Views:

Use collectors to receive log data from configured third-party data sources in your organization's network via a deployed Service Gateway.

To ingest log data, you must add collectors to log repositories. Collectors can currently only receive log data in Common Event Format (CEF) using the TCP or TLS protocol, or log data from a connected Azure subscription with Microsoft Defender for Endpoint enabled.
When you configure a collector for a third-party data source using CEF, the collectors are assigned to a particular port on one of your deployed Service Gateways with the Third-Party Log Collection service installed. Collectors then receive valid logs from the IP addresses of your third-party log data sources and forward the log data to the log repository, where the data is ingested according to the settings you have specified.
Important
Important
Third-party data sources require configuration to send log data to Trend Vision One. Refer to the log forwarding topics in your product documentation to learn how to set up the correct configuration. If an IP address is required to set up a server profile, use the IP address of the Service Gateway associated with the collector. For an example, see the Palo Alto Networks Next-Generation Firewall documentation.
All log data received by a collector is ingested according to the associated log repository settings. To use different ingestion or retention settings, create a new log repository. For CEF log collection, you must have one deployed Service Gateway per CEF collector in a log repository.