starting basis for syslog source recognition in NetSecurity