Supported log types and default parsers
This document contains information about Chronicle SIEM integrations for data ingestion.
It summarizes the devices, and the associated ingestion label (log_type
) field in the
Ingestion API and data_type
in a Forwarder configuration), that Chronicle SIEM supports.
Supported log types with a default parser
Parsers normalize raw log data into structured Unified Data Model format. This
section lists supported devices, and the associated ingestion label (log_type
field in the
Ingestion API and data_type
in a Forwarder configuration), that also have a prebuilt default parser.
The default parser is supported by Chronicle as long as the device's
raw logs are received in the required format.
For a list of supported log types without a default parser, see Supported log types without a default parser.
The Format column indicates the high-level structure of the raw log, as:
- CSV: Comma Separated Values
- JSON: JavaScript Object Notation
- SYSLOG: syslog formatted message
- KV: key-value pair
- XML: Extensible Markup Language
- SYSLOG + KV: syslog header with key-value body
- SYSLOG + JSON: syslog header with JSON body
- SYSLOG + XML: syslog header with XML body
- LEEF: Log Event Extended Format
- CEF: Common Event Format
These changes are applied to newly ingested logs. Parser changes are not applied retroactively to previously ingested logs.
Vendor / Product | Category | Ingestion label | Format | Latest Update |
---|---|---|---|---|
Microsoft AD FS | LDAP | ADFS |
JSON | 2023-08-18 View Change |
AWS Macie | AWS-specific logs | AWS_MACIE |
JSON | 2022-08-08 View Change |
F5 VPN | VPN | F5_VPN |
SYSLOG | 2022-07-22 View Change |
Cisco AMP | AV / Endpoint | CISCO_AMP |
JSON | 2021-12-12 |
Azure Firewall | Azure Firewall Application Rule | AZURE_FIREWALL |
JSON | 2023-06-01 View Change |
TeamViewer | Remote Support | TEAMVIEWER |
JSON | 2022-08-02 View Change |
GitHub | SaaS Application | GITHUB |
JSON | 2023-10-25 View Change |
Duo Administrator Logs | Authentication | DUO_ADMIN |
JSON | 2023-03-10 View Change |
Palo Alto Networks Traps | EDR | PAN_EDR |
CSV + KV | 2022-08-22 View Change |
Cloudflare Audit | SaaS Application | CLOUDFLARE_AUDIT |
JSON | 2023-07-09 View Change |
Fastly WAF | WAF | FASTLY_WAF |
JSON | 2022-06-06 View Change |
Digital Guardian EDR | EDR | DIGITALGUARDIAN_EDR |
KV | 2022-12-07 View Change |
Qualys VM | Vulnerability Scanner | QUALYS_VM |
KV + JSON | 2023-10-27 View Change |
Squid Web Proxy | Web Proxy | SQUID_WEBPROXY |
SYSLOG | 2022-10-30 View Change |
Aruba IPS | IPS | ARUBA_IPS |
JSON | 2022-06-16 View Change |
SOTI MobiControl | Mobile Device Management | SOTI_MOBICONTROL |
SYSLOG | 2023-09-08 View Change |
IAM Context | Google Cloud Specific | N/A |
JSON | 2023-07-26 View Change |
Dell EMC Data Domain | Storage system | DELL_EMC_DATA_DOMAIN |
SYSLOG + KV | 2022-07-08 View Change |
File Scanning Framework | File scanning | FILE_SCANNING_FRAMEWORK |
JSON | 2021-09-27 |
Akamai DNS | DNS | AKAMAI_DNS |
CSV | 2021-06-28 |
CA ACF2 | Mainframe | CA_ACF2 |
LEEF | 2022-05-24 View Change |
BigQuery | Google Cloud Resources Contexts | N/A |
JSON | 2022-03-03 |
Dope Security SWG | Secure Access Service Edge | DOPE_SWG |
CSV | 2023-05-18 View Change |
F5 BIGIP LTM | Load Balancer, Traffic Shaper, ADC | F5_BIGIP_LTM |
SYSLOG | 2023-08-28 View Change |
Splunk Platform | Security log | SPLUNK |
JSON | 2023-11-29 View Change |
Atlassian Jira | Ticketing Application | ATLASSIAN_JIRA |
SYSLOG, JSON | 2023-11-10 View Change |
Palo Alto Prisma Cloud Alert payload | Cloud Security | PAN_PRISMA_CA |
JSON | 2023-08-17 View Change |
ZScaler VPN | VPN | ZSCALER_VPN |
SYSLOG + CSV | 2023-06-08 View Change |
Oracle Cloud Infrastructure | Oracle Cloud Infrastructure | ORACLE_CLOUD_AUDIT |
JSON | 2023-10-30 View Change |
Rapid7 | Vulnerability Scanner | RAPID7_NEXPOSE |
JSON | 2022-09-27 View Change |
Duo Entity context data | Identity and Access Management | DUO_CONTEXT |
JSON | 2022-03-14 |
Apigee | Google Cloud Specific | GCP_APIGEE_X |
JSON | 2023-08-09 View Change |
BIND | DNS | BIND_DNS |
SYSLOG | 2023-09-19 View Change |
Broadcom SSL Visibility Appliance | SSL Visibility | BROADCOM_SSL_VA |
SYSLOG | 2022-09-26 View Change |
Armis Alerts | ALERTS | ARMIS_ALERTS |
JSON | 2023-02-07 View Change |
Salesforce | SaaS Application | SALESFORCE |
KV (LEEF), CSV | 2023-02-24 View Change |
Medigate IoT | IoT | MEDIGATE_IOT |
SYSLOG + JSON | 2023-11-08 View Change |
Yubico OTP | Audit event | YUBICO_OTP |
SYSLOG, JSON, CSV | 2023-02-20 View Change |
Forcepoint NGFW | Network | FORCEPOINT_FIREWALL |
JSON | 2023-02-16 View Change |
Avatier Password Management | SaaS Application | AVATIER |
SYSLOG + KV | 2021-08-05 |
Office 365 | SaaS Application | OFFICE_365 |
JSON | 2023-11-29 View Change |
PostFix Mail | Email Server | POSTFIX_MAIL |
SYSLOG | 2022-10-06 View Change |
Proofpoint Email Filter | Email Server | PROOFPOINT_MAIL_FILTER |
KV | 2022-10-03 View Change |
Attivo Networks | NETWORK | ATTIVO |
SYSLOG + KV (CEF) | 2023-08-14 View Change |
CircleCI | Automation and DevOps Tools | CIRCLECI |
CSV + JSON | 2023-03-09 View Change |
AWS Session Manager | AWS Specific | AWS_SESSION_MANAGER |
SYSLOG | 2023-06-14 View Change |
Suricata IDS | IDS/IPS | SURICATA_IDS |
JSON | 2023-11-23 View Change |
Radware Web Application Firewall | Firewall | RADWARE_FIREWALL |
SYSLOG | 2023-11-23 View Change |
Island Browser logs | Web Browser | ISLAND_BROWSER |
JSON | 2023-09-04 View Change |
GMAIL Logs | Google Cloud Specific | GMAIL_LOGS |
JSON | 2023-08-21 View Change |
AWS CloudFront | CDN | AWS_CLOUDFRONT |
SYSLOG | 2022-05-27 View Change |
Forcepoint Proxy | Web Proxy | FORCEPOINT_WEBPROXY |
SYSLOG + KV (CEF), LEEF | 2023-06-12 View Change |
Windows Network Policy Server | Authentication | WINDOWS_NET_POLICY_SERVER |
SYSLOG, JSON, SYSLOG + XML | 2022-11-21 View Change |
Cisco UCS | OS logs | CISCO_UCS |
SYSLOG | 2022-07-04 View Change |
Ping Federate | Authentication | PING_FEDERATE |
CSV | 2023-04-24 View Change |
Avanan Email Security | Email Server | AVANAN_EMAIL |
JSON | 2022-07-12 View Change |
AWS Key Management Service | AWS Specific | AWS_KMS |
JSON | 2022-05-27 View Change |
Anomali | IOC | ANOMALI_IOC |
JSON, CEF | 2022-03-14 |
BeyondTrust Privileged Identity | Privilege Account Activity | BEYONDTRUST_PI |
SYSLOG | 2022-10-24 View Change |
Forseti Open Source | Google Cloud Specific | FORSETI |
JSON | 2021-12-23 |
FireEye | Alerts | FIREEYE_ALERT |
SYSLOG + JSON, JSON | 2023-11-09 View Change |
Windows DNS | DNS | WINDOWS_DNS |
JSON, XML, SYSLOG + KV | 2023-11-29 View Change |
HAProxy | Load balancing | HAPROXY |
SYSLOG | 2023-09-25 View Change |
Kisi Access Management | Physical Security | KISI |
JSON | 2023-06-14 View Change |
Silverfort Authentication Platform | Identity and Access Management | SILVERFORT |
CEF SYSLOG | 2023-10-11 View Change |
Atlassian Confluence | Knowledge base | ATLASSIAN_CONFLUENCE |
SYSLOG, JSON | 2023-11-14 View Change |
VMware Workspace ONE | Logging and Troubleshooting | VMWARE_WORKSPACE_ONE |
SYSLOG | 2023-08-04 View Change |
Centrify | SSO | CENTRIFY_SSO |
JSON | 2022-08-10 View Change |
Red Canary | EDR | REDCANARY_EDR |
JSON | 2022-09-15 View Change |
IBM Informix | DATABASE | INFORMIX |
JSON + SYSLOG | 2022-02-18 |
Passive DNS | DNS | PASSIVE_DNS |
JSON | 2021-05-19 |
Azure SQL | Database | AZURE_SQL |
JSON | 2022-02-08 |
IBM Websphere Application Server | Web server | IBM_WEBSPHERE_APP_SERVER |
JSON, SYSLOG | 2022-01-20 |
Archer Integrated Risk Management | Risk Management Solution | ARCHER_IRM |
SYSLOG | 2022-05-04 View Change |
Netscout Arbor Sightline | Monitoring | ARBOR_SIGHTLINE |
SYSLOG + JSON | 2022-12-16 View Change |
Custom Security Data Analytics | Log Aggregation | CUSTOM_SECURITY_DATA_ANALYTICS |
JSON | 2022-07-08 View Change |
Palo Alto Prisma Access | Cloud Security | PAN_CASB |
JSON | 2022-11-25 View Change |
Ping Identity | Authentication | PING |
