# RFC3164 Relay — Forwarded Log Walkthrough

Recorded against /assets/index-CY6Sm-TX.js; source revision a4b4e2f; browser-observed workflow. No live target was connected.

## RELAY FORWARDED EVENTS

Learn to parse security events after a Syslog relay adds its own outer header.

## TRAINING IDENTITY

For this synthetic lab, enter Training as the manufacturer and Relay K V demo as the product.

## PASTE FORWARDED CAPTURE

Paste the two complete post-relay records. Both start with the Syslog priority marker.

## DECLARE RELAY HOST

Open Optional declare Syslog forwarder hostnames and enter relay zero one.

## REVIEW RELAY BOUNDARIES

Check that both relay headers are recognized, with zero unsafe or unmatched records.

## APPLY PROFILE

Apply declared relay profile. This keeps the original source text intact.

## ANALYZE WRAPPED LOGS

Click Analyze Logs. The demonstrated source returns two of two events completely parsed.

## VERIFY ORIGINAL FIELDS

Confirm source and destination I P, action, protocol and session I D.

## REVIEW EXTRACTED VALUES

Continue to Review Fields and verify the original event payload has not been confused with the relay host.

## MAP TARGET FIELDS

Continue to Map Fields and check the Stellar Cyber seven point zero recommendations.

## CREATE PARSER DRAFT

Continue to Create Parser and run the final test only when the results are acceptable.

## FINAL DRAFT TEST

Run Final Test and Create Files. A downloaded parser is not a live data processor test.

## TEST A NEW RELAY EVENT

Use the separate holdout relay log to verify the rule does not only match the original example.