Management & monitoringTCP/UDP 514, 6514 Cleartext by default
Port 514, 6514: Syslog
Syslog
Sends logs to a central collector. Traditional syslog uses UDP 514 with no encryption; syslog over TLS uses TCP 6514.
Secure alternative: Syslog over TLS (6514)
How attackers abuse it
- Logs read or forged in transit.
- UDP delivery silently loses events under load.
How to defend it
- Use TCP with TLS (6514) to the SIEM.
- Restrict which hosts can send to the collector.
Exam tip
Central, protected log collection supports both detection and the integrity of evidence.