OpenText

SIEM Platform

Synopsis

The OpenText target forwards events, formatted as CEF, to OpenText Security Log Analytics / ArcSight over syslog. It handles transport framing (UDP, TCP, or TLS) — the event payload is expected to already be in CEF format when it reaches the target.

Schema

- name: <string>
  description: <string>
  type: opentext
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    protocol: <string>
    hostname: <string>
    priority: <numeric>
    template: <string>
    max_message_size: <numeric>
    application_name: <string>
    tls:
      status: <boolean>
      verify: <boolean>
      server_name: <string>
      ca_name: <string>
      cert_name: <string>
      key_name: <string>
      passphrase: <string>
      min_tls_version: <string>
      max_tls_version: <string>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following fields are used to define the target:

Field	Required	Default	Description
`name`	Y		Target name
`description`	N	-	Optional description
`type`	Y		Must be `opentext`
`pipelines`	N	-	Optional post-processor pipelines
`status`	N	`true`	Enable/disable the target

Connection

Field	Required	Default	Description
`address`	Y	-	OpenText/ArcSight CEF Syslog receiver IP or hostname. Resolved at dial time
`port`	N	`514`	Remote receiver port. `514` for tcp/udp, often `6514` for tls. Valid range 1–65535
`protocol`	N	`tcp`	Transport protocol: `tcp`, `udp`, or `tls`

Framing

Field	Required	Default	Description
`hostname`	N	this host's name	Hostname written into the syslog header
`priority`	N	`13`	Syslog PRI value (facility×8 + severity). Valid range 0–191; `13` = user.notice
`template`	N	`<{{.Priority}}>{{.BSDTimestamp}} {{.Hostname}} {{.Message}}`	BSD (RFC 3164) syslog header template. Set to `{{.Message}}` to send the raw payload with no header
`max_message_size`	N	`0`	Maximum framed line length in bytes. `0` sends the full event
`application_name`	N	product name	Syslog tag / app-name. Only rendered when `template` references `{{.AppName}}` — the default template does not use it

TLS

Field	Required	Default	Description
`tls.status`	N	`false`	Enable TLS. Also enabled automatically when `protocol: tls`
`tls.verify`	N	`true`	Verify the server certificate
`tls.server_name`	N	-	SNI / expected server hostname
`tls.ca_name`	N	-	Custom CA to trust. Empty uses the OS trust store
`tls.cert_name`	N*	-	Client certificate for mutual TLS
`tls.key_name`	N*	-	Client key for mutual TLS
`tls.passphrase`	N	-	Passphrase for an encrypted client key
`tls.min_tls_version`	N	`tls1.2`	Minimum negotiated TLS version
`tls.max_tls_version`	N	`tls1.3`	Maximum negotiated TLS version

* = Conditionally optional. tls.cert_name and tls.key_name must be supplied together to enable mutual TLS; supplying only one fails configuration validation.

note

TLS material fields (cert_name, key_name, ca_name, client_ca_name) accept any of the following:

File name — resolved relative to the service root directory. Nested paths such as certs/prod/server.pem are supported.
Absolute path — honored only if it resolves inside the service root. Any path that escapes the root is refused.
Inline PEM content — used verbatim when the value contains -----BEGIN.
Environment variable — ${ENV_VAR}.
Vault reference — $secret{id=...} or $secret{store=...,ref=...}.

Processing

Field	Required	Default	Description
`field_format`	N	-	Optional target-side normalization format applied before delivery. Typically left empty, since the payload already arrives in CEF from upstream processing. See applicable Normalization section

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
`debug.status`	N	`false`	Enable debug logging
`debug.dont_send_logs`	N	`false`	Process logs but don't send to target (testing)

Details

This target is transport-only: it does not render CEF itself. It expects each event to already be a complete CEF record when it reaches the target, and applies syslog framing and delivery on top of that payload. There is no batching — each event is a single, complete delivery to the OpenText Security Log Analytics / ArcSight receiver.

Template Variables

The following variables are available in template:

Variable	Description
`{{.Year}}`	Current year (4-digit)
`{{.Month}}`	Current month (2-digit)
`{{.Day}}`	Current day (2-digit)
`{{.Priority}}`	Syslog PRI value
`{{.Timestamp}}`	Current time, RFC3339
`{{.BSDTimestamp}}`	Current time, RFC3164 (`Jan _2 15:04:05`)
`{{.Hostname}}`	Syslog-header hostname
`{{.AppName}}`	Application name (`application_name`)
`{{.PID}}`	Process ID
`{{.Message}}`	The CEF payload

If template fails to render, the target falls back to sending the raw, sanitized payload with no header.

Framing and Transport

Embedded carriage returns and line feeds in the payload are neutralized before framing, so one event cannot forge a second line on the wire. On a TCP or TLS stream, exactly one trailing newline delimits each event (RFC 6587 non-transparent framing); this is harmless on UDP. No size limit applies by default (max_message_size: 0); set a cap when the transport is UDP and the receiver enforces a lower datagram limit.

TLS

TLS is enabled automatically when protocol: tls, or explicitly via tls.status: true. A client certificate is optional — supplying tls.cert_name without tls.key_name (or vice versa) fails configuration validation. tls.verify defaults to true.

note

The target does not perform CEF rendering or field mapping — it only frames and delivers the payload it receives. Format the event as CEF before it reaches this target.

Examples

Basic Configuration

Sending CEF events to an OpenText Security Log Analytics receiver over TCP...

targets:
  - name: opentext
    type: opentext
    properties:
      address: "10.0.0.51"

Secure TLS

Delivering over an encrypted TLS connection with server verification...

targets:
  - name: opentext-tls
    type: opentext
    properties:
      address: "opentext.example.com"
      port: 6514
      protocol: tls
      tls:
        status: true
        verify: true

Capped UDP

Capping message size for a UDP receiver with a limited datagram size...

targets:
  - name: opentext-udp
    type: opentext
    properties:
      address: "10.0.0.51"
      protocol: udp
      max_message_size: 8192

Synopsis​

Schema​

Configuration​

Connection​

Framing​

TLS​

Processing​

Scheduling​

Debug Options​

Details​

Template Variables​

Framing and Transport​