> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/data-collection.md).

# Data Collection

There are two ways to get data into Sec1 SIEM + EDR/XDR: run the **Sec1 agent**, or **connect an existing log collector** you already operate. You can mix both — an agent on your endpoints and servers plus your existing syslog or Logstash pipeline feeding the same platform. This page explains each path and how the single agent covers SIEM, EDR and XDR at once.

## Two ways to get data in

```mermaid
flowchart LR
    subgraph Env["Your environment"]
        H["Endpoints & servers"]
        S["Existing shippers<br/>(Logstash / Beats / rsyslog)"]
    end
    A["Sec1 agent"]
    I["Platform ingest<br/>(token-authenticated)"]

    H -->|telemetry + logs| A
    S -->|to agent receiver| A
    S -->|direct to ingest + token| I
    A -->|outbound 443| I
```

* **Use our agent** — one unified binary tails log files, receives syslog, reads Windows Event Log channels and (for EDR/XDR) collects endpoint telemetry. Install it once per host; the platform pushes the rest.
* **Connect an existing collector** — keep your current shipper and either point it at an agent receiver or push straight to the platform ingest with a token. No agent required on the log source itself.

## Use the Sec1 agent

The agent is a single static binary you install per host. What it collects is configured centrally in the console and pushed down — you don't hand-edit files on each host. It can do all of the following at once:

* **Tail log files** — watch paths on the host and forward new lines.
* **Receive syslog** — listen for RFC 3164 / RFC 5424 syslog over UDP or TCP.
* **Read Windows Event Log** — tail channels such as Security, System, Application and Sysmon.
* **Run log receivers** — accept pushes from existing shippers over HTTP or raw TCP (see below).
* **Collect endpoint telemetry (EDR/XDR)** — processes, network connections, file integrity, installed software and connected peripherals.

Configure inputs in the console under the agent's **Agent Inputs** editor — files, syslog, Windows Event Log channels and receivers are written to the managed config and applied to the agent without a reinstall. See [Install the agent](/user-docs/10-siem-edr-xdr/install-the-agent.md).

## Connect an existing log collector

Already running Logstash, Beats, rsyslog or a custom shipper? Keep it. You have two ways to bring that data into the platform.

### Agent-receiver mode

Point your existing shipper at a **receiver** on a Sec1 agent. The agent normalises, batches and forwards to the platform, and buffers to its on-disk spool during an outage — so your pipeline inherits guaranteed delivery without changing your shipper's own logic.

Enable a receiver in the **Agent Inputs** editor and it starts listening:

* **HTTP receiver** — accepts HTTP POSTs (JSON or newline-delimited). Optionally require a bearer token. Example bind `:9099`.
* **Raw TCP receiver** — accepts newline-delimited events over a TCP socket. Example bind `:9100`.
* **Syslog** — accepts RFC 3164 / RFC 5424 over UDP or TCP. Example bind `:5514`.

Each receiver is tagged with a source type so the platform parses it to the right schema. Open these ports only on the internal network between your shippers and the agent — see the allowlist in [Install the agent](/user-docs/10-siem-edr-xdr/install-the-agent.md).

### Direct-to-ingest mode

Point your shipper straight at the platform ingest and authenticate with a token — no agent in the path. This suits centralised pipelines that already aggregate everything in one place. The ingest endpoint is token-authenticated and reached outbound over HTTPS on the platform gateway; every event is attributed to the tenant the token belongs to.

Use agent-receiver mode when you want the agent's on-disk spool and local batching in front of the platform; use direct-to-ingest when your pipeline is already centralised and you'd rather not add a hop. Either way the agent is **optional for log collection (SIEM)** — but EDR/XDR endpoint telemetry and response require the agent on the host.

## One agent for SIEM, EDR, XDR or all of it

There is **one** agent binary. You do not pick a SIEM build or an EDR build — the same agent does whatever it is entitled and enabled to do. What runs on a given host is the intersection of two things:

**Effective capability = licensed (subscription) AND toggled-on (per host).**

* **Licensed** — your subscription entitles SIEM, EDR and/or XDR. The platform pushes this entitlement to the agent. With no active subscription the agent goes dormant.
* **Toggled-on** — an operator turns SIEM / EDR / XDR on or off **per host** in the console, sets a **fleet default** or hints the initial choice at install with `SEC1_CAPABILITIES=siem,edr`. This lets you license a product broadly but enable it only where you want it.

A capability runs only when it is **both** licensed and toggled on. Change either side in the console and the agent adjusts on its next config poll — no reinstall.

### Kernel-grade telemetry

Where the OS allows it, the EDR/XDR agent captures at the kernel rather than inferring from polling:

| OS       | Method                      | Notes                                                                |
| -------- | --------------------------- | -------------------------------------------------------------------- |
| Linux    | eBPF                        | Process and network events captured in-kernel.                       |
| Windows  | ETW + Windows Event Log     | Event tracing plus Security/System/Application/Sysmon channels.      |
| macOS    | Endpoint Security framework | Requires the Apple entitlement; visibility-focused.                  |
| Fallback | Polling                     | Used where a kernel source isn't available, so a host still reports. |

The agent reports its active capture method (for example `ebpf`, `etw-sysmon` or `poll`) in its heartbeat, so you can see the fidelity each host is running at.

## Where to go next

* [**Install the agent**](/user-docs/10-siem-edr-xdr/install-the-agent.md) — prerequisites, the allowlist and single vs bulk install.
* [**Architecture**](/user-docs/10-siem-edr-xdr/architecture.md) — the end-to-end picture from ingest to response.
* [**Endpoints & telemetry**](/user-docs/10-siem-edr-xdr/endpoints-and-telemetry.md) — what each host reports.