Skip to content

SIEM Integration

SentriKat can forward vulnerability events to your SIEM via syslog, enabling centralized security monitoring and correlation with other security data sources.

Which plans include it

Cloud: Pro and above. On-premises: Professional.

What is forwarded

SentriKat forwards one kind of event: new_vulnerability, a new match between a product in your inventory and a vulnerability. Every new match is forwarded, for the organizations that have forwarding on. There are no filters: you cannot select by severity, event type or organization. The Test Connection button sends a test event.

Choose the format your collector parses best: CEF, JSON or RFC 5424. Any collector that accepts syslog can receive the events.

Configuration

Where SIEM forwarding is configured

SIEM forwarding is configured in the application, not in .env. The settings live in the database and are edited from the admin UI, so a change takes effect without a restart.

Go to Settings > SIEM / Syslog and set:

Setting Values Default
Enabled on / off off
Host your collector's hostname or IP none
Port usually 514 514
Protocol udp or tcp udp
Format cef, json, or rfc5424 cef
Facility syslog facility local0

Syslog forwarding is plaintext

There is no TLS syslog support: events are sent over plain UDP or TCP. Keep the collector on a trusted network segment, or terminate TLS with a local forwarder (rsyslog, syslog-ng, Vector) that SentriKat delivers to over loopback.

To set it up:

  1. Go to Settings > SIEM / Syslog
  2. Enter your SIEM host and port
  3. Select the log format
  4. Click Test Connection
  5. Save

Log Formats

Every message starts with the syslog priority and a timestamp. In the examples, <PRI> stands for the priority value.

CEF (Common Event Format)

<PRI>2026-02-11T10:30:00Z SentriKat CEF:0|SentriKat|VulnerabilityManagement|1.0|new_vulnerability|CVE-2024-3400 CRITICAL|10|cveId=CVE-2024-3400 product=Palo Alto Networks PAN-OS msg=<description> vendor=Palo Alto Networks dueDate=2024-04-19 ransomware=true

vendor, dueDate and ransomware appear only when they have a value. The CEF severity is 10 for Critical, 8 for High, 5 for Medium and 3 for Low.

JSON

<PRI>2026-02-11T10:30:00Z SentriKat {"timestamp":"2026-02-11T10:30:00Z","source":"SentriKat","event_type":"new_vulnerability","cve_id":"CVE-2024-3400","severity":"Critical","product":"PAN-OS","message":"<description>","vendor":"Palo Alto Networks","due_date":"2024-04-19","ransomware":true}

The JSON object follows the syslog header on the same line. vendor, due_date and ransomware appear only when they have a value.

RFC 5424

<PRI>1 2026-02-11T10:30:00Z SentriKat VulnerabilityManagement - new_vulnerability - CVE-2024-3400 CRITICAL <product>: <message>

This format carries no structured data.

Syslog priority

The priority is the facility times 8 plus the severity: Critical 2, High 3, Medium 4, Low 5. With facility local0 (16), a Critical event has priority 130.

Collector side

On your collector, open a syslog input (UDP or TCP) on the port you set in SentriKat, then parse the message part that follows the header according to the format you chose. For the JSON format, the message is a single JSON object.

Testing

Use Test Connection in Settings > SIEM / Syslog, then check that the test event arrives at your collector.

Troubleshooting

Events Not Arriving

  1. Verify that forwarding is Enabled in Settings > SIEM / Syslog
  2. Check network connectivity: docker compose exec sentrikat nc -zv siem.company.local 514
  3. Verify your SIEM is listening on the configured port
  4. Check SentriKat logs: docker compose logs sentrikat | grep SIEM

Next Steps