JSON, SYSLOG + KV | 2023-04-06 View Change |
Cisco ISE | Identity and Access Management | CISCO_ISE |
SYSLOG | 2023-11-20 View Change |
Cloud Run | Google Cloud Specific | GCP_RUN |
JSON | 2023-04-13 View Change |
Atlassian Bitbucket | Atlassian Bitbucket | ATLASSIAN_BITBUCKET |
JSON | 2023-06-12 View Change |
TCPWave DDI | Secure ddi | TCPWAVE_DDI |
SYSLOG + JSON | 2022-09-27 View Change |
Elastic Audit Beats | ALERTING | ELASTIC_AUDITBEAT |
JSON | 2023-09-04 View Change |
Armis Devices | DEVICES | ARMIS_DEVICES |
JSON | 2023-03-02 View Change |
Guardicore Centra | Deception Software | GUARDICORE_CENTRA |
JSON | 2023-09-08 View Change |
Active Countermeasures | Alert | AI_HUNTER |
SYSLOG | 2020-12-08 |
Netfilter IPtables | Firewall | NETFILTER_IPTABLES |
SYSLOG + KV | 2023-10-12 View Change |
Microsoft Defender For Cloud | Automation and DevOps Tools | MICROSOFT_DEFENDER_CLOUD_ALERTS |
JSON | 2023-08-14 |
Tanium Stream | Tanium Specific | TANIUM_TH |
JSON | 2023-09-20 View Change |
Dell OpenManage | Systems Management Application | DELL_OPENMANAGE |
SYSLOG + KV | 2022-07-27 View Change |
Red Hat OpenShift | Kubernetes Container | REDHAT_OPENSHIFT |
SYSLOG | 2022-08-17 View Change |
Akamai WAF | WAF | AKAMAI_WAF |
SYSLOG | 2023-10-27 View Change |
Cloud Identity Devices | Google Cloud Specific | GCP_CLOUDIDENTITY_DEVICES |
JSON | 2022-04-13 View Change |
ISC DHCP | DHCP | ISC_DHCP |
JSON + SYSLOG + KV | 2022-02-08 |
Rubrik | Backup software | RUBRIK |
SYSLOG | 2022-12-01 View Change |
FortiGate | Firewall | FORTINET_FIREWALL |
JSON, SYSLOG + KV | 2023-11-21 View Change |
Firewall Rule Logging | Google Cloud Specific | N/A |
JSON | 2023-11-01 View Change |
Cofense | Email Server | COFENSE_TRIAGE |
SYSLOG + KV (CEF) | 2023-04-19 View Change |
Trustwave webmarshal | Proxy Server | WEBMARSHAL |
SYSLOG + CSV | 2023-05-04 View Change |
Kubernetes Audit | K8s cluster audit logs | KUBERNETES_AUDIT |
JSON | 2023-08-21 View Change |
Symantec Web Isolation | Secure Access Service Edge | SYMANTEC_WEB_ISOLATION |
JSON | 2022-07-08 View Change |
Delinea PAM | Access Management | DELINEA_PAM |
SYSLOG + CSV | 2022-11-10 View Change |
BeyondTrust | Privilege Account Activity | BOMGAR |
SYSLOG | 2022-11-24 View Change |
Comodo | AV / Endpoint | COMODO_AV |
SYSLOG + KV (CEF) | 2021-04-09 |
Netskope Web Proxy | Web Proxy | NETSKOPE_WEBPROXY |
SYSLOG, SYSLOG+JSON, JSON | 2023-10-09 View Change |
Apache Tomcat | Web server | TOMCAT |
JSON | 2022-04-20 View Change |
VyOS Open Source Router | DHCP | VYOS |
SYSLOG | 2022-10-12 View Change |
Shibboleth IDP | Identity and Access Management | SHIBBOLETH_IDP |
SYSLOG | 2021-04-19 |
Fortinet FortiEDR | EDR | FORTINET_FORTIEDR |
SYSLOG + KV | 2023-08-07 View Change |
AWS Cloudtrail | Cloud Log Aggregator | AWS_CLOUDTRAIL |
JSON | 2023-11-21 View Change |
McAfee ePolicy Orchestrator | Policy Management | MCAFEE_EPO |
SYSLOG + XML, CSV, KV | 2023-10-15 View Change |
Tanium Insight | Tanium Specific | TANIUM_INSIGHT |
SYSLOG + KV | 2021-03-10 |
Infoblox DNS | DNS | INFOBLOX_DNS |
SYSLOG, CEF | 2023-10-17 View Change |
Google Cloud IAM Analysis | Google Cloud Resources Contexts | N/A |
JSON | 2023-02-27 View Change |
D3 Banking | BANKING | D3_BANKING |
JSON | 2022-03-23 View Change |
Opnsense | Firewall and Routing Platform | OPNSENSE |
Syslog, Syslog + CSV | 2023-11-22 View Change |
Qualys Virtual Scanner | Vulnerability Scanner | QUALYS_VIRTUAL_SCANNER |
JSON | 2023-08-21 View Change |
Cisco Umbrella IP | Web Proxy | UMBRELLA_IP |
SYSLOG | 2022-08-22 View Change |
BloxOne Threat Defense | DNS | BLOXONE |
SYSLOG + JSON | 2023-03-07 View Change |
Windows Sysmon | DNS | WINDOWS_SYSMON |
JSON, XML | 2023-11-29 View Change |
Saviynt Enterprise Identity Cloud | Endpoints | SAVIYNT_EIP |
JSON, JSON+KV | 2023-06-05 View Change |
ServiceNow Security | SaaS Application | SERVICENOW_SECURITY |
JSON | 2021-05-24 |
CyberArk | Privilege Account Management | CYBERARK |
KV (CEF) | 2022-10-10 View Change |
Security Command Center Threat | Google Cloud Specific | N/A |
JSON | 2023-11-29 View Change |
Zscaler CASB | CASB | ZSCALER_CASB |
JSON | 2023-09-30 View Change |
Fireeye ETP | Email Server | FIREEYE_ETP |
JSON | 2021-06-11 |
Trend Micro Vision One | AV and endpoint logs | TRENDMICRO_VISION_ONE |
SYSLOG + KV, CEF | 2023-03-24 View Change |
CoSoSys Protector | Endpoint Detection | ENDPOINT_PROTECTOR_DLP |
SYSLOG + KV | 2023-04-17 View Change |
Corelight | NDR | CORELIGHT |
JSON | 2023-11-29 View Change |
Cybereason EDR | EDR | CYBEREASON_EDR |
JSON | 2023-02-23 View Change |
Big Switch BigCloudFabric | Switches, Routers | BIGSWITCH_BCF |
SYSLOG | 2021-04-20 |
Snare System Diagnostic Logs | Security | SNARE_SOLUTIONS |
SYSLOG + KV | 2022-07-29 View Change |
Sysdig | Security | SYSDIG |
JSON | 2022-10-07 View Change |
Compute Context | Google Cloud Specific | N/A |
JSON | 2022-07-29 View Change |
Nucleus Asset Metadata | Nucleus Specific | NUCLEUS_ASSET |
JSON | 2021-08-05 |
Saiwall VPN | VPN | SAIWALL_VPN |
KV | 2023-10-29 View Change |
CrowdStrike Detection Monitoring | EDR | CS_DETECTS |
JSON | 2023-07-21 View Change |
Windows Applocker | Application Locker | WINDOWS_APPLOCKER |
SYSLOG + KV + JSON + XML | 2023-10-17 View Change |
F5 Shape | Security log | F5_SHAPE |
JSON | 2022-02-21 |
AWS RDS | Database | AWS_RDS |
SYSLOG | 2023-04-24 View Change |
Azure WAF | Log Aggregator | AZURE_WAF |
JSON | 2023-07-14 View Change |
Cloud SQL | Google Cloud Specific | GCP_CLOUDSQL |
JSON | 2023-11-29 View Change |
Digital Shadows Indicators | IOC | DIGITAL_SHADOWS_IOC |
JSON | 2022-04-23 |
Sophos DHCP | DHCP | SOPHOS_DHCP |
SYSLOG + KV | 2022-02-10 |
Forcepoint CASB | CASB | FORCEPOINT_CASB |
SYSLOG + CEF | 2022-08-23 View Change |
Arista Switch | Switches | ARISTA_SWITCH |
JSON+SYSLOG | 2022-08-03 View Change |
Cloud NAT | Google Cloud Specific | N/A |
JSON | 2023-04-06 View Change |
Sophos Intercept EDR | EDR logs | SOPHOS_EDR |
JSON | 2022-12-27 View Change |
Zscaler Internet Access Audit Logs | Security Service Edge (SSE) | ZSCALER_INTERNET_ACCESS |
CSV | 2023-10-26 View Change |
Ionix | SECURITY | IONIX |
JSON | 2023-09-28 View Change |
Ubiquiti UniFi Switch | Switch | UBIQUITI_SWITCH |
SYSLOG | 2023-11-21 View Change |
Linux Auditing System (AuditD) | OS | AUDITD |
SYSLOG | 2023-11-27 View Change |
Cisco Firewall Services Module | Firewall | CISCO_FWSM |
SYSLOG | 2023-05-05 View Change |
AWS VPC Flow | AWS Specific | AWS_VPC_FLOW |
SYSLOG | 2023-04-06 View Change |
F5 DNS | DNS | F5_DNS |
SYSLOG | 2021-06-17 |
Kea DHCP | DHCP | KEA_DHCP |
SYSLOG | 2022-03-22 View Change |
CrowdStrike Falcon Stream | Alerts | CS_STREAM |
KV (LEEF) | 2022-07-18 View Change |
RSA NetWitness | PLATFORM CONFIGURATION | RSA_NETWITNESS |
SYSLOG | 2022-10-18 View Change |
Proofpoint On Demand | Email Server | PROOFPOINT_ON_DEMAND |
JSON | 2023-11-13 View Change |
Cisco Stealthwatch | Log Aggregator | CISCO_STEALTHWATCH |
JSON | 2023-06-19 View Change |
WatchGuard | Syslog and KV | WATCHGUARD |
JSON | 2023-11-27 View Change |
OSSEC | IDS/IPS | OSSEC |
SYSLOG | 2023-11-29 View Change |
Box | Collaboration | BOX |
JSON | 2022-09-16 View Change |
Compute Engine | Google Cloud Specific | GCP_COMPUTE |
JSON | 2023-02-24 View Change |
McAfee MVISION CASB | CLOUD SECURITY | MCAFEE_MVISION_CASB |
KV | 2023-06-22 View Change |
Onfido | Authentication | ONFIDO |
SYSLOG + JSON | 2023-03-10 View Change |
OpenSSH | Logging and Troubleshooting | OPENSSH |
SYSLOG | 2023-10-05 View Change |
PAN Autofocus | IOC | PAN_IOC |
JSON | 2021-08-09 |
Strong Swan VPN | VPN | STRONGSWAN_VPN |
JSON | 2023-05-25 View Change |
Azure VPN | VPN | AZURE_VPN |
JSON | 2023-03-07 View Change |
Recorded Future | IOC | RECORDED_FUTURE_IOC |
JSON | 2021-11-17 |
Department of Homeland Security | Threat detection | DHS_IOC |
XML | 2023-07-31 View Change |
Nucleus Unified Vulnerability Management | Nucleus Specific | NUCLEUS_VULNERABILITY |
JSON | 2021-06-30 |
McAfee Enterprise Security Manager | Log Aggregator | MCAFEE_ESM |
