Adding Netwrix Endpoint Protector (CoSoSys) via Syslog

Purpose

This guide explains how to forward Netwrix Endpoint Protector events to Logsign USO over syslog, and what Logsign does with those events once they arrive. Endpoint Protector was originally a CoSoSys product and is now sold by Netwrix, so the source is still registered in Logsign under the vendor name CoSoSys and the product name Endpoint Protector. The integration covers Device Control events (file read, write, copy, rename and delete on monitored devices and network shares, device connect and disconnect, block and unblock), Content Aware Protection events (content threat detections on email, network shares and other exit points) and System Logs (client policy delivery, administrator actions, license information).

Prerequisites

• An Endpoint Protector server (the appliance or virtual appliance that hosts the reporting and administration console) and an administrator account that can change its logging or SIEM export settings.
• Network connectivity from the Endpoint Protector server to the Logsign USO collector on your syslog port, TCP or UDP 514 by default.
• A Logsign USO release that includes the updated CoSoSys Endpoint Protector plugin, if your Endpoint Protector server sends the RFC 5424 header with fractional seconds and a Z offset (see Supported Message Formats). Earlier releases only recognize the two older header forms.

Step 1: Enable syslog export on the Endpoint Protector server

Syslog export is configured entirely on the Endpoint Protector side. Menu labels differ noticeably between Endpoint Protector 5.x and current Netwrix releases, so use the SIEM integration or syslog section of the Netwrix Endpoint Protector documentation for your exact version. Whatever the menu is called, you need to set three things:

1. The destination address, which is the IP address of your Logsign USO collector.
2. The destination port and protocol, matching the syslog listener on the Logsign side (TCP or UDP 514 by default).
3. The event categories to export. Enable Device Control, Content Aware Protection and System Logs to get the full coverage described in this article.

Keep the default syslog output. The Logsign plugin reads the plain text [Key] Value layout that Endpoint Protector produces natively, and it does not parse CEF, LEEF or JSON output.

Step 2: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select CoSoSys as the vendor and Endpoint Protector as the product, and enter the IP address of the Endpoint Protector server as the host. Click Save.

The host you enter must be the address the syslog messages actually come from, which is the Endpoint Protector server itself, not the individual endpoints. The client computer that generated each event is carried inside the message and ends up in Source.HostName.

Supported Message Formats

Every message has a syslog header, then the category and event name, then the event body as [Key] Value pairs separated by  | . Three header forms are recognized.

RFC 5424 with a UTC timestamp and fractional seconds, which is what current Endpoint Protector releases send:

<14>1 2026-09-17T08:33:01.000000Z eppserver EPP-10.22.215.100 - - - EPP IP - 
10.22.102.120 - Device Control - File Read-Write: [Log ID] 
687c79755f45626a42d805f76317aff1 | [Event Name] File Read-Write | [Client Computer] 
NTMK-HR-CHINLQ | [IP Address] 10.22.22.189 | [MAC Address] f4-6b-8c-87-d8-12 | 
[Client User] chi.nlq | [Device Type] Network Share | [File Name] 
//ntmk-svr-file02/personal$/chi.nlq/scan/08092026133113.pdf | [File Type] 
Adobe Acrobat Document | [File Size] 373098

RFC 5424 with a numeric UTC offset, sent by Endpoint Protector 5.9 and similar releases:

1 2025-02-13T16:08:55+03:00 eppserver EPP-10.1.2.28 1327925 - - EPP IP - 10.1.2.27 
- Content Aware Protection - Content Threat Detected: [Log ID] 
6b402f9377f5401e5bb16699c20d8c93 | [Client Computer] BRN1-URT | [IP Address] 
10.1.4.4 | [Content Policy] General | [Destination Type] Network Share

The older RFC 3164 header, with a month, day and time instead of an ISO 8601 timestamp:

Nov 23 07:48:18 eppserver EPP-10.0.0.81: EPP-IP - 10.0.2.13 - Device Control - 
File Read: [Event Name] File Read | [Client Computer] HALISEMIRZA | [IP Address] 
10.34.4.35 | [Client User] halisemirza | [File Name] F:/Projects/plan.dwg | [File 
Type] .dwg file | [File Size] 1099776

For the two ISO 8601 forms, the syslog version digit has to be present in front of the timestamp. Both <14>1 2026-09-17T08:33:01.000000Z and 1 2025-02-13T16:08:55+03:00 are accepted, the leading priority value is optional, but a bare timestamp with no version digit is not recognized.

What Gets Collected

Field names in the left column are the normalized Logsign fields you search on. The right column is the key in the Endpoint Protector message.

Every event is recorded with Vendor CoSoSys, Product Endpoint Protector, EventSource Type Security System, EventSource Category DLP, EventSource PrefixID 4066 and Event.VendorID 1.

Event Classification

The EventMap classification and the severity come from the event name in the message header.

Any other event name is still parsed and searchable, but it gets no EventMap values and its severity defaults to information. If you build correlation rules on event types that are not in the table, filter on Event.Category and Event.Info instead of EventMap.

Notes and Limits

• Time.Generated is taken from the syslog header, not from the Date/Time(Server) value inside the message, and the header time is used as it is without being converted to the appliance time zone. On the RFC 5424 UTC format this means Time.Generated is a UTC time. For a server running at UTC+7, an event the Endpoint Protector console shows at 15:33:01 is recorded in Logsign as 08:33:01 on the same day. Keep that offset in mind when you compare the two consoles or build time based searches.
• Fractional seconds in the header are dropped, so events are recorded with one second resolution.
• Only the native [Key] Value output is parsed. If the Endpoint Protector server is configured to send CEF, LEEF or JSON, the messages are not recognized by this integration.
• An event has to arrive as a single syslog message. If something in the path splits it at the pair separator, the parts are not recognized.
• These keys are parsed but are not mapped to a normalized field: Event Name (the header event name is used instead), Date/Time(Server), Date/Time(Client), Date/Time(Server UTC), Date/Time(Client UTC), Matched Item, Justification, Time Interval, EPP Client Version, Device VID, Device PID and Device Serial. They remain visible in the raw message.
• Mail.TO carries the Email Sender value, not the recipients. The recipient list of an email event is in Event.Detail, from Destination Details.
• System Logs administrator events (event name Admin Action) are collected with Event.Action set from Action Type and the old and new settings in Configuration.Old and Configuration.New, but they are not given EventMap values. Search them with Event.Category System Logs.
• A file name that contains a closing bracket followed by a space, for example [SHS] Private Placement Bonds IM_v3.docx, is handled correctly and does not affect the fields that follow it in the message.

Verification

After both sides are saved, one file operation on a monitored device or share is enough to check the integration end to end.

• In Logsign USO, open Settings > Data Collection and confirm that the CoSoSys Endpoint Protector source is receiving data.
• Open or copy a file on a monitored network share or removable device from a machine that runs the Endpoint Protector client. In Logsign USO, go to Search and look for events with Vendor CoSoSys and Product Endpoint Protector. The operation should appear with your client computer in Source.HostName, the user in Source.UserName, the file in Object.Name and Object.Path, and an EventMap of Object / File / Access or Object / File / Change.
• If the source is receiving data but no events show Vendor CoSoSys, the messages are not in a format this integration recognizes. Check that the syslog output is the native [Key] Value format, and compare the header of a raw message against the three forms in Supported Message Formats.