Overview
GreyCortex Mendel is a network detection and response (NDR) platform that analyzes network traffic for anomalies, policy violations, and intrusion attempts. This article explains how to forward GreyCortex Mendel security events to Logsign Unified SecOps Platform via syslog.
Prerequisites
- All Logsign versions support this integration.
Configure On GreyCortex Mendel
Unverified: the exact console menu path for enabling remote syslog forwarding has not been verified against a live GreyCortex Mendel console during this research. Consult GreyCortex's own administration guide for your version.
- In the GreyCortex Mendel management console, configure an external syslog destination and point it at your Logsign collector's IP address and port.
- Leave the log format at the appliance's default output; Logsign's parser expects this default single-line layout rather than a custom log format.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select GreyCortex as the vendor, and Mendel as the product.
| Field | Description |
|---|---|
| Host | IP address of the GreyCortex Mendel sensor or collector sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once GreyCortex Mendel is forwarding syslog to the configured host/port, events should begin appearing under Search.
Log Format and Supported Events
Logsign recognizes GreyCortex Mendel's default single-line event format, for illustration only (not a captured live sample):
2026-02-06T11:22:50.61+01:00 GreyCortex-Collector Feb 06 2026 11:21:00.000 CET GreyCortex-Sensor-U 192.168.114.100 - NB Outlier: Application Performance at Service 1 7680 WUDO -3304 AnomalyEach line carries a received timestamp, the collector hostname, the event's own generated timestamp and time zone, the reporting sensor hostname, source and destination IP (destination is - when not applicable), an event category and free-text description, a severity level, destination port, protocol or service name, an attack signature ID, and an attack category. The protocol/service field accepts multi-word values (for example "Apple Remote Desktop" or "TTL Exceeded") in addition to single-word protocol names.
The parser recognizes and classifies a range of GreyCortex Mendel event categories out of the box, including network behavior outliers and discoveries (NB Outlier, NB Discovery, NB Scan), intrusion detection alerts (ID Blacklist, ID Policy, ID Scan, ID Hunting, ID Modbus-events, ID Info, ID Detection), and enriches each event with source/destination IP geo data, port, protocol, attack signature ID, and attack category.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search to confirm parsed fields (Source IP, Destination IP, Event Category, Attack Signature ID, etc.) are populating correctly.