Cisco Cyber Vision Classic UI Administration Guide, Release 5.6.0

PDF

Cisco Cyber Vision Classic UI Administration Guide, Release 5.6.0

Syslog configurations

Updated: July 6, 2026

Want to summarize with AI?

Log in

Introduces syslog configurations for forwarding Cisco Cyber Vision events and alerts to external syslog servers.

A syslog configuration is a network logging setup that

  • forwards Cyber Vision events and alerts to an external syslog server,

  • enables integration with Security Information and Event Management (SIEM) platforms, and

  • supports Common Event Format (CEF) for standardized message structure.

Table 1. Feature History Table

Feature

Release Information

Feature Description

Non-CEF syslogs support removed

Release 5.3.x

You can no longer use non-CEF syslog formats with Cyber Vision Center.

When you upgrade to Cisco Cyber Vision Center Release 5.3.x, any existing syslog connections that use non-CEF formats are automatically updated to CEF formats.

Configure syslog

Enable forwarding of Cyber Vision events and alerts to an external syslog server to integrate with a Security Information and Event Management (SIEM) system.

To configure syslog, follow these steps:

Before you begin

  • Ensure you have administrator access to Cyber Vision Center.

  • Confirm that the external syslog server is accessible. Obtain the host IP address, port, and the required protocol.

  • If secure communication is required, ensure you have the P12 certificate from your SIEM administrator.

  • Recent syslog format changes:

    • Standard and RFC3164 formats are deprecated.

    • Standard/CEF is now named CEF.

    • RFC3164/CEF is now named CEF Extended Time Precision.

    Note

    If the deployment had Standard or RFC3164 formats configured, version 5.3.x setup migrates the configuration to CEF.

Procedure

  1. From the main menu, choose Admin > System.

  2. Click Configure in the Syslog configuration menu.

  3. Select Protocol.

    Note

    If secure communication is required, select TCP + TLS and import the P12 certificate.

  4. Enter the syslog server Host IP address and Port that are accessible from Cyber Vision Center.

  5. Select the required Format.

    • CEF: This format, based on the Common Event Format (CEF) standard, sends events with second-precision timestamps.

    • CEF Extended Time Precision: This format, based on the Common Event Format (CEF) and an extended syslog header, sends events with millisecond-precision timestamps.

  6. Save the configuration.

Cyber Vision Center sends events from the Classic UI to syslog with 'Version Number = 1.0.' It sends alerts from the New UI to syslog with 'Version Number = 2.0.

What to do next

To configure notifications for specific alert types, see "Enable or disable syslog notifications for alert types" in the Cisco Cyber Vision New UI Administrator Guide.

To export events using syslog, see "Configure event export to syslog (Classic UI)" in the Cisco Cyber Vision Syslog Notification Format Configuration Guide.