Skip to main content
The relay treats alert and case forwarding as two independently configured streams. Each stream has its own interval and destination.

​
Alert stream

A valid alert stream requires all three options.

​
Case stream

A valid case stream requires the interval, destination IP, and destination port.

​
Stream state rules

1

No options for a stream

If every option for a stream is omitted, that stream is disabled.
2

Partial configuration

If configuration for a stream is started but a required option is missing, that stream is an error.
3

Complete configuration

When all required options are present, the stream can run. Alert and case streams can both be enabled in the same process.

​
Separate destinations

Alert and case streams have separate IP and port options, so they can be sent to independent listeners.
They can also use the same downstream SIEM/SOC receiver when one listener handles both record types.

​
Debug mode

Use --debug only while troubleshooting.
Although the destination option names contain syslog, the documented payload format is newline-delimited JSON (NDJSON) over TCP. Configure the receiving parser accordingly.