Skip to content

Connect Enginsight SIEM

The gateway streams security events as syslog: blocked requests, guardrail hits and PII scrubs (from a gateway- or tenant-level SIEM configuration), and authentication and authorization failures (from the tenant-level configuration only — see Step 2). Enginsight receives syslog through an Event Relay — the Enginsight agent Pulsar acting as a syslog receiver — and forwards it to the Enginsight SIEM.

This page shows the Event Relay settings and the matching gateway SIEM configuration. For the general SIEM options (event filter, other backends) see SIEM integration.

What the gateway sends

Each event is one RFC 5424 syslog message whose message body is a CEF record:

<131>1 2026-10-12T04:57:25.073Z ai.myra.eu myra-ai-gateway - - - CEF:0|Myra Security|AI Gateway|1.0|IP_BLOCKED|Request blocked by IP allowlist|7|rt=1791781045073 dvchost=ai.myra.eu src=198.51.100.23 act=blocked externalId=6e2158a1-25e0-4c47-bcbb-809316371d2f deviceExternalId=00000000-e2e0-4001-a000-000000000000 destinationServiceName=compat reason=198.51.100.23 cs1Label=blocked_by cs1=ip_allowlist cs4Label=tenant_id cs4=00000000-e2e0-4000-a000-000000000000 cfp1Label=cost_usd cfp1=0 cn1Label=status cn1=403

This line was captured from a test gateway (an IP-allowlist block). Over TCP the same message is preceded by its length in bytes and a space (<length> <131>1 …) — octet-counting framing per RFC 6587.

Transport Framing on the wire Enginsight Event Relay Format
UDP One message per datagram RFC5424
TCP Octet counting: <length> <message> RFC6587
TLS Octet counting inside TLS RFC6587 (see TLS for the certificate requirement)

The Enginsight knowledge base describes the same distinction: a message that starts with <PRI>1 and an ISO-8601 time stamp is RFC 5424; a TCP packet that starts with a number and a space is octet-counting framing (RFC 6587). The relay's Format must match what the gateway sends — otherwise no logs arrive.

Before you begin

  • ☑ An Enginsight host with Pulsar installed and the SIEM-Integration core feature enabled in its host settings (required to select it as an Event Relay host).
  • ☑ The relay port is reachable from the gateway: the gateway connects to the relay, not the other way round. Open the port in the firewall in front of the relay host for the gateway's outbound addresses (ask your Myra contact for them).
  • ☑ You can edit the gateway (a tenant_admin with the GATEWAYS_MANAGE permission, or a platform admin) — or the tenant, through the API.

Step 1 — Create the Event Relay in Enginsight

Proceed as follows to create the Event Relay:

  1. In the Enginsight platform, open SIEM → Allgemeine Kollektoren → Event Relay.
  2. Click on Kollektor-Relais hinzufügen.
  3. Enter a Name (for example Myra AI Gateway).
  4. Select the Pulsar host in Hosts.
  5. Keep Bind-Adresse 0.0.0.0, or enter the address the gateway connects to.
  6. Enter a Port that no other Event Relay on this host uses (for example 5140). Every syslog format needs its own relay and port.
  7. Select the Protokoll: UDP, TCP or TLS (for TLS see the certificate requirement in TLS).
  8. Select the Format for that protocol: RFC5424 for UDP, RFC6587 for TCP and TLS.
  9. Under Automatisches Log-Parsing, enable Common Event Format (CEF), so the CEF body is parsed into fields.
  10. Click on Kollektor hinzufügen.
    • The Event Relay is listed with its protocol, port and format.

Step 2 — Point the gateway at the relay

Proceed as follows to configure the gateway:

  1. Open Settings → Gateways and click on the gateway.
  2. Click on Edit, choose Notifications (in the Integrations group) and scroll to SIEM Integration.
  3. Select Syslog / CEF in the drop-down list under SIEM Integration.
  4. Enter the relay host in Host (the Pulsar host's address) and the relay port in Port.
  5. Select the same Protocol as the relay (UDP, TCP or TLS).
  6. Select CEF (RFC 5424 syslog) in Format.
  7. Under Events to forward, select the events (for example blocked and guardrail). The form offers blocked, guardrail, scrubbed and all (every request); use the filter box to narrow the list. If you select none, the gateway sends blocked requests only, unless the configuration also holds security or access events set through the API: the form keeps those and they then apply.
  8. Click on Save Changes.

-> The gateway sends matching events to the Event Relay.

