Skip to main content
The relay sends newline-delimited JSON (NDJSON) over TCP.

​
Transport and framing

Each record is one JSON object followed by a newline:
A receiver should treat each newline as a record boundary rather than waiting for a JSON array or a larger document.

​
Alert and case records

Alert and case events are transmitted as JSON records. The receiving workflow can distinguish alert and case records using fields in the emitted JSON. Before creating a production SIEM parser, capture representative alert and case events from your deployed version and validate the fields used for routing and mapping.

​
Separate delivery paths

Alert and case streams have independent destination settings:
This allows separate ingestion paths:
Both streams can also point to the same downstream system.

​
About the syslog option names

The runtime CLI retains option names such as --alert-syslog-ip and --case-syslog-port. The documented payload itself is NDJSON over TCP, one JSON object per line.
Configure the receiver for line-delimited JSON over TCP. Do not assume RFC 3164 or RFC 5424 framing solely because the CLI option names contain syslog.

​
Receiver checklist

Verify the following before production use:
  • The receiver is listening on the configured TCP port.
  • Network policy allows the relay host to connect.
  • A newline is treated as the record boundary.
  • Each line parses as one JSON object.
  • Alert and case routing is tested with real sample records.
  • SIEM-side timestamp, source-type, and field mappings are validated against actual output.

​
Case summary output

The case example uses:
These options are useful when the destination workflow needs the case summary while preserving it without additional formatting.