Network Devices

Network devices

Routers, firewalls, and switches send their logs to Hal as syslog. The flow is one-way in — Hal receives the logs and never reaches back into the devices.

The format: RFC 5424

Hal ingests the modern, structured RFC 5424 syslog format — not the older RFC 3164 “BSD syslog.” RFC 5424 carries a precise, timezone-aware timestamp, the originating host, and a structured-data section, so each message parses cleanly into typed, searchable fields instead of a free-text blob. pfSense and other FreeBSD-based gear — the common case on MSP networks — emit 5424 directly.

Transport is UDP syslog. Rather than expose a syslog port to the public internet, network logs reach Hal over your Tailscale connection — a private, encrypted tunnel — so a device’s logs never cross the open internet on their way in.

What’s collected

• Authentication events — SSH logins and privilege escalation (su and sudo)
• Device process and system events, with their source addresses

Retained 365 days, searchable alongside your cloud and endpoint sources.

Setting it up

Network devices reach Hal over Tailscale — a customer-owned, customer-managed integration on your instance. HAL AI doesn’t set it up or run it for you. You enable it yourself from the portal (Settings → Tailscale): generate a pre-auth key in your own Tailscale admin console, paste it in, and connect. That puts your instance on your tailnet, so device logs travel over an encrypted tunnel instead of the public internet.

Once Tailscale is connected, point the device’s syslog (RFC 5424, over UDP) at the syslog ingestion record for your instance — Hal can give you the exact hostname and walk you through the device side. The setup is yours to run; Hal’s part is guidance and the endpoint.