Connect data sources

Data sources in the console’s sidebar shows the same guides as this page, already filled in with your platform’s address, makes an API key when a source needs one, and sends a test event so you can see one arrive.

Source	How it arrives	Where it is set up
Windows computers	The Legit AI agent, over HTTPS	Enroll an endpoint
Linux servers	SSH every 30 seconds; nothing installed	SSH servers
Firewalls, switches, routers	Syslog to port 514, UDP or TCP	Below
Servers already running rsyslog	Syslog forwarded over TCP	Below
Fluent Bit, Vector	HTTPS, with an API key	Below
Your own application	HTTPS, with an API key	Send events
Log files	Uploaded in Event Explorer → Import Log File	—

Syslog from devices

On your own server the platform receives syslog on port 514, over UDP and TCP, the way devices already send it — no agent, no key. In the device’s logging settings, set the syslog server to the platform’s address and port 514. UDP works with every device; choose TCP if the device offers it.

Each line goes through the same path as every other event: normalisation, the detection layers, deduplication. A line carrying CEF is read as CEF. The address it came from is kept as observer.ip.

Rule	Default
Which networks may send	All private networks (10/8, 172.16/12, 192.168/16) and loopback; narrowed at your request
Lines per second from one sender	500
Longest line	8 KB

Data sources shows how many lines arrived, when the last one did, and how many were refused and why.

A sender on the same server

A sender on the platform’s own server reaches the receiver without its own address, so its lines are refused by default — the console says so. Legit AI can allow it at your request. Senders on other machines arrive with their own address.

In Legit AI’s cloud, syslog is not received directly: send it to a relay you run (Fluent Bit or Vector, below), which sends it on over HTTPS.

Servers already running rsyslog

Create /etc/rsyslog.d/90-legit-ai.conf on the server:

# Legit AI: forward every message over TCP.
*.* @@legit.corp.internal:514

and restart rsyslog: sudo systemctl restart rsyslog.

Log shippers

Both send to POST /api/ingest/records, which takes a JSON array or one JSON object per line. Make a key in Data sources (or Settings → API Keys) with the ANALYST role and the write scope.

Fluent Bit — add an output:

[OUTPUT]
    Name        http
    Match       *
    Host        legit.corp.internal
    Port        443
    URI         /api/ingest/records
    Format      json
    Header      X-API-Key legit_…
    tls         On
    tls.verify  On

Vector — add a sink:

[sinks.legit_ai]
type = "http"
inputs = ["your_source"]
uri = "https://legit.corp.internal/api/ingest/records"
method = "post"
encoding.codec = "json"
framing.method = "newline_delimited"
request.headers.X-API-Key = "legit_…"

Field names most tools already use are understood: hostname, event_type, severity, src_ip, message and their common variants — see Send events.

A self-signed certificate

While the platform uses the certificate made at installation, give the shipper that certificate (tls.ca_file in both) — or, only while testing, turn verification off (tls.verify Off, tls.verify_certificate = false).

Check it works

Data sources → Send a test event sends one harmless event through the whole pipeline. Event Explorer shows every event as it arrives; search for the host name a source sends.