SYSLOG + JSON | 2022-02-25 |
Duo Auth | Authentication | DUO_AUTH |
JSON | 2023-10-23 View Change |
AWS CloudWatch | Cloud service monitoring | AWS_CLOUDWATCH |
JSON, GROK | 2023-09-02 View Change |
Windows Defender ATP | AV / Endpoint | WINDOWS_DEFENDER_ATP |
SYSLOG + JSON, XML, JSON | 2023-11-25 View Change |
Bitwarden Events | Password Manager | BITWARDEN_EVENTS |
JSON | 2023-11-09 View Change |
Dell Switch | Switches, Routers | DELL_SWITCH |
SYSLOG | 2023-11-02 View Change |
Pulse Secure Virtual Traffic Manager | Traffic Shapers | PULSE_SECURE_VTM |
SYSLOG | 2023-11-03 View Change |
IBM DataPower Gateway | API Gateway | IBM_DATAPOWER |
JSON, SYSLOG | 2023-11-09 View Change |
VPC Flow Logs | Google Cloud Specific | GCP_VPC_FLOW |
JSON | 2023-05-23 View Change |
Zscaler Private Access | Security Service Edge | ZSCALER_ZPA |
SYSLOG + JSON, JSON | 2023-02-22 View Change |
Chrome Management | Browser | N/A |
JSON | 2023-11-29 View Change |
Cloudflare WAF | Cloud Log | CLOUDFLARE_WAF |
JSON | 2023-08-30 View Change |
Netscout | NETWORK | ARBOR_EDGE_DEFENSE |
SYSLOG + KV | 2023-02-21 View Change |
Cisco Umbrella DNS | DNS | UMBRELLA_DNS |
CSV, JSON | 2023-11-07 View Change |
Red Hat Directory Server LDAP | Identity and Access Management | REDHAT_DIRECTORY_SERVER |
JSON + SYSLOG + KV | 2022-04-11 View Change |
Workspace Alerts | Google Cloud Specific | WORKSPACE_ALERTS |
JSON | 2023-11-29 View Change |
SonicWall | Firewall | SONIC_FIREWALL |
SYSLOG + KV | 2023-05-26 View Change |
Fluentd Logs | Log Aggregator | FLUENTD |
SYSLOG + JSON | 2023-11-29 View Change |
Thinkst Canary | Deception Software | THINKST_CANARY |
JSON | 2023-09-15 View Change |
Microsoft Intune | Mobile Device Management | AZURE_MDM_INTUNE |
JSON | 2022-08-17 View Change |
IBM z/OS | OS | IBM_ZOS |
LEEF | 2023-07-25 View Change |
Evision FircoSoft | Infrastructure | EVISION_FIRCOSOFT |
SYSLOG | 2023-11-22 View Change |
Menlo Security | Web Proxy | MENLO_SECURITY |
JSON | 2023-08-03 View Change |
Microsoft Defender for Identity | EDR | MICROSOFT_DEFENDER_IDENTITY |
JSON | 2022-07-27 View Change |
SentinelOne EDR | EDR | SENTINEL_EDR |
SYSLOG + JSON | 2023-11-09 View Change |
Suricata EVE | IPS IDS | SURICATA_EVE |
JSON | 2022-08-17 View Change |
Workspace Groups | Google Cloud Specific | WORKSPACE_GROUPS |
JSON | 2023-11-29 View Change |
Cloud Identity Device Users | Google Cloud Specific | GCP_CLOUDIDENTITY_DEVICEUSERS |
JSON | 2022-10-01 View Change |
Tanium Asset | Tanium Specific | TANIUM_ASSET |
JSON, SYSLOG + KV | 2022-09-26 View Change |
Varonis | Data Security / Insider Threat | VARONIS |
SYSLOG + KV (CEF), LEEF | 2022-10-08 View Change |
JAMF CMDB | Computer Inventory | JAMF |
JSON | 2023-04-27 View Change |
Workspace Activities | Google Cloud Specific | WORKSPACE_ACTIVITY |
JSON | 2023-11-29 View Change |
Imperva Database | Cloud Application and Edge Security | IMPERVA_DB |
SYSLOG | 2023-07-17 View Change |
Clearswift | Information Security | CLEARSWIFT |
SYSLOG | 2023-11-22 View Change |
Sourcefire | IDS/IPS | SOURCEFIRE_IDS |
JSON, CEF | 2023-07-06 View Change |
Chronicle SOAR Audit | SOAR | CHRONICLE_SOAR_AUDIT |
JSON | 2023-10-12 View Change |
Pivotal | PaaS Application | PIVOTAL |
SYSLOG + KV | 2022-08-17 View Change |
Tanium Threat Response | Tanium Specific | TANIUM_THREAT_RESPONSE |
JSON | 2023-07-28 View Change |
OpenVPN | Network | OPEN_VPN |
SYSLOG + KV + JSON | 2023-11-27 View Change |
OneLogin | SSO | ONELOGIN_SSO |
JSON | 2023-04-28 View Change |
Cloud DNS | Google Cloud Specific | N/A |
JSON | 2023-05-12 View Change |
Cisco WLC/WCS | Wireless | CISCO_WIRELESS |
SYSLOG | 2023-02-09 View Change |
AWS Config | AWS Specific | AWS_CONFIG |
JSON | 2022-05-27 View Change |
Cylance Protect | Alerts | CYLANCE_PROTECT |
SYSLOG + KV | 2022-09-06 View Change |
Akamai Cloud Monitor | Load Balancer, Traffic Shaper, ADC | AKAMAI_CLOUD_MONITOR |
JSON | 2023-09-16 View Change |
Desynova Contido | Switches | DESYNOVA_CONTIDO |
SYSLOG + JSON | 2023-09-19 View Change |
Custom DNS | DNS | CUSTOM_DNS |
JSON | 2022-08-05 View Change |
IBM Security Verify SaaS | SaaS Application | IBM_SECURITY_VERIFY_SAAS |
JSON | 2023-10-27 View Change |
Hashicorp Vault | Privileged Account Activity | HASHICORP |
JSON, SYSLOG, SYSLOG+JSON, SYSLOG+KV | 2023-10-26 View Change |
Versa Firewall | FIREWALL | VERSA_FIREWALL |
SYSLOG + KV | 2023-07-03 View Change |
Ipswitch SFTP | Data Transfer | IPSWITCH_SFTP |
SYSLOG, JSON | 2022-09-05 View Change |
Honeyd | Deception Software | HONEYD |
SYSLOG | 2021-04-05 |
Workday | SaaS Application | WORKDAY |
JSON | 2022-09-15 View Change |
ExtraHop RevealX | Firewall IDS/IPS | EXTRAHOP |
JSON, SYSLOG | 2023-10-27 View Change |
Cisco Switch | Switches, Routers | CISCO_SWITCH |
SYSLOG | 2023-11-05 View Change |
Arcsight CEF | Security log | ARCSIGHT_CEF |
CEF Syslog | 2023-04-27 View Change |
ZScaler DNS | DNS | ZSCALER_DNS |
SYSLOG + KV, JSON | 2023-10-17 View Change |
AIX system | OS | AIX_SYSTEM |
SYSLOG | 2023-06-21 View Change |
Cisco Internetwork Operating System | Network Infrastructure | CISCO_IOS |
SYSLOG | 2023-10-04 View Change |
Oracle | DATABASE | ORACLE_DB |
SYSLOG + KV | 2023-10-25 View Change |
Men and Mice DNS | DNS | MENANDMICE_DNS |
SYSLOG | 2021-11-12 |
Microsoft AD | LDAP | WINDOWS_AD |
JSON | 2023-08-09 View Change |
Azion | Firewall | AZION |
JSON | 2023-09-30 View Change |
WordPress | Configuration Management | WORDPRESS_CMS |
JSON | 2023-05-25 View Change |
Solarwinds Kiwi Syslog Server | Security Log | SOLARWINDS_KSS |
SYSLOG + KV | 2022-11-16 View Change |
Juniper MX Router | Routers and Switches | JUNIPER_MX |
SYSLOG + KV | 2023-11-26 View Change |
LimaCharlie | EDR | LIMACHARLIE_EDR |
JSON | 2023-08-07 |
ExtraHop DNS | DNS | EXTRAHOP_DNS |
JSON | 2021-12-13 |
Open Cybersecurity Schema Framework (OCSF) | Schema | OCSF |
JSON | 2023-10-30 View Change |
Azure DevOps Audit | Automation and DevOps Tools | AZURE_DEVOPS |
JSON | 2023-11-23 View Change |
Workspace Users | Google Cloud Specific | WORKSPACE_USERS |
JSON | 2023-11-29 View Change |
Cisco UCM | Communication Manager | CISCO_UCM |
SYSLOG + KV | 2022-08-18 View Change |
Digital Shadows SearchLight | Threat Intelligence | DIGITAL_SHADOWS_SEARCHLIGHT |
JSON | 2022-05-02 |
FireEye NX | NDR | FIREEYE_NX |
JSON | 2022-05-18 View Change |
CyberArk Endpoint Privilege Manager (EPM) | EPM | CYBERARK_EPM |
JSON | 2023-08-22 View Change |
Zscaler | Web Proxy | ZSCALER_WEBPROXY |
SYSLOG + KV, CSV | 2023-11-20 View Change |
Linux Sysmon | DNS | LINUX_SYSMON |
XML | 2023-11-09 View Change |
Fidelis Network | NDR | FIDELIS_NETWORK |
SYSLOG + KV, JSON | 2023-09-04 View Change |
iBoss Proxy | Webproxy | IBOSS_WEBPROXY |
SYSLOG + JSON | 2023-08-22 View Change |
Microsoft Azure Activity | Misc Windows Specific | AZURE_ACTIVITY |
JSON | 2023-10-09 View Change |
Preempt Alert | Identity and Access Management | PREEMPT |
SYSLOG + KV (CEF) | 2022-06-22 View Change |
ManageEngine AD360 | Identity and Access Management | MANAGE_ENGINE_AD360 |
SYSLOG + KV | 2022-09-16 View Change |
Fortinet FortiAnalyzer | Fortinet FortiAnalyzer | FORTINET_FORTIANALYZER |
JSON | 2023-07-19 View Change |
Zix Email Encryption | Email Server | ZIX_EMAIL_ENCRYPTION |
SYSLOG | 2022-11-05 View Change |
Unbound DNS | DNS | UNBOUND_DNS |
SYSLOG | 2020-06-09 |
Brocade ServerIron ADX | Load Balancer | BROCADE_SERVERIRON |
SYSLOG | 2022-01-13 |
Cloud Data Loss Prevention | Google Cloud Specific | N/A |
JSON | 2022-12-19 View Change |
Zeek TSV | Format Specific | BRO_TSV |
SYSLOG + TSV | 2022-01-31 |
Accellion | DLP | ACCELLION |
SYSLOG | 2022-09-30 View Change |
Mobileiron | ENDPOINT MANAGEMENT | MOBILEIRON |
JSON | 2023-02-02 View Change |
BeyondTrust Secure Remote Access | Remote Access Tools | BEYONDTRUST_REMOTE_ACCESS |
SYSLOG + KV | 2022-09-30 View Change |
DMP | Physical Security | DMP_ENTRE |
SYSLOG | 2020-09-23 |
Acalvio | Deception Software | ACALVIO |
SYSLOG + KV | 2020-10-13 |
