Log specifications for Helix Enterprise

Helix Enterprise data source inputs are most useful when structured with consistent formatting to allow the most efficient normalization and parsing. This allows integration with all Helix Enterprise features and provides you with continuous reporting through a common taxonomy.

Helix Enterprise uses the Communication Broker (Comm Broker) Sender to accept machine-generated messages and logs from hardware devices, operating systems, applications, security appliances, network devices, and databases through a variety of methods.

The Comm Broker looks for events formatted as the following (in descending order of preference):

Important

If a backslash (\) is used in events formatted as JSON, CEF, or LEEF, it must be escaped with another backslash. For example, C:\\Windows\\explorer.exe.

The following character encoding is supported:

For streaming inputs (TCP, named pipe), the Comm Broker Sender expects line feed-separated messages or records.

Helix Enterprise accepts and processes events sent through syslog UDP/TCP streams and the cloud integrations available on the Cloud Connect page of the Helix Enterprise Web UI.