Data forward to SIEM

[y0d4a]

Hi,

i try to forward rsyslog to external server by adding lines in /etc/rsyslog.d/honey-log.conf
module(load="imtcp")
input(type="imtcp" port="514")
. @@X.X.X.X:514

But data which i got is related to dockers images like:

my idea was to forward attacks events, but not sure how, can i get some help? :)

thank you

[y0d4a]

bump bump :)