> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/data-sinks/data-sink-integrations/send-data-to-devo.md).

# Send data to Devo

{% hint style="info" %}
See the changelog of this Data sink type [here](/data-sinks-changelog/devo-data-sink.md).
{% endhint %}

## Overview

Onum supports integration with [Devo](https://www.devo.com/).

Devo is an integrated platform that includes data-powered SIEM, SOAR, and UEBA. It is a cloud-native logging and security analytics platform used to monitor and protect your organization.

Select **Devo** from the list of Data sink types and click **Configuration** to start.

## Prerequisites 

* You’ll need a valid Devo tenant, with domain details (region, account) defined. 
* OAuth token with the correct permissions.
* The data you send must include a “tag” or metadata so that Devo knows how to route/process it (which table, which parser) and avoid being classified as unknown.
* You’ll typically use TLS/SSL and will need to provide certificates
* You’ll need to know the correct ingestion endpoint (which region, protocol: syslog/TLS, HTTP, etc).
* Ensure the data you send is in a format that Devo expects (JSON, syslog, etc) and mapped to the correct tag so Devo can parse it into tables properly

## Onum Setup

{% stepper %}
{% step %}
Log in to your Onum tenant and click **Data Sinks > New Data sink**.
{% endstep %}

{% step %}
Double-click the **Devo** Sink.
{% endstep %}

{% step %}
Enter a **Name** for the new Data Sink. Optionally, add a **Description** and some **Tags** to identify the Sink.
{% endstep %}

{% step %}
Decide whether or not to include this Data sink info in the metrics and graphs of the [**Home**](/home.md) area.
{% endstep %}

{% step %}
Specify the **Devo Cloud**<mark style="color:red;">**\***</mark> environment you wish to send your data to (**US**, **EU**, or **CA**). For details on the URLs, [see here](https://docs.devo.com/space/latest/94762521/Getting+started).
{% endstep %}

{% step %}
Enter the rules for connecting to this cloud environment:

<table><thead><tr><th width="169.83203125">Parameters</th><th>Description</th></tr></thead><tbody><tr><td><strong>Net buffer size</strong></td><td>Define the number of bytes allocated for buffering network data during transmission to Devo. The minimum value is <code>-1</code>.</td></tr><tr><td><strong>Write timeout</strong></td><td>Enter the number of milliseconds to wait before considering the request a timeout. The minimum value is <code>1</code>.</td></tr><tr><td><strong>Idle timeout</strong></td><td>Enter the milliseconds the connection remains open and idle before it is automatically terminated or closed. The minimum value is <code>1</code>.</td></tr><tr><td><strong>Dial timeout</strong></td><td>The maximum time (in ms) allowed for establishing a connection before the attempt is aborted. The minimum value is <code>1</code>.</td></tr><tr><td><strong>Connection Time to Live</strong></td><td>The maximum duration (in ms) the connection remains active before it is forcibly closed, regardless of whether it is idle or in use. The minimum value is <code>1</code>.</td></tr></tbody></table>
{% endstep %}

{% step %}
In the **TLS** section, enter the authentication credentials

* **Certificate** - Add your TLS certificate from your [Secrets](/settings/organization-settings/secrets-management.md) or create one.
* **Private Key** - Add your private key from your [Secrets](/settings/organization-settings/secrets-management.md) or create one.
* **CA Chain** - Add your CA chain from your [Secrets](/settings/organization-settings/secrets-management.md) or create one.
  {% endstep %}

{% step %}
Click **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the corresponding value.
* Click **Save**.

<figure><picture><source srcset="/files/NeeWsSQzoChVxRIY76Nt" media="(prefers-color-scheme: dark)"><img src="/files/1oTccyPmgZJ1laY7IhZH" alt=""></picture><figcaption></figcaption></figure>

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/settings/organization-settings/secrets-management.md).
{% endhint %}

You can now select the created secrets in the configuration.
{% endstep %}
{% endstepper %}

Click **Finish** when complete. Your new Data sink will appear in the **Data sinks** area list.

## Pipeline configuration

When it comes to using this Data sink in a [Pipeline](https://docs.onum.com/the-workspace/pipelines), you must configure the following output parameters. To do it, simply click the Data sink on the canvas and select **Configuration**.

### Output configuration

If your message already has the required format, toggle **Passthrough** to send on the message exactly as the sink receives it. Uncheck **Passthrough** to manually format the message:

#### **Type**

<table><thead><tr><th width="170.03125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><strong>Output type</strong></td><td><p>The Syslog format to send in:</p><p></p><ul><li>The original BSD format (<strong>Syslog RFC 3164</strong>) </li><li>The “new” format (<strong>Syslog RFC 5424</strong>)</li></ul><p>If you are unsure about the veracity of the fields you have chosen, you can click <strong>Validate</strong> to check if they are valid. For the <strong>Syslog RCF 3164</strong> type, you have the option to <strong>Auto-fix</strong> the values to correctly populate them.</p></td></tr></tbody></table>

You must select the incoming fields that correspond to each value to build the end message in Devo. The fields to configure will differ depending on the Syslog type chosen.

{% tabs %}
{% tab title="Syslog RFC 3164" %}

#### **Header**

Enter the header parameters:

* **Priority**<mark style="color:red;">**\***</mark>/ **Severity** **&** **Facility**<mark style="color:red;">**\***</mark> - The field corresponding to the Priority OR the fields corresponding to the Severity and Facility that will be used to make the Priority field.
* **Timestamp** - The field containing the timestamp value.
* **Hostname** - The field containing the hostname.

#### **Message**

Enter the fields used to build the body of the message:

* **Tag -** The field containing the tag.
* **ProcId** - The incoming field with the process ID.
* **Content** - The field used as the content field.

#### Test mode

Decide if you want to send events while they are still processing. This is useful to test the Pipeline without the need for a valid destination.
{% endtab %}

{% tab title="Syslog RFC 5424" %}

#### **Header**

Enter the header parameters:

* **Priority**<mark style="color:red;">\*</mark> / **Severity** **&** **Facility**<mark style="color:red;">\*</mark> - The field corresponding to the Priority OR the fields corresponding to the Severity and Facility that will be used to make the Priority field.
* **Timestamp** - The field containing the timestamp value.
* **Hostname** - The field containing the hostname.
* **Appname** - The field containing the application name.
* **ProcID** - The field containing the Process ID.
* **Message ID** - The field containing the Message ID.

#### **Structured data**

* **Structured data** - Where to source the structured data from.

#### **Message**

Enter the fields used to build the body of the message:

* **Message** - The field containing the message body.

#### Test mode

Decide if you want to send events while they are still processing. This is useful to test the Pipeline without the need for a valid destination.
{% endtab %}
{% endtabs %}

Click **Save** to save your configuration.