# Send data to Devo

{% hint style="info" %}
See the changelog of this Data sink type [here](/data-sinks/devo-data-sink.md).
{% endhint %}

## Overview

Onum supports integration with [Devo](https://www.devo.com/).

Devo is an integrated platform that includes data-powered SIEM, SOAR, and UEBA. It is a cloud-native logging and security analytics platform used to monitor and protect your organization.

Select **Devo** from the list of Data sink types and click **Configuration** to start.

## Prerequisites 

* You’ll need a valid Devo tenant, with domain details (region, account) defined. 
* OAuth token with the correct permissions.
* The data you send must include a “tag” or metadata so that Devo knows how to route/process it (which table, which parser) and avoid being classified as unknown.
* You’ll typically use TLS/SSL and will need to provide certificates
* You’ll need to know the correct ingestion endpoint (which region, protocol: syslog/TLS, HTTP, etc).
* Ensure the data you send is in a format that Devo expects (JSON, syslog, etc) and mapped to the correct tag so Devo can parse it into tables properly

## Onum Setup

{% stepper %}
{% step %}
Log in to your Onum tenant and click **Data Sinks > New Data sink**.
{% endstep %}

{% step %}
Double-click the **Devo** Sink.
{% endstep %}

{% step %}
Enter a **Name** for the new Data Sink. Optionally, add a **Description** and some **Tags** to identify the Sink.
{% endstep %}

{% step %}
Decide whether or not to include this Data sink info in the metrics and graphs of the [**Home**](/the-workspace/home.md) area.
{% endstep %}

{% step %}
Specify the **Devo Cloud**<mark style="color:red;">**\***</mark> environment you wish to send your data to (**US**, **EU**, or **CA**). For details on the URLs, [see here](https://docs.devo.com/space/latest/94762521/Getting+started).
{% endstep %}

{% step %}
Enter the rules for connecting to this cloud environment:

<table><thead><tr><th width="169.83203125">Parameters</th><th>Description</th></tr></thead><tbody><tr><td><strong>Net buffer size</strong></td><td>Define the number of bytes allocated for buffering network data during transmission to Devo. The minimum value is <code>-1</code>.</td></tr><tr><td><strong>Write timeout</strong></td><td>Enter the number of milliseconds to wait before considering the request a timeout. The minimum value is <code>1</code>.</td></tr><tr><td><strong>Idle timeout</strong></td><td>Enter the milliseconds the connection remains open and idle before it is automatically terminated or closed. The minimum value is <code>1</code>.</td></tr><tr><td><strong>Dial timeout</strong></td><td>The maximum time (in ms) allowed for establishing a connection before the attempt is aborted. The minimum value is <code>1</code>.</td></tr><tr><td><strong>Connection Time to Live</strong></td><td>The maximum duration (in ms) the connection remains active before it is forcibly closed, regardless of whether it is idle or in use. The minimum value is <code>1</code>.</td></tr></tbody></table>
{% endstep %}

{% step %}
In the **TLS** section, enter the authentication credentials

* **Certificate** - Add your TLS certificate from your [Secrets](/administration/global-settings/organization-settings/secrets-management.md) or create one.
* **Private Key** - Add your private key from your [Secrets](/administration/global-settings/organization-settings/secrets-management.md) or create one.
* **CA Chain** - Add your CA chain from your [Secrets](/administration/global-settings/organization-settings/secrets-management.md) or create one.
  {% endstep %}

{% step %}
Click **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the corresponding value.
* Click **Save**.

<figure><picture><source srcset="/files/NeeWsSQzoChVxRIY76Nt" media="(prefers-color-scheme: dark)"><img src="/files/1oTccyPmgZJ1laY7IhZH" alt=""></picture><figcaption></figcaption></figure>

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/administration/global-settings/organization-settings/secrets-management.md).
{% endhint %}

You can now select the created secrets in the configuration.
{% endstep %}
{% endstepper %}

Click **Finish** when complete. Your new Data sink will appear in the **Data sinks** area list.

## Pipeline configuration

When it comes to using this Data sink in a [Pipeline](https://docs.onum.com/the-workspace/pipelines), you must configure the following output parameters. To do it, simply click the Data sink on the canvas and select **Configuration**.

### Output configuration

If your message already has the required format, toggle **Passthrough** to send on the message exactly as the sink receives it. Uncheck **Passthrough** to manually format the message:

#### **Type**

<table><thead><tr><th width="170.03125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><strong>Output type</strong></td><td><p>The Syslog format to send in:</p><p></p><ul><li>The original BSD format (<strong>Syslog RFC 3164</strong>) </li><li>The “new” format (<strong>Syslog RFC 5424</strong>)</li></ul><p>If you are unsure about the veracity of the fields you have chosen, you can click <strong>Validate</strong> to check if they are valid. For the <strong>Syslog RCF 3164</strong> type, you have the option to <strong>Auto-fix</strong> the values to correctly populate them.</p></td></tr></tbody></table>

You must select the incoming fields that correspond to each value to build the end message in Devo. The fields to configure will differ depending on the Syslog type chosen.

{% tabs %}
{% tab title="Syslog RFC 3164" %}

#### **Header**

Enter the header parameters:

* **Priority**<mark style="color:red;">**\***</mark>/ **Severity** **&** **Facility**<mark style="color:red;">**\***</mark> - The field corresponding to the Priority OR the fields corresponding to the Severity and Facility that will be used to make the Priority field.
* **Timestamp** - The field containing the timestamp value.
* **Hostname** - The field containing the hostname.

#### **Message**

Enter the fields used to build the body of the message:

* **Tag -** The field containing the tag.
* **ProcId** - The incoming field with the process ID.
* **Content** - The field used as the content field.

#### Test mode

Decide if you want to send events while they are still processing. This is useful to test the Pipeline without the need for a valid destination.
{% endtab %}

{% tab title="Syslog RFC 5424" %}

#### **Header**

Enter the header parameters:

* **Priority**<mark style="color:red;">\*</mark> / **Severity** **&** **Facility**<mark style="color:red;">\*</mark> - The field corresponding to the Priority OR the fields corresponding to the Severity and Facility that will be used to make the Priority field.
* **Timestamp** - The field containing the timestamp value.
* **Hostname** - The field containing the hostname.
* **Appname** - The field containing the application name.
* **ProcID** - The field containing the Process ID.
* **Message ID** - The field containing the Message ID.

#### **Structured data**

* **Structured data** - Where to source the structured data from.

#### **Message**

Enter the fields used to build the body of the message:

* **Message** - The field containing the message body.

#### Test mode

Decide if you want to send events while they are still processing. This is useful to test the Pipeline without the need for a valid destination.
{% endtab %}
{% endtabs %}

Click **Save** to save your configuration.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.onum.com/the-workspace/data-sinks/data-sink-integrations/send-data-to-devo.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.