Sycope supports Syslog as an External Destination and provides a CEF encoder for standardized event formatting. Energy Logserver can receive CEF-formatted data over TCP, creating a direct path for forwarding selected Sycope alerts into the central event environment.
This allows Energy Logserver analysts to use Sycope detections as another source of security evidence while keeping detailed flow history and network investigation in Sycope.
Table of Contents
From a Sycope alert to Energy Logserver
Sycope rules define the network, performance or security conditions that should generate an alert.
When a configured rule reaches the selected threshold level, the alert can be sent to an external Syslog destination. Using the CEF encoder, Sycope formats the event according to the Common Event Format before forwarding it to Energy Logserver.
On the receiving side, Energy Logserver can use a CEF input pipeline to decode the event and make its fields available for indexing and further processing.
Once stored in Energy Logserver, the Sycope alert can be searched and analyzed together with information from other security, infrastructure and application sources.
The integration therefore connects network-based detection with the wider event context already maintained in the SIEM.
Complementary capabilities, clearly divided
Sycope and Energy Logserver remain independent platforms and provide different perspectives on the monitored environment.
Sycope provides:
- Flow-based network analysis
- Host-to-host communication visibility
- Network performance monitoring
- Network anomaly and threat detection
- Predefined and custom alerting rules
- Historical network communication data
- Detailed traffic context for investigation
Energy Logserver provides:
- Centralized collection and indexing of security and operational events
- Search across multiple data sources
- SIEM correlation rules
- Security dashboards and visualizations
- Alerting and incident management
- Risk scoring and security analysis
- Data retention and lifecycle management
Sycope identifies activity visible directly in network communication. Energy Logserver can combine selected Sycope events with logs and security information collected from other systems.
Network detections as part of a broader event context
A network alert is often most useful when it can be related to information from other parts of the infrastructure.
Forwarding selected Sycope detections to Energy Logserver allows network behavior to become part of a broader security analysis rather than remaining isolated in a separate monitoring platform.
Correlation with logs from other systems
A Sycope alert can indicate activity such as scanning, unexpected communication, abnormal traffic behavior or another condition detected through flow analysis.
Once the event is available in Energy Logserver, it can be compared with logs and events associated with the same systems or time period.
For example, a network detection involving a server can be analyzed alongside operating system, authentication, application or security-device events already stored in Energy Logserver.
Sycope provides the network perspective, while Energy Logserver provides the wider event context needed to correlate activity across different data sources.
Selected security signals instead of the complete flow data set
The integration does not require all network flow data collected by Sycope to be continuously transferred to the SIEM.
Sycope rules determine which conditions generate alerts, and external actions can be configured for the rule and threshold levels that should be sent outside the platform.
This allows organizations to forward meaningful network detections while keeping detailed flow records and historical communication in Sycope.
The SIEM receives the information needed for correlation and triage without duplicating the complete network data set.
Structured event fields for further analysis
CEF provides a standardized structure for transferring security events between systems.
Relevant information from a Sycope alert can therefore be represented as structured fields and decoded by the Energy Logserver CEF input.
Depending on the Sycope rule and encoder configuration, this can include information describing the alert, its severity, timestamp and the network systems involved.
Once indexed, these fields can be used in Energy Logserver searches, filters, dashboards and correlation rules.
Existing SIEM workflows remain in place
For organizations already using Energy Logserver as a central security platform, Sycope events can become another source of data within the existing SOC workflow.
Analysts can work with the Sycope alert together with other indexed events and use Energy Logserver’s existing correlation, visualization and incident-management capabilities.
When an investigation requires deeper information about the network activity itself, the analyst can continue in Sycope using the available traffic history and communication context.
CEF and Syslog integration
The integration uses standard mechanisms available in both systems.
Sycope provides Syslog as an External Destination and allows alert actions to be associated with selected monitoring rules.
Starting with Sycope 3.2, Syslog output can also use a CEF encoder compliant with the Common Event Format standard.
Energy Logserver’s Network Probe supports CEF input over TCP. The incoming CEF message is decoded and can then be processed according to the Energy Logserver pipeline and index configuration.
This makes it possible to connect the two systems without requiring a dedicated proprietary connector.
How the integration works
The integration consists of four main elements.
Alert generation in Sycope
Sycope analyzes network data using predefined or custom rules.
When the conditions defined by a rule are met, the platform generates an alert describing the detected activity and its severity.
Syslog and CEF configuration
Energy Logserver is configured as a Syslog External Destination in Sycope.
The CEF encoder is used to format the alert before it is sent to the configured destination.
The external action can be assigned to selected rules and threshold levels, allowing administrators to control which Sycope detections are forwarded.
CEF input in Energy Logserver
Energy Logserver receives the event through a CEF-enabled TCP input.
The CEF codec decodes the standard prefix and key-value extension fields, making the event available for indexing and further processing in the platform.
The target pipeline, field mapping and index configuration can be adapted to the organization’s Energy Logserver environment.
Correlation and further investigation
Once indexed, Sycope alerts can be searched, visualized and correlated with information from other systems available in Energy Logserver.
If additional network evidence is required, the investigation can continue in Sycope using historical flow data and the detailed communication context associated with the affected systems.
From network detection to multi-source analysis
Consider a Sycope rule that identifies suspicious communication involving an internal server.
Sycope generates an alert containing information about the detected activity. Because the rule is configured with the Energy Logserver Syslog action, the event is encoded in CEF and forwarded to the configured CEF input.
Energy Logserver receives and indexes the event.
The analyst can then compare the Sycope detection with authentication logs, endpoint events, firewall records or other security information associated with the same host and time period.
This can help establish whether the network behavior is an isolated observation or is supported by evidence from other systems.
If the investigation requires information about communication before or after the alert, the analyst can return to Sycope and review the historical traffic associated with the affected hosts.
The integration therefore connects flow-based network detection with centralized log and event analysis while preserving the specialized role of each platform.
Sycope and Energy Logserver integration
The integration allows selected Sycope network and security alerts to become part of the Energy Logserver SIEM workflow using standard CEF and Syslog mechanisms.
Energy Logserver provides the broader multi-source event context, while Sycope retains the detailed network history required for deeper traffic investigation.
To discuss integrating Sycope alerts with your Energy Logserver environment, contact our team.
