---
title: "Avaya Avaya G450 Media Gateway Integration"
slug: "avaya-g450-media-gateway"
updated: 2026-11-08T14:38:36Z
published: 2026-11-08T14:38:36Z
canonical: "docs.hunters.ai/avaya-g450-media-gateway"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Avaya Avaya G450 Media Gateway Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Avaya G450 Media Gateway Syslog |  | ✅ | ✅ | ✅ | `avaya_g450_media_gateway_syslog` | JSON | S3, GCP Bucket List, Azure Block Storage List |

## Overview

The Avaya G450 Media Gateway is a branch/enterprise voice gateway appliance that bridges analog, digital, and VoIP telephony traffic as part of Avaya Communication Manager / Aura deployments. The gateway emits syslog messages covering operational events (clock synchronization faults, hardware/voice processing errors) as well as security-relevant events such as SSH account lockouts, unauthorized access attempts (with source IP, username, and protocol), and MSS (Media Server Synchronization) notifications. These logs are collected via Cribl, which wraps the native syslog-derived fields into a JSON envelope (`_raw` holding a JSON string, plus `_time`) before delivery to cloud storage (S3/GCS/Azure Blob) and ingestion by Hunters. For security operations, these logs are valuable for detecting brute-force/unauthorized remote access attempts against gateway management interfaces, account lockouts, and device health/availability issues that could indicate tampering or outages affecting voice infrastructure.

## Supported data types

### Avaya G450 Media Gateway Syslog

**Table name:** `avaya_g450_media_gateway_syslog`

This data type contains syslog events generated by the Avaya G450 Media Gateway, including security-relevant events such as unauthorized access attempts, SSH account lockouts, and MSS notifications, as well as operational events like clock synchronization failures and voice processing errors. These events capture the source IP, username, and protocol involved, enabling detection of unauthorized or anomalous access to gateway management interfaces.

**Expected format**

Logs are expected in JSON format.

`{"_raw": "{\"year\":\"2026\",\"priority\":\"<44>\",\"timestamp\":\"Mar 05 13:02:15\",\"hostname\":\"BRANCH1_G450_01\",\"tag\":\"-NoTag\",\"dateformat\":\"-NoUTC\",\"model\":\"mediagateway.g450\",\"eventtype\":\"lntUnAuthAccessEvent\",\"message\":\"SECURITY-Warning: Unauthorized Access from IP address = 192.168.77.212, User = mdavis, Protocol = 22\"}", "_time": 1772715735}`

## Send data to Hunters

Hunters supports the collection of Avaya logs using S3 List, S3 Notifications, GCP Bucket List, and Azure Block Storage List.

**To connect Avaya logs:**

### Connect using S3 List or S3 Notifications

1. Route Avaya logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in [this section](https://docs.hunters.ai/docs/connect-data-through-aws-s3).

### Connect using GCP Bucket List

1. Route Avaya logs into a Google Cloud Storage bucket.
2. Once logs are in the bucket, follow the steps in [this section](https://docs.hunters.ai/docs/connect-data-through-gcp).

### Connect using Azure Block Storage List

1. Route Avaya logs into an Azure Storage container as block blobs.
2. Once logs are in the container, follow the steps in [this section](https://docs.hunters.ai/docs/connect-data-through-azure-storage).