Skip to main content
Connecting a SIEM?Start with Connect a SIEM. It covers which events are worth forwarding, which payload format to pick, and where to look in the documentation of Splunk, Microsoft Sentinel, QRadar, Elastic, and others — then sends you back here for the configuration.
Follow these steps:
  1. Go through Before You Begin.
  2. Follow the guide that matches your desired integration:

​
Additional information

The guides above give you all information necessary to enable logging. However, here are some additional tips for Logging:
  • xorlab logging is built with the open-source Logback framework. For more details on Logback, refer to the Logback Documentation.
  • You can use multiple appender in one logback-audit.xml file. The same appender can be used in multiple logger (for example to log the same event via multiple channels).
  • You can use multiple logger in one logback-audit.xml file. The logger name attribute is hierarchical: For example, name="audit" will log all audit.* events.
  • appender must be configured before logger in the logback-audit.xml file.
For worked configurations covering common logging use cases, see Logging Examples. For more conceptual information and references, have a look at: