The syslog writer retrieves Idira Identity or User Behavior Analytics (UBA) events using REST APIs and writes those events to the syslog. The Splunk Add-on, or other SEIM integration, then uses the syslog as a data source. The Idira Syslog Writer captures events from Idira Identity, while Idira Identity Threat Intelligence Syslog Writer captures events from User Behavior Analytics.