GCP_KUBERNETES_CONTEXT | Computer Inventory | GCP_KUBERNETES_CONTEXT |
JSON | 2023-11-01 View Change |
Citrix Storefront | Remote Access Tools | CITRIX_STOREFRONT |
JSON | 2022-07-22 View Change |
Stealthbits PAM | Privileged Access Management Solution | STEALTHBITS_PAM |
CEF + KV | 2023-11-07 View Change |
Juniper IPS | IDS/IPS | JUNIPER_IPS |
SYSLOG + KV | 2022-05-26 View Change |
Open LDAP | LDAP | OPENLDAP |
SYSLOG | 2023-07-18 View Change |
IBM WebSEAL | Web server | IBM_WEBSEAL |
JSON, SYSLOG | 2023-11-17 View Change |
Infoblox DHCP | DHCP | INFOBLOX_DHCP |
SYSLOG | 2023-04-26 View Change |
Vectra Detect | NDR | VECTRA_DETECT |
SYSLOG + JSON + CEF | 2023-10-12 View Change |
Qualys Continuous Monitoring | Monitoring | QUALYS_CONTINUOUS_MONITORING |
JSON | 2022-08-30 View Change |
TrendMicro Web Proxy | Web Proxy | TRENDMICRO_WEBPROXY |
SYSLOG + KV | 2023-08-02 View Change |
Automation Anywhere | Automation Tools | AUTOMATION_ANYWHERE |
SYSLOG + KV | 2021-04-28 |
Juniper | Firewall | JUNIPER_FIREWALL |
SYSLOG + KV | 2023-11-02 View Change |
Aqua Security | IaaS Applications | AQUA_SECURITY |
JSON | 2022-02-03 |
Stormshield Firewall | FIREWALL | STORMSHIELD_FIREWALL |
SYSLOG + KV | 2023-06-29 View Change |
Seqrite Endpoint Security (EPS) | AV and endpoint logs | SEQRITE_ENDPOINT |
LEEF | 2023-03-24 View Change |
Palo Alto Cortex XDR Alerts | NDR | CORTEX_XDR |
JSON | 2023-11-10 View Change |
pfSense | FIREWALL | PFSENSE |
SYSLOG | 2023-05-05 View Change |
Tripwire | DLP | TRIPWIRE_FIM |
SYSLOG | 2023-06-21 View Change |
ClamAV | AV / Endpoint | CLAM_AV |
JSON | 2022-02-07 |
Quest Active Directory | Authentication log | QUEST_AD |
CEF SYSLOG | 2022-01-31 |
Zoom Operation Logs | Operation-Specific | ZOOM_OPERATION_LOGS |
SYSLOG | 2022-11-04 View Change |
Imperva | WAF | IMPERVA_WAF |
SYSLOG+KV, JSON | 2023-10-16 View Change |
Carbon Black | EDR | CB_EDR |
JSON | 2023-10-26 View Change |
Elastic Packet Beats | Log Aggregator | ELASTIC_PACKETBEATS |
SYSLOG + JSON | 2022-05-09 View Change |
Palo Alto Networks Firewall | Firewall | PAN_FIREWALL |
CSV + CEF + LEEF | 2023-11-29 View Change |
Symantec Endpoint Protection | AV / Endpoint | SEP |
SYSLOG | 2023-11-28 View Change |
RH-ISAC | IOC | RH_ISAC_IOC |
JSON | 2023-11-21 View Change |
Avaya Aura Experience Portal | Avaya Aura Experience Portal | AVAYA_AURA |
SYSLOG | 2022-12-30 View Change |
HP Procurve Switch | Switches | HP_PROCURVE |
SYSLOG | 2023-09-24 View Change |
Snort | IDS/IPS | SNORT_IDS |
SYSLOG + JSON | 2022-09-22 View Change |
Dataminr Alerts | DATAMINR_ALERT |
2023-08-23 View Change |
||
Cisco DHCP | DHCP | CISCO_DHCP |
SYSLOG + CSV | 2022-02-07 |
NXLog Manager | Log Aggregator | NXLOG_MANAGER |
SYSLOG | 2022-01-13 |
Barracuda Firewall | Firewall | BARRACUDA_FIREWALL |
SYSLOG | 2022-07-08 View Change |
Elastic Windows Event Log Beats | Log Aggregator | ELASTIC_WINLOGBEAT |
SYSLOG + JSON | 2023-11-28 View Change |
Tanium Discover | Tanium Specific | TANIUM_DISCOVER |
JSON | 2022-11-24 View Change |
F5 Advanced Firewall Management | Firewall | F5_AFM |
SYSLOG + CSV | 2023-09-11 View Change |
IBM Security Verify | Endpoint Security | IBM_SECURITY_VERIFY |
SYSLOG | 2023-01-25 View Change |
Samba SMBD | Privileged Account Activity | SMBD |
Syslog | 2023-03-09 View Change |
Fortinet FortiNAC | NAC | FORTINET_FORTINAC |
SYSLOG | 2022-07-08 View Change |
Symantec VIP Gateway | Email Server | SYMANTEC_VIP |
SYSLOG | 2023-03-03 View Change |
Azure AD Directory Audit | Audit | AZURE_AD_AUDIT |
JSON | 2023-11-23 View Change |
Sophos UTM | Unified Threat Management | SOPHOS_UTM |
KV | 2022-06-30 View Change |
SentinelOne Deep Visibility | EDR | SENTINEL_DV |
JSON | 2023-09-06 View Change |
Kubernetes Auth Proxy | Kubernetes Specific | KUBERNETES_AUTH_PROXY |
JSON | 2022-09-08 View Change |
DigitalArts i-Filter | Web Proxy | DIGITALARTS_IFILTER |
SYSLOG | 2023-04-17 View Change |
Ansible AWX | Automation and DevOps Tools | ANSIBLE_AWX |
JSON | 2022-11-09 View Change |
Emerging Threats Pro | IOC | ET_PRO_IOC |
CSV | 2022-11-28 View Change |
Gitlab | SAAS | GITLAB |
JSON | 2023-10-20 View Change |
ForgeRock OpenAM | Identity and Access Management | OPENAM |
CSV, SYSLOG + KV | 2023-05-19 View Change |
Proofpoint Observeit | Email Server | OBSERVEIT |
JSON, KV | 2023-11-03 View Change |
Pulse Secure | VPN | PULSE_SECURE_VPN |
SYSLOG | 2023-11-07 View Change |
McAfee DLP | DLP | MCAFEE_DLP |
CSV | 2022-04-13 View Change |
Barracuda WAF | Firewall | BARRACUDA_WAF |
JSON, SYSLOG + KV | 2023-07-19 View Change |
Cisco Web Services Manager | CISCO_WSM | CISCO_WSM |
SYSLOG | 2023-10-05 View Change |
CloudM | Identity and Access Management | CLOUDM |
JSON | 2022-06-09 View Change |
Aruba Airwave | Wireless | ARUBA_AIRWAVE |
XML | 2021-03-16 |
CrowdStrike Falcon | EDR | CS_EDR |
JSON | 2023-11-23 View Change |
Cisco Prime | Network Management and Optimization | CISCO_PRIME |
SYSLOG | 2021-05-21 |
JumpCloud Directory Insights | CLOUD | JUMPCLOUD_DIRECTORY_INSIGHTS |
JSON | 2023-11-21 View Change |
Qualys Asset Context | Vulnerability Scanner | QUALYS_ASSET_CONTEXT |
JSON | 2023-08-01 View Change |
Vectra Stream | NDR | VECTRA_STREAM |
SYSLOG + KV | 2023-10-15 View Change |
Proofpoint Threat Response | Email Server | PROOFPOINT_TRAP |
SYSLOG | 2023-05-26 View Change |
Imperva Advanced Bot Protection | Bot Protection | IMPERVA_ABP |
JSON | 2023-07-21 View Change |
Illumio Core | Policy Management | ILLUMIO_CORE |
JSON | 2023-03-14 View Change |
Microsoft Sentinel | Microsoft Sentinel | MICROSOFT_SENTINEL |
JSON | 2023-11-03 View Change |
Cisco Meraki | Wireless | CISCO_MERAKI |
SYSLOG, JSON | 2023-10-09 View Change |
CSV Custom IOC | IOC | CSV_CUSTOM_IOC |
CSV | 2023-09-11 View Change |
Azure AD | LDAP | AZURE_AD |
JSON | 2023-11-20 View Change |
Cisco Umbrella Cloud Firewall | Firewall | UMBRELLA_FIREWALL |
CSV | 2022-09-02 View Change |
Layer7 SiteMinder | SSO | SITEMINDER_SSO |
KV+JSON | 2022-08-30 View Change |
Mongo Database | DATABASE | MONGO_DB |
JSON | 2023-05-26 View Change |
Netscout OCI | Alert log | NETSCOUT_OCI |
SYSLOG + KV | 2023-09-04 View Change |
ForgeRock OpenDJ | LDAP | OPENDJ |
SYSLOG + KV | 2020-10-01 |
AMD Pensando DSS Firewall | Firewall | AMD_DSS_FIREWALL |
SYSLOG + CSV | 2023-05-08 View Change |
AWS Security Hub | IDS/IPS | AWS_SECURITY_HUB |
JSON | 2023-06-20 View Change |
Cisco Umbrella Audit | Firewall and Security Management | CISCO_UMBRELLA_AUDIT |
CSV | 2023-02-28 View Change |
Nokia VitalQIP | DDI (DNS, DHCP, IPAM) | VITALQIP |
SYSLOG | 2022-03-01 |
Cloud Passage | SaaS Application | CLOUD_PASSAGE |
JSON | 2022-06-30 View Change |
Cisco PIX Firewall | Firewall | CISCO_PIX_FIREWALL |
SYSLOG | 2023-05-23 View Change |
EfficientIP DDI | Network | EFFICIENTIP_DDI |
SYSLOG + KV | 2022-01-24 |
Semperis DSP | LDAP | SEMPERIS_DSP |
SYSLOG | 2021-04-29 |
Nyansa Events | IoT | NYANSA_EVENTS |
SYSLOG + KV | 2023-03-01 View Change |
Kubernetes Node | Kubernetes Container | KUBERNETES_NODE |
JSON | 2023-11-29 View Change |
Okera Dynamic Access Platform | Data Security | OKERA_DAP |
JSON | 2023-01-29 View Change |
Cloud Intrusion Detection System | Google Cloud Specific | GCP_IDS |
JSON | 2023-09-26 View Change |
Lenel Onguard Badge Management | Access Control System | LENEL_ONGUARD |
JSON | 2022-10-31 View Change |
Tanium Audit | SCAN NETWORK | TANIUM_AUDIT |
JSON | 2023-09-26 View Change |
Cloud Load Balancing | Google Cloud Specific | GCP_LOADBALANCING |
JSON | 2023-11-29 View Change |
Hitachi Cloud Platform | Hitachi Cloud Platform | HITACHI_CLOUD_PLATFORM |
SYSLOG | 2023-05-30 View Change |
Trend Micro AV | AV / Endpoint | TRENDMICRO_AV |
SYSLOG + KV, CEF | 2023-05-21 View Change |
Uptycs EDR | Endpoint detection and response | UPTYCS_EDR |
JSON | 2022-07-08 View Change |
Sendmail | Email Server | SENDMAIL |
SYSLOG + KV | 2023-09-20 View Change |
Openpath | AV / Endpoint | OPENPATH |
SYSLOG | 2023-11-08 View Change |
Palo Alto Panorama | Firewall | PAN_PANORAMA |
CSV | 2023-08-07 View Change |
