Security events are forwarded to your SIEM over Syslog in real time, so endpoint leak signals sit alongside the rest of your security stack.
Schedule a Demo
Enterprise security operations centres work best when all alert streams flow into one place — Anexet Premium exports its DLP and insider-threat events straight into your SIEM.
Enterprise security operations centres work best when all alert streams flow into one place. Anexet Premium adds a dedicated Notifications Server component that forwards DLP and insider-threat events over Syslog (UDP or TCP), so analysts can correlate file-exfiltration attempts, policy violations, and anomalous user behavior inside whichever SIEM platform they already operate — without switching consoles. Because forwarding uses standard Syslog rather than a purpose-built plugin for one named SIEM product, it works with any platform that can ingest a Syslog feed.
At the same time, organizations that route employee web traffic through a corporate proxy can activate Anexet's optional ICAP Server component. The proxy passes traffic to Anexet for inspection, blocking, or logging before it reaches the endpoint, closing a coverage gap that endpoint-only DLP tools leave open.
Both capabilities ship as part of the Anexet Premium plan — a single, on-premise deployment that unifies DLP, employee activity monitoring, and IT inventory under one license.
Structured DLP and insider-threat events enriched with user identity, channel, data classification, and policy name — sent over Syslog so any SIEM can ingest them.
Inspect and block web traffic at the proxy layer before it reaches the endpoint, closing the gap endpoint-only tools leave open.
All event forwarding happens within your security perimeter — no traffic leaves your infrastructure through Scinero.
The Syslog forwarder is included with the Premium plan. The underlying features that generate these events may also run on Advanced where noted.
Triggered when intercepted data matches a content rule, thesaurus, digital fingerprint, or hash bank. Each event carries user, channel, timestamp, and severity.
Logged when Anexet blocks a transfer over HTTP, SMTP, MAPI, FTP, XMPP, USB, print, clipboard, or messenger file transfer.
File create, move, delete, and rename actions on workstations and network shares, flagged when they match a rule. The underlying audit runs from Advanced; forwarding to your SIEM is a Premium capability.
Quarantined and released messages, with approver identity and rationale recorded. The underlying quarantine runs from Advanced; forwarding to your SIEM is a Premium capability.
Case-state changes from the Investigations module, useful for audit trails in regulated environments.
Risk score spikes and behavioral anomalies surfaced by the Risk Analysis module, including sudden activity pattern shifts.
Web-traffic blocks and content violations detected via the ICAP proxy path, with the originating user and URL. Requires the optional ICAP Server component.
SIEM integration and the ICAP Server are included with Premium, giving you one Syslog-based forwarding pipeline for every event listed above. The exact forwarding scope and ICAP configuration for your environment is confirmed during the demo.
Anexet's Central Server and its surrounding functional servers — Security Policies Server, Reporting Server, Investigation Server — generate structured security events as they process intercepted data, enforce policies, and score user risk. A dedicated Notifications Server component forwards these events as Syslog messages (UDP or TCP) from your on-premise Anexet deployment to your on-premise or internally accessible SIEM, enriched with user identity, channel, data classification, and policy name.
Anexet is deployed fully on-premise; the vendor has no access to your data. The SIEM integration forwards events within your security perimeter — no traffic reaches Scinero's infrastructure. The ICAP Server, when activated, keeps the same boundary: your corporate proxy forwards web traffic to an Anexet component running inside your network, not to a cloud service.
Four steps from a security event on the endpoint to a correlated alert in your SIEM.
Enable the ICAP Server and/or Syslog event forwarding in the Administrator Console — a dedicated section alongside Central Server, Mail Processing, and other subsystem controls. The Status Monitor shows live uptime and queue metrics for every component.
1
The Anexet Central Server and its surrounding functional servers generate structured security events as they process intercepted data, enforce policies, and score user risk.
2
The Notifications Server forwards these events to your external SIEM as Syslog messages (UDP or TCP), enriched with user identity, channel, data classification, and policy name — ready to correlate with network, identity, and endpoint signals from other tools.
3
For ICAP-path coverage, your existing corporate proxy forwards web traffic to Anexet's ICAP Server before delivery. Violations are blocked and logged back to the Client Console alongside endpoint-sourced incidents.
4
Enable the ICAP Server and/or Syslog event forwarding in the Administrator Console — a dedicated section alongside Central Server, Mail Processing, and other subsystem controls. The Status Monitor shows live uptime and queue metrics for every component.
1
The Anexet Central Server and its surrounding functional servers generate structured security events as they process intercepted data, enforce policies, and score user risk.
2
The Notifications Server forwards these events to your external SIEM as Syslog messages (UDP or TCP), enriched with user identity, channel, data classification, and policy name — ready to correlate with network, identity, and endpoint signals from other tools.
3
For ICAP-path coverage, your existing corporate proxy forwards web traffic to Anexet's ICAP Server before delivery. Violations are blocked and logged back to the Client Console alongside endpoint-sourced incidents.
4
Common questions about Anexet's SIEM integration and ICAP Server component.
Anexet sends structured DLP and insider-threat events over Syslog — security policy violations, blocking activations, file operations audit records, mail quarantine actions, Risk Analysis anomalies, and Investigations milestones. Each event includes the user identity, channel, timestamp, data classification, and policy name so your SOC can correlate them with other data sources inside the SIEM.
No. Anexet's Notifications Server forwards events as standard Syslog messages over UDP or TCP, so any SIEM platform that can ingest a Syslog feed can receive them — there is no separate, purpose-built connector per SIEM vendor. Field mapping for your specific SIEM is confirmed during the demo.
Yes. Anexet is deployed on-premise; the vendor has no access to your data. The SIEM integration forwards events from your on-premise Anexet servers to your on-premise or internally accessible SIEM — no traffic leaves your security perimeter through Scinero.
The ICAP integration uses your existing corporate proxy as an inspection point. The proxy passes web traffic to Anexet's optional ICAP Server, which applies content-aware policies and blocks policy violations before the content reaches the user's browser — even on devices where an Anexet endpoint agent is not installed. Agent-based DLP covers richer channel depth (USB, print, clipboard, messengers, cloud drives); ICAP covers proxy-routed web traffic. Both paths report into the same Client Console.
SIEM integration and the optional ICAP Server are included with the Premium plan, giving you a single Syslog-based forwarding pipeline for every DLP and insider-threat event. Confirm the exact scope for your environment during the demo.
No new Anexet server type is required specifically for SIEM forwarding — the Central Server and its surrounding components generate the events, and the Notifications Server forwards them over Syslog. The ICAP Server is a separately licensed optional component for organizations routing traffic through a proxy. See the Administrator Console's Status Monitor for live uptime of all deployed components.
Yes. Anexet's server components run in a Linux environment. The Client and Administrator consoles also launch on Linux with full functionality, so your team can configure Syslog forwarding and ICAP rules from a Linux workstation. Endpoint agents support Windows, Linux, and macOS (including ARM64).
Tell us about your SIEM platform and security operations setup — we'll confirm the Syslog integration scope and arrange a demo or a free trial of Anexet Ultimate.
