Secure60 Collector

Overview

The Secure60 Collector ingests data from your log sources and transforms it into the Secure60 Common Information Model (CIM), then sends it to your Secure60 Project.

Key Features

How configuration works

You deploy a collector once with a small environment file that says which collector group it belongs to. Everything after that — which parsers run, and what they do — is managed in the portal and pulled by the collector on a loop. A parser change is live inside a minute, with no redeploy and no restart.

Three things make up that configuration:

What it does
Log Parsers Match a log type and pull structured fields out of it — usernames, IP addresses, outcomes — into CIM field names.
Parser Templates Proven parsers you can deploy into an organisation in one click, without writing any parser code.
Log Patterns Automatic detection of the log shapes arriving in your project, so you can see what you have before you parse it.

If you are starting out, begin with Parser Templates — it is the fastest way to get structured fields out of a common log source.

Collector configuration can also be managed entirely through an environment file, without the portal. That approach is documented under Manual Configuration and is mainly of interest for older deployments and for the few settings that are still read at start-up.

Creating Collector Groups

Collector Groups allow you to organize and manage multiple collectors together. This is the starting point for portal-based configuration.

Step 1: Navigate to Collectors

  1. Log in to your Secure60 Portal
  2. Navigate to Integrations → Secure60 Collector → Collectors

Step 2: Create a New Collector Group

  1. Click the “New Collector Group” button
  2. Enter a descriptive name for your collector group (e.g., “Production Web Servers”, “Network Devices”, “Application Logs”)
  3. The system will generate a unique identifier for this group
Collector group panel in the Secure60 portal showing the display name, group name, and profile assignment

The Group Name is the key collectors report under. It can be edited while you are creating the group, but is locked once saved.

Step 3: Generate Configuration File

Once you’ve created a collector group, you can generate a .env file that contains all the necessary configuration:

  1. Select your collector group from the list
  2. Click to view the group details
  3. Generate or download the .env file
Generated .env file for a collector group in the Secure60 portal

The generated file is deliberately small — it identifies the collector and nothing more:

S60_PROJECT_ID=<your project id>
S60_INGEST_TOKEN=<generated token>
COLLECTOR_GROUP=<your group name>
ENABLE_GENERIC_NORMALISE=true
ENTITY_TRACKING_HOSTNAME=true
ENTITY_TRACKING_USERNAME=true
ENTITY_TRACKING_SRCIP=true
ENTITY_TRACKING_APPNAME=true

COLLECTOR_GROUP is the important line: it is what the collector uses to ask the portal which configuration belongs to it. Profiles and parsers are not written into this file — they arrive over the sync described below, which is why a parser change never requires a redeploy.

Step 4: Deploy the Collector

Use the generated .env file to deploy your Secure60 Collector:

docker run -i --name s60-collector \
  -p 80:80 -p 443:443 -p 514:514/udp -p 6514:6514 -p 5044:5044 \
  --rm -d --env-file .env secure60/s60-collector:stable

Or using Docker Compose:

services:
  s60-collector:
    image: "secure60/s60-collector:stable"
    container_name: "s60-collector"
    ports:
      - "443:443"
      - "80:80"
      - "514:514/udp"
      - "6514:6514"
      - "5044:5044"
    env_file:
      - .env
    restart: 'always'

Managing Collector Groups

The Collectors page displays two sections:

You can:

Collector Profiles

Collector Profiles are containers that hold one or more Log Parsers. They allow you to organize parsers logically and apply them to specific collector groups.

Collector Profiles page in the Secure60 portal listing profiles by name and value

Creating a Collector Profile

  1. Navigate to Integrations → Secure60 Collector → Collector Profiles
  2. Click “New Profile” or “Add Item”
  3. Enter a descriptive name for your profile (e.g., “Cisco ASA Logs”, “Web Application Logs”, “Authentication Events”)
  4. Optionally, provide a value identifier for the profile

Assigning Log Parsers to Profiles

  1. Select a profile from the list
  2. Add Log Parsers to the profile by:
    • Creating new parsers directly in the profile
    • Assigning existing parsers to the profile
  3. Configure the order in which parsers are applied (if multiple parsers are in the profile)

Assigning Profiles to Collector Groups

  1. Navigate to Collectors
  2. Click on a collector group to view its details
  3. Assign one or more profiles to the group
  4. The collectors in that group will automatically use the parsers defined in the assigned profiles

Configuration Management

How configuration reaches the collector

Configuration is pulled, not pushed. Each collector asks the portal what it should be running, on a loop:

  1. The collector authenticates with its ingest token and asks for the configuration belonging to its COLLECTOR_GROUP
  2. The portal returns the parser code from every profile assigned to that group
  3. The collector validates the code in isolation before applying it — a parser that would not compile is rejected and the previous configuration keeps running
  4. Valid configuration is written to disk and picked up without a restart
  5. Unchanged configuration is skipped, so a collector that is already current does nothing

The poll runs every 60 seconds by default, so a parser saved in the portal is live on every collector in the group inside a minute. There is no redeployment, no container restart, and no window where the collector is running a half-applied configuration.

A collector with no COLLECTOR_GROUP set skips the sync entirely and runs on its environment file alone — which is what a collector deployed before this workflow existed will do until you assign it a group.

Portal-Based Configuration Benefits

Using the portal for collector configuration provides several advantages:

Configuration Workflow

The recommended workflow is:

  1. Initial Setup: Create collector groups and generate .env files
  2. Deploy Collectors: Use the generated .env files to deploy collectors
  3. Monitor Unknown Collectors: Review unknown collectors and assign them to groups
  4. Create Profiles: Build profiles for different log types or environments
  5. Build Parsers: Create parsers using Log Patterns, Search, or manual creation
  6. Assign Profiles: Link profiles to collector groups
  7. Iterate: Refine parsers and profiles as you learn more about your log data

Advanced Configuration

A few features are not yet managed through this workflow and are still configured on the collector itself — data masking and privacy controls among them. Those live on the Manual Configuration page, which generates a larger environment file, and they are read at start-up rather than synced.

For anything else, contact integrations@secure60.io.

See the Manual Configuration documentation for details on advanced configuration options.

Best Practices

Organizing Collector Groups

Designing Collector Profiles

Building Effective Log Parsers

Managing Unknown Collectors

Getting Help

For assistance with portal-based collector configuration:

We strongly recommend working with our Integrations team for custom advice and onboarding assistance specific to your organization’s needs.

Back to top