SIEM: HEC - Cato Networks

Team: Huntress Managed Security Information and Event Management (SIEM)
Product: Cato Networks
Environment: Cato Management Application (CMA); Huntress Platform
Summary: Forward Cato Networks security and connectivity events to Huntress Managed SIEM over a Splunk HTTP Event Collector (HEC) integration.

In this Article

Before You Begin
Configure the Source in the Huntress Platform
Configure the Integration in Cato
Search Cato Logs in Managed SIEM
Example Log Messages
What Is Not Collected
Troubleshooting

Before You Begin

Before setting up this integration, ensure you have:

• Editor permission for Integrations (in the Resources section) in the Cato Management Application (CMA).

• A Huntress account with the Managed SIEM entitlement.

• Available integration capacity in Cato. A Cato account allows at most three event integrations, shared across integration types. If you are at the cap, remove an unused integration first.

• Track is enabled on the Cato rules whose events you want to see. Event tracking is set per rule; a rule with tracking off emits no events.

• A Cato Threat Protection license (required if you want IPS events).

• Cato Suspicious Activity Monitoring (SAM) is enabled (required if you want Suspicious Activity events).

Configure the Source in the Huntress Platform

1. Log in to the Huntress Platform and go to Source Management.

2. Select Add Source.

3. Under Network/Firewall, select Cato Networks.

4. Select the organization the source belongs to, name the source, and save your changes. The URL and token are generated once the source is saved.

5. On the source edit page, copy the HTTP Event Collector URL and the HTTP Event Collector Token. You will paste both into Cato in the next task.

Configure the Integration in Cato

1. Log in to the CMA and go to Resources > Integrations.

2. On the Integrated Apps tab, select New.

3. Select Splunk.

4. In Ingestion URL, paste the HTTP Event Collector URL from the Huntress source edit page.

5. In API Key, paste the HTTP Event Collector Token from the Huntress source edit page.

6. Leave Port empty. Huntress listens on the default port 443.

7. Leave Index empty. Huntress does not use a Splunk index; any value entered here is ignored.

8. For data sources, select Events.

Warning: Select Events only. Do not enable Flows. Huntress Managed SIEM ingests Cato events. Flows are not parsed and will not appear as normalized SIEM data.

9. Save your changes.

Events appear under the new source in Source Management within a few minutes. If no data arrives, see the Troubleshooting section below.

Tip: Filtering in Cato is the most cost-effective way to exclude high-volume events you do not want to search in Huntress. Cato native SIEM integrations support filter groups, which let you limit the integration to specific values of fields such as action, severity, rule name, application, site, or user.

Search Cato Logs in Managed SIEM

Huntress normalizes Cato events to ECS fields. Every original Cato field is also searchable under the cato.* prefix (for example, cato.rule_id or cato.pop_name).

Note: The event.action field is normalized, so search using the normalized form. For example, Cato's "Bypass by Size" is searchable as bypass-by-size. The unmodified Cato value is always available under cato.action.

Cato fields that Huntress does not map to a dedicated ECS field remain fully searchable under cato.*. These include MITRE ATT&CK enrichment (cato.mitre_attack_tactics, cato.mitre_attack_techniques, cato.mitre_attack_subtechniques) and anti-malware file hashes (cato.file_hash).

Example Query Builder Rows

Note: The field box suggests common ECS fields and accepts typed input. Fields like rule.name, network.transport, and all cato.* fields are searchable but may not appear in the suggestion dropdown, so type them in full.

Example Log Messages

The examples below show Cato events after Huntress normalizes them. Values are sanitized using IETF documentation IP address blocks, and a representative subset of cato.* passthrough fields are shown.

Firewall Block (Internet Firewall)

{
  "@timestamp": "2026-02-21T04:57:21.652Z",
  "event.provider": "Cato Networks",
  "event.category": "network",
  "event.action": "block",
  "source.ip": "192.0.2.10",
  "destination.ip": "198.51.100.1",
  "destination.port": "443",
  "network.transport": "tcp",
  "rule.name": "Block P2P",
  "message": "Internet Firewall Block: 192.0.2.10 → blocked.example.com (rule: Block P2P)",
  "cato.event_type": "Security",
  "cato.event_sub_type": "Internet Firewall",
  "cato.action": "Block",
  "cato.domain_name": "blocked.example.com",
  "cato.pop_name": "Atlantis",
  "cato.event_count": "1"
}

IPS Threat (Requires Threat Protection)

{
  "@timestamp": "2026-02-21T05:03:11.000Z",
  "event.provider": "Cato Networks",
  "event.category": "threat",
  "event.action": "block",
  "event.code": "feed_ips15_ssh",
  "source.ip": "192.0.2.10",
  "destination.ip": "203.0.113.44",
  "message": "IPS Block: Epsilon Red Ransomware http://malicious.example.com/payload",
  "cato.event_type": "Security",
  "cato.event_sub_type": "IPS",
  "cato.signature_id": "feed_ips15_ssh",
  "cato.threat_name": "Epsilon Red Ransomware",
  "cato.threat_type": "Ransomware",
  "cato.url": "http://malicious.example.com/payload",
  "cato.mitre_attack_tactics": "Initial Access (TA0001), Reconnaissance (TA0043)"
}

Admin Sign-In (Connectivity)

{
  "@timestamp": "2026-02-21T05:10:00.000Z",
  "event.provider": "Cato Networks",
  "event.category": "authentication",
  "event.action": "succeeded",
  "user.name": "admin@example.com",
  "source.ip": "198.51.100.25",
  "message": "Cato Management Application Succeeded by admin@example.com",
  "cato.event_type": "Connectivity",
  "cato.event_sub_type": "Cato Management Application",
  "cato.action": "Succeeded",
  "cato.src_country": "Ireland"
}