ESET AV | ESET_AV | ESET_AV |
SYSLOG + JSON | 2023-01-10 View Change |
Cisco CTS | Telephone Software | CISCO_CTS |
SYSLOG + KV | 2021-05-20 |
VMware vRealize Suite | Cloud | VMWARE_VREALIZE |
SYSLOG | 2023-06-20 View Change |
AWS Aurora | AWS | AWS_AURORA |
JSON | 2023-11-02 View Change |
Stealthbits Audit | File system monitoring | STEALTHBITS_AUDIT |
JSON | 2021-11-09 |
Okta Access Gateway | OKTA specific | OKTA_ACCESS_GATEWAY |
SYSLOG + KV | 2023-02-20 View Change |
ThreatConnect | IOC | THREATCONNECT_IOC |
JSON | 2022-01-13 |
AWS EMR | AWS Specific | AWS_EMR |
SYSLOG, SYSLOG+JSON, JSON | 2023-10-30 View Change |
VMware AirWatch | Wireless | AIRWATCH |
SYSLOG + KV | 2023-09-05 View Change |
Bitdefender | AV / Endpoint | BITDEFENDER |
CSV | 2023-05-02 View Change |
Cyberark Privilege Cloud | Identity & Access Management | CYBERARK_PRIVILEGE_CLOUD |
SYSLOG + KV | 2023-11-24 View Change |
VMware Horizon | VDI | VMWARE_HORIZON |
SYSLOG | 2022-08-15 View Change |
Wazuh | Log Aggregator | WAZUH |
SYSLOG + JSON | 2023-07-17 View Change |
AWS Route 53 DNS | AWS Specific | AWS_ROUTE_53 |
JSON + SYSLOG | 2023-05-08 View Change |
Nokia Router | Switches and Routers | NOKIA_ROUTER |
SYSLOG + KV | 2023-11-27 View Change |
Akamai Enterprise Application Access | Enterprise Application Access | AKAMAI_EAA |
JSON | 2023-11-14 View Change |
Jenkins | Automation and DevOps | JENKINS |
JSON, SYSLOG | 2023-11-27 View Change |
Blue Coat Proxy | Web Proxy | BLUECOAT_WEBPROXY |
SYSLOG + JSON, SYSLOG + KV | 2023-11-27 View Change |
Digi modems | Switches and Routers | DIGI_MODEMS |
SYSLOG | 2023-06-26 View Change |
Cisco FireSIGHT Management Center | SaaS Application | CISCO_FIRESIGHT |
KV | 2023-09-21 View Change |
ManageEngine ADAudit Plus | Active Directory Audit | ADAUDIT_PLUS |
SYSLOG + KV (CEF) | 2023-10-17 View Change |
Datadog | NDR | DATADOG |
JSON | 2023-07-21 View Change |
Oracle Cloud Infrastructure VCN Flow Logs | Oracle Cloud Infrastructure | OCI_FLOW |
JSON | 2023-04-29 View Change |
Palo Alto Prisma Cloud | SECURITY PLATFORM | PAN_PRISMA_CLOUD |
JSON | 2022-08-09 View Change |
CA LDAP | Web server | CA_LDAP |
JSON | 2022-08-19 View Change |
Qualys Scan | Vulnerability scanner | QUALYS_SCAN |
JSON | 2023-04-21 View Change |
Microsoft Exchange | Email Server | EXCHANGE_MAIL |
SYSLOG | 2023-11-20 View Change |
Trustwave SEC MailMarshal | Email server | MAILMARSHAL |
SYSLOG | 2023-04-06 View Change |
SecureLink | Remote Access Tools | SECURELINK |
SYSLOG | 2023-09-13 View Change |
Trend Micro Deep Security | AV / Endpoint | TRENDMICRO_DEEP_SECURITY |
LEEF | 2022-09-01 View Change |
ProofPoint Secure Email Relay | Email server | PROOFPOINT_SER |
JSON | 2023-08-29 View Change |
Bluecat Edge DNS Resolver | DNS | BLUECAT_EDGE |
JSON, KV, SYSLOG | 2022-01-18 |
Kiteworks | Network | KITEWORKS |
SYSLOG, CSV | 2023-11-10 View Change |
Microsoft Powershell | Misc. Windows-specific | POWERSHELL |
SYSLOG + JSON | 2023-09-14 View Change |
Apache Cassandra | Web server | CASSANDRA |
JSON | 2022-04-13 View Change |
CommVault | Alert System | COMMVAULT |
KV , SYSLOG | 2023-11-10 View Change |
Imperva SecureSphere Management | Data Security / Insider Threat | IMPERVA_SECURESPHERE |
SYSLOG + KV (CEF) | 2023-04-26 View Change |
Infoblox | DHCP, DNS | INFOBLOX |
SYSLOG | 2023-11-07 View Change |
FireEye HX Audit | Audits | FIREEYE_HX_AUDIT |
XML | 2022-11-04 View Change |
HPE ILO | Server Management | HPE_ILO |
SYSLOG | 2023-11-27 View Change |
Linux DHCP | DHCP | LINUX_DHCP |
SYSLOG | 2023-11-10 View Change |
McAfee Skyhigh CASB | CASB | MCAFEE_SKYHIGH_CASB |
SYSLOG + KV | 2023-06-17 View Change |
Thycotic | Identity and Access Management | THYCOTIC |
SYSLOG + KV (CEF) | 2023-09-22 View Change |
IBM CICS | Service Bus | IBM_CICS |
LEEF | 2021-10-27 |
McAfee Unified Cloud Edge | SaaS Application | MCAFEE_UCE |
JSON | 2021-07-20 |
Barracuda Email | Email Server | BARRACUDA_EMAIL |
JSON | 2023-01-19 View Change |
IBM AS/400 | Application System | IBM_AS400 |
SYSLOG + KV | 2022-04-13 View Change |
Cisco VCS Expressway | Telephone software | CISCO_VCS |
SYSLOG | 2023-06-12 View Change |
Mandiant Custom IOC | IOC | MANDIANT_CUSTOM_IOC |
JSON | 2023-11-17 View Change |
Ordr IoT | IoT | ORDR_IOT |
SYSLOG + JSON | 2022-08-19 View Change |
Skybox Firewall Assurance | Firewall | SKYBOX_FIREWALL_ASSURANCE |
SYSLOG + KV | 2023-09-07 View Change |
Snyk Group level audit Logs | Vulnerability Scanners | SNYK_SDLC |
JSON | 2023-04-25 View Change |
macOS Endpoint Security | AV and endpoint logs | MACOS_ENDPOINT_SECURITY |
SYSLOG + KV | 2023-07-17 View Change |
Microsoft Azure NSG Flow | Network Flow | AZURE_NSG_FLOW |
JSON | 2022-04-18 View Change |
ManageEngine Reporter Plus | SaaS Application | MANAGE_ENGINE_REPORTER_PLUS |
JSON | 2022-08-29 View Change |
Tanium Patch | Tanium Specific | TANIUM_PATCH |
JSON | 2022-02-08 |
Ruckus Networks | Wireless | RUCKUS_WIRELESS |
SYSLOG + KV | 2023-01-06 View Change |
Office 365 Message Trace | OFFICE_365 Specific | OFFICE_365_MESSAGETRACE |
JSON | 2023-05-10 View Change |
Okta | Identity and Access Management | OKTA |
JSON | 2023-06-28 View Change |
Sophos Central | AV / Endpoint | SOPHOS_CENTRAL |
JSON | 2022-12-27 View Change |
Apigee | Google Cloud Specific | GCP_APIGEE |
JSON | 2021-11-02 |
Ipswitch MOVEit Transfer | Switches | IPSWITCH_MOVEIT_TRANSFER |
SYSLOG + CSV | 2023-08-18 View Change |
Microsoft Azure Resource | Log Aggregator | AZURE_RESOURCE_LOGS |
JSON | 2023-10-04 View Change |
Duo User Context | Identity and Access Management | DUO_USER_CONTEXT |
JSON | 2021-04-12 |
Centripetal Networks IOC | IOC | CENTRIPETAL_IOC |
SYSLOG + KV | 2022-01-06 |
Oracle Unified Directory | ORACLE OUD | ORACLE_OUD |
SYSLOG | 2023-09-11 View Change |
Windows DHCP | DHCP | WINDOWS_DHCP |
JSON, SYSLOG, CSV | 2023-11-29 View Change |
SiteMinder Web Access Management | SSO | CA_SSO_WEB |
JSON | 2022-08-08 View Change |
Deep Instinct EDR | EDR | DEEP_INSTINCT_EDR |
SYSLOG + KV | 2022-11-18 View Change |
HCL BigFix | Network Management and Optimization | HCL_BIGFIX |
JSON | 2022-08-30 View Change |
Check Point | Firewall | CHECKPOINT_FIREWALL |
SYSLOG + KV, JSON | 2023-10-11 View Change |
Lacework Cloud Security | Cloud Security | LACEWORK |
JSON | 2023-11-09 View Change |
Symantec DLP | DLP | SYMANTEC_DLP |
SYSLOG + KV (CEF), XML | 2023-09-02 View Change |
Armis Activities | ACTIVITIES | ARMIS_ACTIVITIES |
JSON | 2023-02-07 View Change |
Tenable Active Directory Security | Tenable Active Directory Security | TENABLE_ADS |
SYSLOG | 2023-11-06 View Change |
Workspace Mobile Devices | Google Cloud Specific | WORKSPACE_MOBILE |
JSON | 2023-11-29 View Change |
IBM Safenet | IT infrastructure | IBM_SAFENET |
SYSLOG | 2023-05-24 View Change |
Microsoft ATA | IDS/IPS | MICROSOFT_ATA |
SYSLOG + KV | 2021-07-13 |
ESET Threat Intelligence | IOC | ESET_IOC |
JSON | 2023-10-05 View Change |
NGINX | Server Management | NGINX |
JSON + SYSLOG | 2022-09-10 View Change |
Thales Vormetric | Encryption | VORMETRIC |
SYSLOG | 2021-12-17 |
Windows Defender AV | AV / Endpoint | WINDOWS_DEFENDER_AV |
JSON, XML | 2023-09-04 View Change |
Rapid7 Insight | Vulnerability Scanner | RAPID7_INSIGHT |
SYSLOG, JSON | 2023-05-05 View Change |
Forescout NAC | NAC | FORESCOUT_NAC |
SYSLOG, CEF | 2023-05-31 View Change |
Fortinet | DHCP | FORTINET_DHCP |
KV | 2022-11-21 View Change |
Armis Vulnerabilities | VULNERABILITIES | ARMIS_VULNERABILITIES |
JSON | 2023-02-07 View Change |
HCNET Account Adapter Plus | DHCP | HCNET_ACCOUNT_ADAPTER |
SYSLOG | 2022-09-15 View Change |
tenable.io | Vulnerability Scanner | TENABLE_IO |
JSON | 2023-01-02 View Change |
AWS Elastic Load Balancer | AWS Specific | AWS_ELB |
SYSLOG | 2022-05-27 View Change |
Azure Cosmos DB | Database | AZURE_COSMOS_DB |
JSON | 2023-02-22 View Change |
Peplink Firewall | Firewall | PEPLINK_FW |
SYSLOG + KV | 2023-08-17 View Change |
Microsoft CASB | CASB | MICROSOFT_CASB |
SYSLOG + KV (CEF) | 2023-11-27 View Change |
