---
title: "Configuring Syslog Collectors"
description: "Veeam App for Palo Alto Networks XSIAM receives data from Veeam Backup & Replication or Veeam ONE through syslog collectors added to Palo Alto Networks Broker virtual machines."
canonical: "https://helpcenter.veeam.com/docs/security_plugins_xsiam/guide/xsiam_configure_syslog_collectors.html"
breadcrumb: "User Guide > Configuring Veeam App for Palo Alto Networks XSIAM > Configuring Syslog Collectors"
dateModified: "2026-08-21"
---

# Configuring Syslog Collectors

Veeam App for Palo Alto Networks XSIAM receives data from Veeam Backup & Replication or Veeam ONE through syslog collectors added to Palo Alto Networks Broker virtual machines. For more information about broker VMs, see [this section](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Broker-VM) in the Cortex XSIAM documentation.

To add a syslog collector, do the following:

1. In the main menu, click **Settings** > **Configurations**.
2. On the **Data Broker** > **Broker VMs** > **Brokers** tab, select a broker virtual machine. In the **Apps** column, click **Add** and select **Syslog Collector**.
3. In the **New Syslog Data Source** window, specify the following settings:

    - **Protocol** — a transport protocol used by the syslog server. Default values are *TCP*, *UDP* or *TLS*.
    - **Port** — a port number used by the syslog server. Default values are *514* (for TCP and UDP) and *6514* (for TLS).
    - **Source Network** — an IPv4 address or subnet of the syslog server.
    - **Format** — a format of syslog messages. To display the data correctly, select *RAW*.
    - **Vendor** — a name of the product vendor. To display the data correctly, specify *Veeam*.
    - **Product** — a name of the product you want to get data from. For example, *VBR*.

4. Click **Done**.

After you add a syslog collector, the dataset will be created. The name of the dataset includes values of the **Vendor**, **Product**, and **Format** settings.. For example, *veeam_vbr_raw*. If you use correlation rules, specify the name of the dataset in the correlation rule query. For more details, see [Configuring Correlations](xsiam_configure_correlations.md).

::: important

To display data correctly, consider the following:

- Make sure that you specify the *Veeam* value in the **Vendor** field and use the RAW format.
- The format of syslog messages sent to Veeam App for Palo Alto Networks XSIAM must be the same as on Veeam Backup & Replication and Veeam ONE. For more information, see [Specifying Syslog Servers](https://helpcenter.veeam.com/docs/vbr/userguide/syslog_servers.html) in the Veeam Backup & Replication User Guide and [Syslog Integration](https://helpcenter.veeam.com/docs/one/userguide/syslog_settings.html) in the Veeam ONE User Guide.

:::