Purpose
This guide explains how to forward Seclore EDRM (Enterprise Digital Rights Management) Policy Server logs to Logsign USO via Syslog, so file activity (access, save, print, delete, copy, share) and classification events (labeling, label upgrades) become visible for security analytics and forensic purposes.
Prerequisites
- A Seclore EDRM Policy Server with administrative access, configured to export activity and classification logs.
- Network connectivity from the Seclore Policy Server to Logsign over Syslog (UDP/TCP, port 514 by default, or your organization's configured Syslog port).
Step 1: Configure Syslog Forwarding on Seclore EDRM
Configure the Seclore Policy Server to forward its activity and classification logs to Logsign's IP address over Syslog. The exact menu path depends on your Seclore Policy Server version; consult your Seclore administrator or Seclore's own documentation to enable Syslog export and point it at the Logsign collector IP and port. This step was not independently re-verified against a live Seclore admin console during this research. Only the log format Seclore actually sends (below) and the Logsign-side parser were confirmed from source.
Seclore wraps each event in two nested RFC 5424-style Syslog headers around a JSON body, with the JSON payload preceded by a distinctive ACTIVITYLOGS_<id> message ID. Logsign's parser locates and decodes this JSON body directly; no reformatting is required on the Seclore side beyond enabling standard Syslog export.
Step 2: Add Seclore EDRM as a Device in Logsign USO
- In Logsign USO, go to Data Collection and click +Device.
- Select Syslog as the collection type and Seclore EDRM as the device/plugin.
- Enter the Seclore Policy Server's IP address as the source, give the device a name, and save.
Once traffic arrives, Logsign automatically recognizes Seclore EDRM records by their user-qid and activity/activity-type fields and applies the Seclore EDRM parser (EventSource Prefix ID 4512).
Supported Log Types
| Activity / Activity Type | Description | Event Mapping |
|---|---|---|
| 2 | File Access | Object / File / Access |
| 3 | File Save | Object / File / Change |
| 4 | File Print | Object / File / Access |
| 5 | File Delete / Share | Object / File / Share |
| 6 | File Copy / Permission change | Object / Permission / Change |
| CLASSIFIED | Document classified with a label | Object / Permission / Change |
| UPGRADED | Classification label upgraded | Object / Permission / Change |
| AUTO_UPGRADED_EMAIL_LABEL | Classification label auto-upgraded via email policy | Object / Permission / Change |
Both activity logs (file access/save/print/delete/copy) and classification logs (label assignment and upgrades) are parsed by the same plugin; Logsign distinguishes them automatically from the JSON payload's activity-type field.
Notes and Limits
- Fields captured include the acting user (ID, name, email, domain), source and machine IP, file identity and path (current and original name/location), classification/label details, and the enterprise application and policy involved.
- This plugin was built for a specific customer request; if you hit an activity type or log shape not listed above, contact Logsign support with a raw sample so the event mapping can be extended.