NetApp SAN | Rest api | NETAPP_SAN |
SYSLOG | 2023-04-25 View Change |
Auth0 | Authentication log | AUTH_ZERO |
JSON | 2023-06-19 View Change |
Cloudflare | SaaS Application | CLOUDFLARE |
JSON | 2023-11-22 View Change |
1Password | Identity and Access Management | ONEPASSWORD |
JSON | 2023-06-07 View Change |
Crowdstrike IOC | IOC | CROWDSTRIKE_IOC |
JSON | 2023-08-23 View Change |
Aruba | Wireless | ARUBA_WIRELESS |
SYSLOG | 2023-05-25 View Change |
MySQL | Database | MYSQL |
SYSLOG | 2021-04-12 |
Ntopng | NTOPNG |
2023-11-16 View Change |
||
VMware NSX | Network and Security Virtualization | VMWARE_NSX |
KV | 2023-11-15 View Change |
Okta User Context | Identity and Access Management | OKTA_USER_CONTEXT |
JSON | 2023-08-16 View Change |
SAP Netweaver | Database | SAP_NETWEAVER |
JSON | 2023-05-03 View Change |
Fortinet Web Application Firewall | WEB | FORTINET_FORTIWEB |
KV | 2023-05-18 View Change |
Riverbed Steelhead | Network Management and Optimization | STEELHEAD |
JSON | 2022-08-08 View Change |
GMV Checker ATM Security | ATM Audit | GMV_CHECKER |
SYSLOG | 2022-04-20 View Change |
CloudGenix SD-WAN | Switches, Routers | CLOUDGENIX_SDWAN |
SYSLOG + KV | 2022-09-08 View Change |
AppOmni | SAAS Security Application | APPOMNI |
JSON | 2023-08-23 View Change |
NIMBLE OS | OS | NIMBLE_OS |
SYSLOG | 2022-07-21 View Change |
RSA | Identity and Access Management | RSA_AUTH_MANAGER |
CSV | 2022-08-09 View Change |
IBM Guardium | Database DLP | GUARDIUM |
CSV, CEF | 2022-10-06 View Change |
Unifi AP | Switches and Routers | UNIFI_AP |
SYSLOG + KV, SYSLOG + JSON | 2022-05-24 View Change |
Windows Hyper-V | Virtualization Software | WINDOWS_HYPERV |
JSON | 2023-10-09 View Change |
SailPoint IAM | Identity and Access Management | SAILPOINT_IAM |
JSON | 2022-07-08 View Change |
Kubernetes Audit Azure | Log Aggregator | KUBERNETES_AUDIT_AZURE |
JSON | 2023-06-20 View Change |
OSQuery | EDR | OSQUERY_EDR |
SYSLOG + JSON | 2023-11-29 View Change |
Snoopy Logger | Log Aggregator | SNOOPY_LOGGER |
SYSLOG | 2022-08-10 View Change |
Neosec | Security | NEOSEC |
JSON | 2023-07-31 View Change |
Nutanix Prism | Firewall | NUTANIX_PRISM |
JSON | 2023-01-23 View Change |
Thales Digital Identity and Security | Digital Identity & Security | THALES_DIS |
SYSLOG | 2022-03-17 |
Static IP | DHCP | ASSET_STATIC_IP |
CSV | 2023-06-16 View Change |
Airlock Digital Application Allowlisting | Application Whitelisting | AIRLOCK_DIGITAL |
SYSLOG | 2023-02-22 View Change |
Nasuni File Services Platform | Data Transfer | NASUNI_FILE_SERVICES |
SYSLOG + JSON | 2022-08-21 View Change |
Cisco NX-OS | OS | CISCO_NX_OS |
SYSLOG | 2023-08-11 View Change |
Apache | Security | APACHE |
SYSLOG + JSON | 2023-07-31 View Change |
AWS WAF | AWS Specific | AWS_WAF |
JSON | 2023-09-11 View Change |
Juniper Mist | Network Management and Optimization software | JUNIPER_MIST |
JSON | 2023-02-24 View Change |
Imperva CEF | CEF | IMPERVA_CEF |
SYSLOG + KV | 2023-03-07 View Change |
Sophos Capsule8 | Container Security | SOPHOS_CAPSULE8 |
JSON | 2021-12-22 |
FileZilla | File tranfser | FILEZILLA_FTP |
SYSLOG | 2022-03-23 View Change |
Cambium Networks | Switches and Routers Log Type | CAMBIUM_NETWORKS |
SYSLOG | 2023-07-27 View Change |
Cisco CloudLock | CASB | CISCO_CLOUDLOCK_CASB |
JSON | 2021-10-04 |
F5 ASM | WAF | F5_ASM |
SYSLOG | 2023-11-08 View Change |
ZScaler NGFW | Firewall | ZSCALER_FIREWALL |
SYSLOG + KV (CEF), CSV | 2023-09-12 View Change |
Cloud Audit Logs | Google Cloud Specific | N/A |
JSON | 2023-11-29 View Change |
CA Access Control | Access Management | CA_ACCESS_CONTROL |
JSON+SYSLOG, SYSLOG | 2023-07-25 View Change |
Google Cloud Identity Context | Identity and Access Management | CLOUD_IDENTITY_CONTEXT |
JSON | 2023-07-25 View Change |
Juniper Junos | Network Device | JUNIPER_JUNOS |
SYSLOG + KV | 2023-10-25 View Change |
MISP Threat Intelligence | Cybersecurity | MISP_IOC |
JSON, CSV | 2023-09-26 View Change |
Palo Alto Cortex XDR Events | Monitoring and Threat Detection | PAN_CORTEX_XDR_EVENTS |
JSON | 2023-02-01 View Change |
Aruba EdgeConnect SD-WAN | Network Security | ARUBA_EDGECONNECT_SDWAN |
SYSLOG + CSV | 2023-05-03 View Change |
Tanium Integrity Monitor | Tanium Specific | TANIUM_INTEGRITY_MONITOR |
JSON | 2022-10-12 View Change |
Windows Event | Endpoint | WINEVTLOG |
JSON + KV + XML | 2023-11-29 View Change |
GCP_NETWORK_CONNECTIVITY | Computer Inventory | GCP_NETWORK_CONNECTIVITY_CONTEXT |
JSON | 2023-06-13 View Change |
IBM Security Access Manager | WAF | IBM_SAM |
SYSLOG | 2023-09-12 View Change |
Zeek JSON | DNS | BRO_JSON |
JSON | 2023-11-29 View Change |
AWS GuardDuty | IDS/IPS | GUARDDUTY |
JSON | 2023-08-18 View Change |
Kyriba Treasury Management | SaaS Application | KYRIBA |
CSV | 2021-02-24 |
Apple MacOS | AV / Endpoint | MACOS |
SYSLOG | 2022-05-04 View Change |
ESET | EDR | ESET_EDR |
SYSLOG + JSON | 2022-05-10 View Change |
Cloudian hyperstore | Storage Solutions | CLOUDIAN_HYPERSTORE |
SYSLOG | 2021-05-05 |
Kemp Load Balancer | Load Balancer, Traffic Shaper, ADC | KEMP_LOADBALANCER |
SYSLOG + KV | 2023-05-31 View Change |
McAfee IPS | IDS/IPS | MCAFEE_IPS |
SYSLOG | 2021-04-15 |
Kong API Gateway | Microservice management | KONG_GATEWAY |
SYSLOG + JSON | 2022-09-23 View Change |
Proofpoint Tap Alerts | Email Server | PROOFPOINT_MAIL |
JSON | 2023-06-26 View Change |
Cisco Wireless IPS | Cisco Wips | CISCO_WIPS |
SYSLOG + KV | 2023-11-17 View Change |
Citrix Monitor | Monitoring of DaaS | CITRIX_MONITOR |
JSON | 2022-12-06 View Change |
Elastic Search | Log Aggregator | ELASTIC_SEARCH |
JSON | 2023-11-02 View Change |
Symantec CloudSOC CASB | CASB | SYMANTEC_CASB |
SYSLOG + JSON | 2021-12-17 |
Sophos Firewall (Next Gen) | Firewall | SOPHOS_FIREWALL |
KV | 2023-11-20 View Change |
Fortinet FortiClient | Security | FORTINET_FORTICLIENT |
KV | 2023-10-27 View Change |
Slack Audit | Productivity | SLACK_AUDIT |
JSON | 2023-10-27 View Change |
IBM DB2 | Database | DB2_DB |
LEEF | 2023-10-30 View Change |
EPIC Systems | Discovery and Monitoring | EPIC |
LEEF + KV | 2022-10-31 View Change |
Jamf Protect Alerts | Endpoint Security | JAMF_PROTECT |
JSON | 2023-11-22 View Change |
Cato Networks | NDR | CATO_NETWORKS |
JSON | 2023-05-19 View Change |
Cloud SQL Context | Google Cloud Specific | GCP_SQL_CONTEXT |
JSON | 2023-07-26 View Change |
Preempt Auth | Identity and Access Management | PREEMPT_AUTH |
SYSLOG + JSON | 2021-06-16 |
Duo Telephony Logs | Identity and Access Management | DUO_TELEPHONY |
JSON | 2023-08-24 View Change |
Teleport Access Plane | Remote Access | TELEPORT_ACCESS_PLANE |
SYSLOG | 2023-11-17 View Change |
Cisco Firepower NGFW | Firewall | CISCO_FIREPOWER_FIREWALL |
SYSLOG + KV, JSON | 2023-09-12 View Change |
McAfee Web Protection | SaaS Application | MCAFEE_WEB_PROTECTION |
JSON | 2022-09-22 View Change |
NetApp ONTAP | Rest api | NETAPP_ONTAP |
SYSLOG | 2023-04-03 View Change |
AlgoSec Security Management | Policy Management | ALGOSEC |
SYSLOG + KV (CEF) | 2022-11-27 View Change |
Cisco TACACS+ | Authentication | CISCO_TACACS |
SYSLOG + KV | 2022-08-09 View Change |
BMC Helix Discovery | bmc helix discovery | BMC_HELIX_DISCOVERY |
SYSLOG | 2022-08-29 View Change |
Net Suite | WAF | NET_SUITE |
kv | 2023-08-02 View Change |
Cloud Storage Context | Google Cloud Specific | N/A |
JSON | 2023-04-13 View Change |
Microsoft Graph API Alerts | Gateway to data and intelligence | MICROSOFT_GRAPH_ALERT |
JSON | 2023-11-27 View Change |
Proofpoint Web Browser Isolation | ATTACK PROTECTION ISOLATION | PROOFPOINT_WEB_BROWSER_ISOLATION |
JSON | 2023-05-25 View Change |
Forcepoint DLP | Forcepoint DLP | FORCEPOINT_DLP |
CEF | 2022-11-07 View Change |
Azure Application Gateway | GATEWAY | AZURE_GATEWAY |
JSON | 2023-11-16 View Change |
Cisco Application Control Engine | Load Balancer, Traffic Shaper, ADC | CISCO_ACE |
SYSLOG | 2022-09-15 View Change |
F5 BIGIP Access Policy Manager | Access Policy Manager | F5_BIGIP_APM |
