API settings belong to one product key (one CID). The first option sends Event Collector events to a Syslog collector such as QRadar or ArcSight.
Mikiri WAF opens the connection. The collector does not call the API.
Available on the same plan as the Event Collector (
Enterprise). The plan is checked on the account side and is not checked by these methods.Forwarding runs in the API auxiliary process. With
EC_STORAGE_PERIODset to0, events are not stored, so there is nothing to send. In read-only mode the sender is not started.
In WMC an administrator sets this under System → API. The product key selected in the header is the CID the settings apply to.
syslog_sent on an event row is empty until the API writes the frame to the collector. Syslog over TCP (RFC 6587) and TLS (RFC 5425) does not confirm that the SIEM parsed the event. A completed write means the collector accepted the bytes. If the connection fails, the row stays empty and the next pass retries it.
Rows that are already marked are not sent again, including after the collector address changes. Events stored while forwarding was off are sent once it is turned on, until the retention period deletes them.
The message is RFC 5424. The body is CEF. Both TCP and TLS use octet counting. The facility is local0.
| Event level | Syslog severity | CEF severity |
|---|---|---|
debug |
debug (7) | 0 |
info |
info (6) | 3 |
warn |
warning (4) | 5 |
error |
error (3) | 8 |
fatal |
critical (2) | 10 |
The CEF header is Mikiri Security|Mikiri WAF|1.0|{agent}:{category}|{category}|{severity}.
Extension fields:
rt — event time in milliseconds;src — agent IP address;cs1 — agent (cs1Label is Agent);cs2 — agent IID (cs2Label is IID);cs3 — CID (cs3Label is CID);cat — event category;externalId — event id;msg — description, at most 2048 characters.TLS checks the server certificate against the system trust store. verify: false skips the check. TCP ignores verify.
Opens the collector and writes one test frame. The settings are not saved, and no event row is stored.
The check runs on the API host that forwards events. A completed write means the collector accepted the bytes. Syslog does not confirm that the SIEM parsed the event.
Request example:
curl http://api.example.com:8080/check/v1/syslog --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"host": "10.10.10.50",
"port": 6514,
"protocol": "tls",
"verify": true
}'
| Parameter | Type | Description |
|---|---|---|
host |
string | Collector host name or IP. Required |
port |
integer | Port from 1 to 65535. Default 6514 for tls, 514 for tcp |
protocol |
string | tcp or tls. Default tls |
verify |
boolean | Verify the TLS certificate. Default true. Ignored for tcp |
{"status": "success"}
A failed connection returns status fail and the connection error in description.
Request example:
curl http://api.example.com:8080/settings/v1/get_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%"
}'
Missing settings return the defaults.
{
"status": "success",
"syslog": {
"enabled": false,
"host": "",
"port": 6514,
"protocol": "tls",
"format": "cef",
"ec": false,
"verify": true
}
}
Replaces the syslog object for this CID. Other options stored next to it are left in place.
Request example:
curl http://api.example.com:8080/settings/v1/set_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"syslog": {
"enabled": true,
"host": "10.10.10.50",
"port": 6514,
"protocol": "tls",
"format": "cef",
"ec": true,
"verify": true
}
}'
| Parameter | Type | Description |
|---|---|---|
enabled |
boolean | Send events. Default false |
host |
string | Collector host name or IP. Required when enabled is true |
port |
integer | Port from 1 to 65535. Default 6514 for tls, 514 for tcp |
protocol |
string | tcp or tls. Default tls |
format |
string | cef |
ec |
boolean | Forward Event Collector events. Required true when enabled is true. Default false |
verify |
boolean | Verify the TLS certificate against the system trust store. Default true |
{"status": "success", "syslog": {}}
syslog in the response is the stored object.