Receive securely
Accept UDP, TCP, and TLS/mTLS syslog with bounded listeners, framing controls, and per-listener limits.
Security telemetry · collector · engineering preview
Make every security log count.
DarkSyslog is the resilient intake layer for high-value syslog. It accepts the protocols your infrastructure already speaks, applies intentional routing, and forwards canonical events to the systems where your team investigates them.
The collector runtime is implemented; production release qualification is in progress. Plan and validate a deployment with the DarkAPI team before relying on it in production.
COLLECTOR STATUSREADY TO ROUTE
01 listener: syslog-tls
02 route: security-critical
03 delivery: durable
canonical event → trusted source → selected destination
Built for operational paths
Control the path from device to evidence.
Route deliberately
Apply ordered filters and trusted source metadata to turn raw syslog into canonical security events.
Deliver reliably
Choose DarkAPI, Kafka, or S3/Parquet delivery, with a durable local journal available for downstream outages.
Designed for real collector failure modes.
Listener queues, size limits, timeouts, acknowledgement-aware delivery, and journal recovery are part of the collector’s operating model. Configure the capacity and retention appropriate to your environment, then validate before rollout.
UDP, TCP, TLS/mTLS
Ordered first-match routes
Canonical JSON envelopes
Bounded queues and batches
Durable replay option
Configuration preflight
Fit DarkSyslog into your telemetry architecture.
Use it as a dedicated forwarding tier, route different event classes independently, and retain the outputs that meet your investigation and archive needs.
Supported delivery targets
- DarkAPI event delivery
- Kafka topics
- S3-compatible Parquet archives
Ready to route security telemetry with intent?
Talk with us about collector topology, destination requirements, and a safe production rollout.
Get started