SYSLOG | 2023-06-06 View Change |
Oracle Cloud Infrastructure Audit Logs | Oracle Cloud Infrastructure | OCI_AUDIT |
JSON | 2023-09-29 View Change |
Symantec EDR | EDR | SYMANTEC_EDR |
JSON | 2022-03-31 View Change |
AWS Control Tower | Identity and Access Management | AWS_CONTROL_TOWER |
JSON | 2023-01-04 View Change |
FireEye HX | EDR | FIREEYE_HX |
JSON | 2023-05-08 View Change |
Microsoft Defender for Endpoint | EDR | MICROSOFT_DEFENDER_ENDPOINT |
JSON | 2023-10-12 View Change |
Windows Firewall | Firewall | WINDOWS_FIREWALL |
Space Separated Value | 2021-08-26 |
Cisco Umbrella Web Proxy | Web Proxy | UMBRELLA_WEBPROXY |
CSV | 2023-10-17 View Change |
Thales Luna Hardware Security Module | THALES_LUNA_HSM specific | THALES_LUNA_HSM |
JSON/SYSLOG | 2022-12-02 View Change |
Signal Sciences WAF | WAF | SIGNAL_SCIENCES_WAF |
JSON | 2023-11-22 View Change |
AlphaSOC | Alert | ASOC_ALERT |
JSON | 2021-06-21 |
Check Point Sandblast | EDR | CHECKPOINT_EDR |
SYSLOG + KV | 2022-09-07 View Change |
FortiMail Email Security | Email Security | FORTINET_FORTIMAIL |
KV | 2023-09-06 View Change |
Apache Hadoop | open-source software | HADOOP |
SYSLOG + KV | 2023-06-05 View Change |
Datto File Protection | DATTO_FILE_PROTECTION | DATTO_FILE_PROTECTION |
SYSLOG | 2022-08-22 View Change |
Check Point Harmony | Remote Access Tools | CHECKPOINT_HARMONY |
SYSLOG+KV | 2023-11-10 View Change |
Cisco Email Security | Email Server | CISCO_EMAIL_SECURITY |
SYSLOG + KV, JSON | 2023-10-05 View Change |
Citrix Netscaler | Load Balancer, Traffic Shaper, ADC | CITRIX_NETSCALER |
SYSLOG + KV | 2023-11-26 View Change |
Barracuda Web Filter | Webfilter | BARRACUDA_WEBFILTER |
SYSLOG | 2023-07-20 View Change |
COVID-19 Cyber Threat Coalition | IOC | COVID_CTC_IOC |
Value Entry | 2020-06-02 |
Azure AD Organizational Context | LDAP | AZURE_AD_CONTEXT |
JSON | 2023-11-24 View Change |
Cisco ACS | Authentication | CISCO_ACS |
SYSLOG + KV | 2023-09-26 View Change |
Ribbon Analytics Platform | Telephone Software | RIBBON_ANALYTICS_PLATFORM |
SYSLOG | 2022-09-09 View Change |
Cisco Vision Dynamic Signage Director | Content and Delivery Management | CISCO_STADIUMVISION |
SYSLOG, SYSLOG+KV | 2023-05-12 View Change |
HP Aruba(Clearpass) | Identity and Access Management | CLEARPASS |
SYSLOG + KV | 2022-08-18 View Change |
ServiceNow CMDB | Policy Management | SERVICENOW_CMDB |
JSON | 2023-05-31 View Change |
VMware ESXi | Hypervisor | VMWARE_ESX |
SYSLOG | 2023-10-10 View Change |
Cisco ASA | firewall | CISCO_ASA_FIREWALL |
SYSLOG | 2023-11-29 View Change |
Absolute Mobile Device Management | Mobile Device Management | ABSOLUTE |
SYSLOG + KV (CEF) | 2023-07-07 View Change |
Thales MFA | Authentication | THALES_MFA |
SYSLOG + KV (CEF) | 2022-07-13 View Change |
Digital Guardian DLP | DLP | DIGITALGUARDIAN_DLP |
JSON | 2023-06-02 View Change |
DNSFilter | Data Transfer | DNSFILTER |
CSV | 2023-10-27 View Change |
IBM Security QRadar SIEM | Security Log | IBM_QRADAR |
SYSLOG | 2023-05-18 View Change |
Vsftpd | FTP Server | VSFTPD |
GROK | 2023-11-20 View Change |
Cloud IoT | Google Cloud Specific | GCP_CLOUDIOT |
JSON | 2022-06-06 View Change |
Stealthbits Defend | Security System for Active Directory and File Systems. | STEALTHBITS_DEFEND |
SYSLOG + KV (LEEF, CEF) | 2022-11-17 View Change |
Kolide Endpoint Security | Security | KOLIDE |
JSON | 2023-10-25 View Change |
STIX Threat Intelligence | Cybersecurity Threats | STIX |
SYSLOG + KV (CEF) | 2023-11-08 View Change |
AWS S3 Server Access | AWS Specific | AWS_S3_SERVER_ACCESS |
SYSLOG | 2023-07-19 View Change |
Workspace ChromeOS Devices | Google Cloud Specific | WORKSPACE_CHROMEOS |
JSON | 2023-11-29 View Change |
SpyCloud | AV / Endpoint | SPYCLOUD |
SYSLOG + JSON | 2023-11-08 View Change |
Bluecat DDI | DDI (DNS, DHCP, IPAM) | BLUECAT_DDI |
SYSLOG | 2022-11-08 View Change |
Sentinelone Alerts | Endpoint Security | SENTINELONE_ALERT |
JSON | 2023-08-18 View Change |
Windows Event (XML) | AV / Endpoint | WINEVTLOG_XML |
SYSLOG + XML, KV | 2023-11-20 View Change |
Cisco Router | Switches, Routers | CISCO_ROUTER |
SYSLOG | 2023-11-10 View Change |
Cisco VPN | VPN | CISCO_VPN |
SYSLOG | 2022-08-19 View Change |
AWS Network Firewall | Firewall | AWS_NETWORK_FIREWALL |
JSON | 2023-05-05 View Change |
Falco IDS | IDS/IPS | FALCO_IDS |
JSON | 2023-05-23 View Change |
Symantec Event export | SEP | SYMANTEC_EVENT_EXPORT |
JSON, SYSLOG | 2023-11-07 View Change |
Tanium Reveal | Tanium Specific | TANIUM_REVEAL |
JSON | 2021-11-15 |
SecureAuth | SSO | SECUREAUTH_SSO |
SYSLOG, XML | 2023-07-09 View Change |
Imperva FlexProtect | Cloud App & Network Security | IMPERVA_FLEXPROTECT |
CEF + KV | 2023-08-28 View Change |
Shrubbery TACACS+ | NETWORK MANAGEMENT | SHRUBBERY_TACACS |
SYSLOG + KV | 2022-11-08 View Change |
McAfee Web Gateway | Web Proxy | MCAFEE_WEBPROXY |
SYSLOG + KV (CEF), JSON | 2023-06-17 View Change |
Area1 Security | Email server | AREA1 |
JSON | 2023-04-06 View Change |
Dell EMC Isilon NAS | Storage | DELL_EMC_NAS |
SYSLOG | 2023-07-21 View Change |
Sophos AV | AV / Endpoint | SOPHOS_AV |
CSV, JSON | 2022-07-27 View Change |
InterSystems Cache | Database | INTERSYSTEMS_CACHE |
SYSLOG + KV | 2022-10-19 View Change |
Mimecast | Email Server | MIMECAST_MAIL |
KV | 2023-03-31 View Change |
Microsoft IIS | Web Server | IIS |
SYSLOG + KV, JSON | 2023-10-27 View Change |
Tenable Security Center | Vulnerability Scanner | TENABLE_SC |
SYSLOG | 2021-05-18 |
Cisco Application Centric Infrastructure | CISCO ACI | CISCO_ACI |
JSON, SYSLOG | 2022-09-26 View Change |
Carbon Black App Control | Security log | CB_APP_CONTROL |
CEF, JSON | 2022-07-01 View Change |
Akeyless Vault Platform | Akeyless Vault Platform | AKEYLESS_VAULT |
KV + JSON | 2023-09-16 View Change |
Resource Manager Context | Google Cloud Specific | GCP_RESOURCE_MANAGER_CONTEXT |
JSON | 2023-07-26 View Change |
Unix system | OS | NIX_SYSTEM |
SYSLOG , JSON | 2023-11-10 View Change |
Sierra Wireless | IOT Devices | SIERRA_WIRELESS |
SYSLOG | 2023-11-23 View Change |
Juniper Software Defined Wide Area Network | SYSLOG | JUNIPER_SDWAN |
SYSLOG | 2023-07-10 View Change |
Symantec Web Security Service | Web Proxy | SYMANTEC_WSS |
JSON | 2023-06-19 View Change |
Tanium Comply | Tanium Specific | TANIUM_COMPLY |
JSON | 2022-08-18 View Change |
VanDyke SFTP | Data Transfer | VANDYKE_SFTP |
JSON, SYSLOG | 2022-03-25 View Change |
IBM Tivoli | Monitoring | IBM_TIVOLI |
JSON, SYSLOG | 2023-06-12 View Change |
Abnormal Security | Email Server | ABNORMAL_SECURITY |
JSON , SYSLOG | 2023-11-06 View Change |
VMware Tanzu Kubernetes Grid | IDS/IPS | VMWARE_TANZU |
JSON + SYSLOG+JSON | 2023-09-08 View Change |
Cloud Functions Context | Google Cloud Specific | GCP_CLOUD_FUNCTIONS_CONTEXT |
JSON | 2023-07-26 View Change |
Netskope | Cloud Security | NETSKOPE_ALERT |
JSON | 2023-11-10 View Change |
ThreatLocker Platform | THREATLOCKER | THREATLOCKER |
JSON | 2023-06-18 View Change |
Darktrace | NDR | DARKTRACE |
SYSLOG + KV (CEF), SYSLOG + JSON | 2023-11-20 View Change |
Workspace Privileges | Google Cloud Specific | WORKSPACE_PRIVILEGES |
JSON | 2023-11-29 View Change |
VMware vCenter | Server | VMWARE_VCENTER |
SYSLOG + JSON | 2023-11-13 View Change |
Kaspersky AV | AV / Endpoint | KASPERSKY_AV |
KV + CEF | 2023-10-13 View Change |
CIS Albert Alerts | Alerts | CIS_ALBERT_ALERT |
SYSLOG | 2022-10-10 View Change |
Jamf Protect Telemetry | Endpoint Security | JAMF_TELEMETRY |
JSON | 2023-11-29 View Change |
Zimperium | Mobile Device Management | ZIMPERIUM |
SYSLOG + JSON | 2023-08-18 View Change |
Microsoft SQL Server | Database | MICROSOFT_SQL |
SYSLOG + KV, JSON | 2023-10-09 View Change |
Supported log types without a default parser
Chronicle SIEM does not provide a default parser for these log types. You can ingest raw logs from these devices using the Chronicle SIEM Ingestion API or the Chronicle SIEM forwarder. Chronicle SIEM will not normalize the data to structured Unified Data Model format.
