Adding GreyCortex Mendel via Syslog

Overview

GreyCortex Mendel is a network detection and response (NDR) platform that analyzes network traffic for anomalies, policy violations, and intrusion attempts. This article explains how to forward GreyCortex Mendel security events to Logsign Unified SecOps Platform via syslog.

Prerequisites

• All Logsign versions support this integration.

Configure On GreyCortex Mendel

Unverified: the exact console menu path for enabling remote syslog forwarding has not been verified against a live GreyCortex Mendel console during this research. Consult GreyCortex's own administration guide for your version.

1. In the GreyCortex Mendel management console, configure an external syslog destination and point it at your Logsign collector's IP address and port.
2. Leave the log format at the appliance's default output; Logsign's parser expects this default single-line layout rather than a custom log format.

Add Device in Logsign USO

Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select GreyCortex as the vendor, and Mendel as the product.

Click Save to add the source. Once GreyCortex Mendel is forwarding syslog to the configured host/port, events should begin appearing under Search.

Log Format and Supported Events

Logsign recognizes two variants of GreyCortex Mendel's default single-line event format. Both are detected automatically, so no setting needs to be changed on the Logsign side when Mendel switches from one to the other. The examples below are for illustration only (not captured live samples).

Current layout, where the attack signature ID follows the destination IP. A leading syslog priority such as <14> is accepted:

<14>2026-10-16T17:05:43.39+02:00 GreyCortex-Collector Oct 16 2026 17:04:00.000 CEST GreyCortex-Sensor-U 19.151.10.59 19.151.10.61 2025707 ID Policy: SMB2 NT Create AndX Request For a .bat File 1 445 SMB Policy Violation

Legacy layout, where the attack signature ID sits between the protocol and the attack category:

2026-10-06T11:22:50.61+01:00 GreyCortex-Collector Oct 06 2026 11:21:00.000 CET GreyCortex-Sensor-U 19.151.10.51 - NB Outlier: Application Performance at Service 1 7680 WUDO -3304 Anomaly

Each line carries a received timestamp, the collector hostname, the event's own generated timestamp and time zone, the reporting sensor hostname, source and destination IP (destination is - when not applicable), an event category and free-text description, a severity level, destination port, protocol or service name, an attack signature ID, and an attack category. Only the position of the attack signature ID differs between the two layouts. The protocol/service field accepts multi-word values (for example "Apple Remote Desktop" or "TTL Exceeded") in addition to single-word protocol names. In the current layout the attack category is expected to be a single word (such as Anomaly, Exploitation, Information or Reconnaissance) or "Policy Violation".

The parser recognizes and classifies a range of GreyCortex Mendel event categories out of the box, including network behavior outliers and discoveries (NB Outlier, NB Discovery, NB Scan), intrusion detection alerts (ID Blacklist, ID Policy, ID Scan, ID Hunting, ID Modbus-events, ID Info, ID Detection), and enriches each event with source/destination IP geo data, port, protocol, attack signature ID, and attack category. When an event category is not in this built-in list (for example ID Misc), the event is still classified from its attack category: Anomaly, Exploitation, Information, Policy Violation and Reconnaissance each map to a fixed event type.

Verification

• Confirm the source is receiving data under Settings > Data Collection (event count should increase).
• Search for the source's Device Name/Tag under Search to confirm parsed fields (Source IP, Destination IP, Event Category, Attack Signature ID, etc.) are populating correctly.