API integrations, where the Signal Client polls a vendor API. With a syslog source, the platform connects to Conductor and pushes events as they happen.

flowchart LR
    A["OT security platform<br/>(Nozomi Networks, Dragos)"] -->|"CEF over syslog · TCP/UDP 514, 6514"| B["Conductor<br/>Signal Server"]
    B -->|"artifacts.raw"| C["NATS JetStream"]
    C --> D["Signal Parser → WitFoo Analytics"]

Guides¶

Source	Format	Guide
Nozomi Networks (Guardian, CMC)	CEF over syslog	Set up →
Dragos Platform	CEF over syslog	Set up →

Prefer TCP or TLS

UDP syslog can drop messages under load because it has no delivery guarantee. Use TCP 514 or 6514 for alerts you need to keep.