Devo
Integrating Keeper SIEM push to Devo
Overview
Keeper supports event streaming into Devo deployments. External logging is real-time, and new events will appear almost immediately. Setup instructions are below.
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F4290574019-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-LO5CAzpxoaEquZJBpYz%252Fuploads%252FF3a6T5hBe7DckUtd6lGM%252Fimage.png%3Falt%3Dmedia%26token%3Dab1a58a0-512d-4c78-b928-b6ae7eb23d99&width=768&dpr=4&quality=100&sign=f79c0269&sv=1)
Devo uses a standard "Syslog" push capability over TCP.
Ports TCP Ports 514 and 6514 (TLS)
Fields Exported "audit_event", "username", "client_version", "remote_address", "channel", "result_code", "email", "to_username", "client_version_new","username_new", "file_format", "record_uid", "folder_uid", "folder_type", "shared_folder_uid", "attachment_id", "team_uid", "role_id"
Payload Format Pipe-delimited, e.g. "audit_event=login|username=bob@foo.com|..."
Important: Ensure that the endpoint is using a valid signed SSL certificate. Keeper's systems will refuse to connect to an invalid or self-signed endpoint. Also, ensure that your Devo server allows traffic from Keeper servers. See Firewall Configuration page.
Last updated