Log collection

SecureOPS ingests telemetry from two kinds of sources: collectors installed in your environment, and API integrations that pull events from cloud platforms.

Collectors

A collector is a lightweight service that receives, buffers, and forwards logs to SecureOPS over TLS. Deploy at least one collector per network segment.

Platform	Install method	Typical sources
Windows	MSI installer	Windows Event Log, Sysmon, IIS
Linux	Shell installer	syslog, auditd, application logs
Virtual appliance	OVA image	Network syslog (firewalls, switches), NetFlow

Deploying a collector

Go to Settings → Collectors → Add collector.
Select the platform and copy the install command. The command embeds a one-time enrollment token valid for 24 hours.
Run the command on the target system with administrative privileges.
Verify the collector shows Connected in the collector list.

For endpoint-level visibility (process activity, file integrity, local authentication), install the SecureOPS endpoint agent on your servers and workstations. The agent registers with your nearest collector automatically.

Forwarding syslog devices

Firewalls, switches, and appliances that can't run an agent should forward syslog to a collector:

Point the device's syslog output at the collector IP, port 514/UDP or 6514/TCP (TLS).
In Settings → Log sources, confirm the device appears and assign it a source type (for example FortiGate, Palo Alto, Cisco IOS).
Parsing and field extraction are applied automatically based on the source type.

API integrations

Cloud and SaaS platforms are connected under Settings → Integrations. Each integration authenticates with the vendor's API and pulls events on a schedule. See Office 365 for a complete example.

Verifying data flow

Use Search to confirm events are arriving:

source:windows-security | stats count by host | sort -count

If a source shows no events after 15 minutes, check the collector's local log and confirm outbound TLS connectivity to your tenant's ingestion endpoint.