In order to send logs to SGBox you need to modify first you syslog settings:

1. Go to Detections > Notifications > Notification Method Settings. The Notification Method Settings screen will appear.
2. In the Syslog Settings section, specify the following:
   •  Server IP address: Type the IPv6 or IPv4 address of the syslog server
   •  Port: The port number of the syslog server
   • Facility: Select the facility code
3.  Click Save

NOTE: 

Log Forwarder can send several log types from the Apex Central database to a syslog server in either Common Event Format (CEF) or Apex Central format.

1. Log in to Apex Central console using an Administrator account.
2. Go to Administration → Settings → Syslog Settings. The Syslog Settings screen appears.
3. Select the Enable syslog forwarding check box.
4. Configure the following settings for the server that receives the forwarded syslogs:
   •  Server address: FQDN or IP address of the receiving Syslog or SIEM server.
   •  Port: Syslog server port number. For UDP, the IANA standard port number is 514. For TLS, it’s usually port 6514.
   •  Protocol: Select TCP, UDP, or SSL/TLS as the method of communication with the syslog server
   • NOTE: For best security practice, upload CA certificate that issued receiver’s SSL certificate to enable SSL certificate validation. If the receiver SSL certificate is a self-sign certificate, it must contains Subject and Subject Alternative Name, the CN Name and DNS Name must contain the Receiver host FQDN or IP address.Apex Central only supports CA certificates in X.509 format with .DER or .PEM encoding
5. Select the log Format:
   •  CEF: Uses the standard Common Event Format (CEF) for log messages
6. Configure the Frequency for when Apex Central forwards the logs.
7. Select the log type(s) to forward:
   •  Select a log category from the Log type dropdown list:
     •  Security log
     • Product information
   •  Select the check box for the log(s) you want to forward. Apex Central displays the total number of selected log types next to the Log type dropdown list.
   • (Optional) Select another log category from Log type dropdown list to select additional logs types to forward.
8.  Click Test Connection to test the server connection. The syslog server connection status will appear at the top of the screen.
9.  Click Save.

NOTE: 

• Apex Central starts forwarding logs to the configured syslog server.
• To monitor the log forwarding status, go to Administration > Command Tracking and select Forward Syslog from the Command drop-down list.

 If SSL/TLS is selected, by default Apex Central accepts receiver's SSL certificate without validation

• For best security practice, upload CA certificate that issued receiver’s SSL certificate to enable SSL certificate validation.
• If the receiver SSL certificate is a self-sign certificate, it must contains Subject and Subject Alternative Name, the CN Name and DNS Name must contain the Receiver host FQDN or IP address.
• Apex Central only supports CA certificates in X.509 format with .DER or .PEM encoding