The same configuration as JSON, as the gateway's config.siem:

{
  "siem": {
    "type": "syslog",
    "host": "pulsar-relay.example.com",
    "port": 5140,
    "protocol": "udp",
    "format": "cef",
    "events": ["blocked", "guardrail"]
  }
}

Authentication and authorization failures (sign-in denials, access-denied) and tool-access decisions of agents (see Field mapping) are not tied to a gateway: they are sent only to the tenant-level SIEM configuration. A gateway's own SIEM configuration overrides the tenant configuration for that gateway's request events. To receive them in Enginsight, also set the tenant's siem (it applies to every gateway of the tenant without its own configuration):

PATCH /admin/v1/tenants/{id}
Content-Type: application/json

{
  "siem": {
    "type": "syslog",
    "host": "pulsar-relay.example.com",
    "port": 5140,
    "protocol": "udp",
    "format": "cef",
    "events": ["blocked", "guardrail", "security"]
  }
}

For TCP, set "protocol": "tcp" and the relay Format to RFC6587.

💡 Note: A relay on a private address (for example 10.x.x.x) is accepted only on deployments where the operator has enabled SIEM delivery to private targets. Otherwise the gateway rejects the host with 400 when you save. See SIEM targets.

Step 3 — Verify that events arrive

  1. Trigger an event your filter forwards — for example a request your guardrails block.
  2. On the relay host, check that the gateway's packets arrive (as in the Enginsight troubleshooting article): sudo tcpdump -ni any port 5140 -A. A UDP payload starts with <13…>1 20…; a TCP payload starts with a number, a space and <13…>1.
  3. In Enginsight, open SIEM → Data Lake and filter on the Event Relay. Allow a few minutes for the first events.

If nothing arrives, compare the relay's Protokoll, Port and Format with the table in What the gateway sends. The gateway logs delivery failures on its side only; they are not shown in the UI.

Field mapping

Enginsight's CEF reference maps cef.src to its generic source-IP field (gen.src.ip) and cef.Vendor / cef.Product to gen.vendor / gen.product. All other keys are available as cef.<key> fields. The gateway uses only standard CEF keys:

CEF key Enginsight field Content
Header: Vendor / Product / Version cef.Vendor (gen.vendor) / cef.Product (gen.product) / cef.ProductVersion Myra Security / AI Gateway / 1.0
Header: Event class / Name / Severity cef.EventClassID / cef.Message / cef.Severity For example GUARDRAIL_BLOCK / Request blocked by guardrail / 7 — see the event classes
rt cef.rt Event time, Unix milliseconds
dvchost cef.dvchost Deployment host name, for example ai.myra.eu
src cef.src → gen.src.ip Client IPv4 address (security events: the actor's address)
c6a2 cef.c6a2 Client IPv6 address (CEF src is IPv4-only, so an IPv6 client does not fill gen.src.ip; an IPv4-mapped client, dotted or hex, is reported as its IPv4 address in src)
suser cef.suser User id
act cef.act blocked, flagged, scrubbed, allowed, or denied
externalId cef.externalId Gateway request id
deviceExternalId cef.deviceExternalId Gateway id
destinationServiceName cef.destinationServiceName LLM provider
reason cef.reason Block reason
request cef.request Request path (security events)
cs1 … cs6 cef.cs1 … cef.cs6 (labels in cef.cs1Label …) blocked_by (security events: action), detectors, guardrail_verdict, tenant_id, model, egress
cn1 cef.cn1 (cef.cn1Label = status) HTTP status
cfp1 cef.cfp1 (cef.cfp1Label = cost_usd) Estimated cost in USD
flexString1 / flexString2 cef.flexString1 / cef.flexString2 OWASP-LLM categories / MITRE-ATLAS techniques

Tool-access decisions (event classes TOOL_ACCESS_DENIED, severity 4, and TOOL_ACCESS_ALLOWED, severity 1) use the same keys with other labels: cs1 = tool, cs2 = connector_id, cs3 = rule_id, cs4 = tenant_id, cs5 = agent_id, cs6 = owner_id, flexString1 = root_agent_id, flexString2 = actor_kind, and reason = the decision reason. Tool arguments are never sent. Without an events filter only denials are sent; access or all sends every decision.

Keys with no value are left out of a record. The full description of each value, the length limits and how untrusted values are sanitised is in SIEM integration.

TLS

The gateway can send syslog over TLS ("protocol": "tls", conventionally port 6514; relay Protokoll TLS, Format RFC6587). The gateway verifies the relay's certificate against the public CA trust store, so the relay needs a host name with a publicly-trusted certificate. A Pulsar relay with a self-signed or private-CA certificate is not supported yet — the gateway refuses the connection and delivers nothing. Support for your own CA is planned; until then use UDP or TCP on a network path you trust (for example a VPN or a private link).

Notes

  • Message size: one message is at most 8192 bytes. Normal events are far smaller.
  • Connections: over TCP and TLS the gateway opens one connection per event. Plan the relay's connection limits for your event volume (the blocked filter keeps volume low; all sends every request).
  • Format check: the message format was verified with standard syslog parsers (Vector's syslog source and an RFC 5424 parser) on a test gateway, not yet against a live Enginsight relay. If your relay receives packets but the Data Lake stays empty, re-check the relay Format first.

See also