Uniformed speculation, but I imagine the monitoring device sends warnings and such to a central SIEM/log server (like splunk) for analysis and correlation acros

Uniformed speculation, but I imagine the monitoring device sends warnings and such to a central SIEM/log server (like splunk) for analysis and correlation across multiple devices. That channel is likely web server calls or json posts, over https.