Adding Seclore EDRM via Syslog

Purpose

This guide explains how to forward Seclore EDRM (Enterprise Digital Rights Management) Policy Server logs to Logsign USO via Syslog, so file activity (access, save, print, delete, copy, share), classification events (labeling, label upgrades) and Policy Server audit events (administrative authentication, role assignment, hotfolder and patch operations) become visible for security analytics and forensic purposes.

Prerequisites

• A Seclore EDRM Policy Server with administrative access, configured to export activity, classification and audit logs.
• Network connectivity from the Seclore Policy Server to Logsign over Syslog (UDP/TCP, port 514 by default, or your organization's configured Syslog port).

Step 1: Configure Syslog Forwarding on Seclore EDRM

Configure the Seclore Policy Server to forward its activity, classification and audit logs to Logsign's IP address over Syslog. The exact menu path depends on your Seclore Policy Server version; consult your Seclore administrator or Seclore's own documentation to enable Syslog export and point it at the Logsign collector IP and port. This step was not independently re-verified against a live Seclore admin console during this research. Only the log format Seclore actually sends (below) and the Logsign-side parser were confirmed from source.

Seclore wraps each event in two nested RFC 5424-style Syslog headers around a JSON body. The JSON payload is preceded by a distinctive message ID that also names the log class: ACTIVITYLOGS_<id> for file activity and classification records, and AUDITLOGS_<id> for Policy Server audit records. Logsign's parser locates and decodes this JSON body directly; no reformatting is required on the Seclore side beyond enabling standard Syslog export.

Step 2: Add Seclore EDRM as a Device in Logsign USO

1. In Logsign USO, go to Data Collection and click +Device.
2. Select Syslog as the collection type and Seclore EDRM as the device/plugin.
3. Enter the Seclore Policy Server's IP address as the source, give the device a name, and save.

Once traffic arrives, Logsign automatically recognizes Seclore EDRM records by their user-qid and activity/activity-type fields and applies the Seclore EDRM parser (EventSource Prefix ID 4512). A single Syslog source carries all three log classes; no separate device definition is needed for audit logs.

Supported Log Types

File activity and classification records arrive under the ACTIVITYLOGS message ID and are keyed on the activity or activity-type field.

Policy Server audit records arrive under the AUDITLOGS message ID. They reuse the same numeric activity field, but the numbers mean something different from the file activity table above, so Logsign resolves them separately. An audit record describes itself in the description field and references a Policy Server object rather than a protected file.

All three log classes are parsed by the same plugin; Logsign distinguishes them automatically from the Syslog message ID, and falls back to the shape of the JSON payload when a body is received without its header.

Notes and Limits

• For file activity and classification records, fields captured include the acting user (ID, name, email, domain), source and machine IP, file identity and path (current and original name/location), classification/label details, and the enterprise application and policy involved.
• For audit records, the sentence in the description field is carried as the event description, and the Policy Server object the event acted on (hotfolder, repository, patch) is carried in the object identity and name fields.
• An audit activity code outside the table above is still parsed and keeps its description, but resolves to a generic audit identity rather than a specific event mapping.
• This plugin was built for a specific customer request; if you hit an activity type or log shape not listed above, contact Logsign support with a raw sample so the event mapping can be extended.