You can create a custom parser to normalize these logs. You can also search raw logs.
Vendor / Product | Ingestion label |
---|---|
A10 Load Balancer | A10_LOAD_BALANCER |
Accops Hysecure VPN | ACCOPS_HYSECURE_VPN |
Acquia Cloud Platform | ACQUIA_CLOUD_PLATFORM |
Acronis Backup | ACRONIS |
Microsoft ActiveSync | ACTIVE_SYNC |
ManageEngine ADManager Plus | ADMANAGER_PLUS |
Admin by request PAM | ADMIN_BY_REQUEST |
Adobe Commerce | ADOBE_COMMERCE |
Adobe Experience Manager | ADOBE_EXPERIENCE_MANAGER |
ManageEngine ADSelfService Plus | ADSELFSERVICE_PLUS |
ADTRAN NetVanta router | ADTRAN_NETVANTA |
ADVA Fiber Service Platform | ADVA_FSP |
Agari Phishing Defense | AGARI_PHISHING_DEFENSE |
Advanced Intrusion Detection Environment | AIDE |
Extreme Networks AirDefense | AIRDEFENSE |
Akamai Prolexic | AKAMAI_DDOS |
Akamai DHCP | AKAMAI_DHCP |
Akamai Enterprise Threat Protector | AKAMAI_ETP |
Akamai SIEM Connector | AKAMAI_SIEM_CONNECTOR |
AlertLogic Notifications | ALERTLOGIC_NOTIFICATIONS |
AlienVault Open Threat Exchange | ALIENVAULT_OTX |
Allot NetEnforcer | ALLOT_NETENFORCER |
Alveo Risk Data Management | ALVEO_RDM |
Analyst1 IOC | ANALYST1_IOC |
Apache Kafka Audit | APACHE_KAFKA_AUDIT |
Apache SpamAssassin | APACHE_SPAMASSASSIN |
APC Automatic Transfer Switch | APC_ATS |
APC Netbotz | APC_NETBOTZ |
APC Power Distribution Unit | APC_PDU |
APC Smart-UPS | APC_SMART_UPS |
APC StruxureWare Portal | APC_STRUXUREWARE |
Apiiro Cloud Application Security Platform | APIIRO |
Appgate Software-defined Perimeter | APPGATE_SDP |
Appian Cloud | APPIAN_CLOUD |
AppViewX | APPVIEWX |
Aptos Enterprise Order Management | APTOS_EOM |
Argo CD | ARGO_CD |
Argo Workflows | ARGO_WORKFLOWS |
Arista NDR | ARISTA_NDR |
Arkime Packet Capture | ARKIME_PCAP |
Armis | ARMIS |
Armorblox Email Security | ARMORBLOX_ESC |
Armor Anywhere | ARMOR_ANYWHERE |
Array Networks SSL VPN | ARRAYNETWORKS_VPN |
Array Networks WAF | ARRAY_NETWORKS_WAF |
Aruba Orchestrator | ARUBA_ORCHESTRATOR |
Arxan Threat Analytics | ARXAN_THREAT_ANALYTICS |
Asana | ASANA |
AssetNote | ASSETNOTE |
Atlassian Cloud Admin Audit | ATLASSIAN_AUDIT |
Atlassian Jira Confluence Json | ATLASSIAN_CONFLUENCE_JSON |
Atlassian Jira Json | ATLASSIAN_JIRA_JSON |
AT&T Netbond | ATT_NETBOND |
Authentic8 Silo | AUTHENTIC8_SILO |
Authx Identity Management | AUTHX |
Authx User Context | AUTHX_USER_CONTEXT |
Automox | AUTOMOX_EPM |
Avast Business | AVAST_HUB |
Avaya Session Border Controller | AVAYA_BORDER |
Avaya Interactive Voice Response | AVAYA_IVR |
Avaya VSP Switch | AVAYA_VSP |
Avaya Wireless | AVAYA_WIRELESS |
Aviatrix Cloud Network Platform | AVIATRIX |
Awake NDR | AWAKE_NDR |
AWS Dynamo DB | AWS_DYNAMO_DB |
Amazon ElastiCache | AWS_ELASTI_CACHE |
Amazon FSx for Windows File Server | AWS_FSX |
AWS Identity and Access Management (IAM) | AWS_IAM |
AWS Inspector | AWS_INSPECTOR |
AWS Inspector2 | AWS_INSPECTOR2 |
AWS NGINX | AWS_NGINX |
AWS Redshift | AWS_REDSHIFT |
AWS Simple Email Service | AWS_SES |
AWS Shield | AWS_SHIELD |
AWS VPN | AWS_VPN |
Axis Atmos | AXIS_ATMOS |
Axis Security Audit | AXIS_OS |
Axonius Cybersecurity Asset Management | AXONIUS |
Microsoft Azure | AZURE |
Azure AD Provisioning | AZURE_AD_PROVISIONING |
Azure AD Sign-In | AZURE_AD_SIGNIN |
Azure API Management | AZURE_API_MANAGEMENT |
Azure App Service | AZURE_APP_SERVICE |
Azure ATP | AZURE_ATP |
Azure Bastion | AZURE_BASTION |
Azure DNS logs | AZURE_DNS |
Azure Key Vault logging | AZURE_KEYVAULT_AUDIT |
Microsoft Intune Context | AZURE_MDM_INTUNE_CONTEXT |
Azure Security Center | AZURE_SECURITY_CENTER |
Azure Storage Audit | AZURE_STORAGE_AUDIT |
Backbox | BACKBOX |
OneIdentity Balabit | BALABIT |
BambooHR | BAMBOO_HR |
Barracuda CloudGen Access | BARRACUDA_CLOUDGEN_ACCESS |
Barracuda Impersonation Protection | BARRACUDA_IMPERSONATION |
Barracuda Content Shield | BARRACUDA_SHIELD |
Bettercloud | BETTERCLOUD |
BeyondTrust BeyondInsight | BEYONDTRUST_BEYONDINSIGHT |
BeyondTrust Cloud Privilege Broker | BEYONDTRUST_CPB |
BeyondTrust Endpoint Privilege Management | BEYONDTRUST_ENDPOINT |
BeyondTrust Management console | BEYONDTRUST_MC |
Beyond Identity | BEYOND_IDENTITY |
Bitvise SSHd | BITVISE_SSHD |
Bluecat Address Manager | BLUECAT_AM |
Blue Prism | BLUE_PRISM |
BMC AMI Defender | BMC_AMI_DEFENDER |
BMC Client Management | BMC_CLIENT_MANAGEMENT |
BMC Control-M | BMC_CONTROL_M |
Bricata NDR | BRICATA_NDR |
Britive Audit API | BRITIVE_AUDIT_API |
BRIVO | BRIVO |
CA Privileged Access Manager | BROADCOM_CA_PAM |
Broadcom Compliance Event Manager | BROADCOM_CEM |
Broadcom Support Portal Audit Logs | BROADCOM_SUPPORT_PORTAL |
Brocade Fabric OS | BROCADE_FOS |
Brocade SANnav Management Portal | BROCADE_SANNAV |
Brocade Switch | BROCADE_SWITCH |
Zeek DHCP | BRO_DHCP |
Zeek HTTP | BRO_HTTP |
BT IPControl | BT_IPCONTROL |
Burpsuite Application Security testing tool | BURPSUITE |
Cameyo Bring Your Own Cloud | CAMEYO_BYO_CLOUD |
Canary Audit Trail | CANARY_AUDIT_TRAIL |
CATO SD-WAN | CATO_SDWAN |
Censornet CASB | CENSORNET_CASB |
CENSYS | CENSYS |
Cequence Bot Defense | CEQUENCE_BOT_DEFENSE |
Cerberus FTP Server | CERBERUS_FTP |
Check Point CloudGuard | CHECKPOINT_CLOUDGUARD |
Check Point Email | CHECKPOINT_EMAIL |
Checkpoint SmartDefense | CHECKPOINT_SMARTDEFENSE |
Cilium | CILIUM |
Cisco Aironet | CISCO_AIRONET |
Cisco APIC | CISCO_APIC |
Cisco Call Manager | CISCO_CALL_MANAGER |
Cisco DNA Center Platform | CISCO_DNAC |
Cisco DNS | CISCO_DNS |
Cisco Meraki Camera | CISCO_MERAKI_CAMERA |
Cisco vManage SD-WAN | CISCO_SDWAN |
Cisco Secure Malware Analytics | CISCO_SECURE_MALWARE_ANALYTICS |
Cisco Secure Workload | CISCO_SECURE_WORKLOAD |
Cisco Content Security Management Appliance | CISCO_SMA |
Cisco SNMP Trapd | CISCO_SNMP |
Cisco Unity Connection | CISCO_UNITY_CONNECTION |
Cisco WSA | CISCO_WSA |
CiscoXDR | CISCO_XDR |
Citrix Analytics | CITRIX_ANALYTICS |
Citrix Netscaler Web Logs | CITRIX_NETSCALER_WEB_LOGS |
Citrix SD-WAN | CITRIX_SDWAN |
Citrix Session Metadata | CITRIX_SESSION_METADATA |
Citrix Virtual Desktop Infrastructure | CITRIX_VDI |
Citrix WAF | CITRIX_WAF |
Citrix Web Gateway | CITRIX_WEB_GATEWAY |
Citrix Workspace | CITRIX_WORKSPACE |
Citrix XenCenter | CITRIX_XENCENTER |
Claroty Continuous Threat Detection | CLAROTY_CTD |
Claroty Enterprise Management Console | CLAROTY_EMC |
Clearsense Healthcare Analytics | CLEARSENSE |
Click Studios Passwordstate | CLICK_STUDIOS_PASSWORDSTATE |
CloudBolt | CLOUDBOLT |
Cloudflare Bot Management | CLOUDFLARE_BOT_MANAGEMENT |
Cloud Passage (CSM) | CLOUDPASSAGE_CSM |
Cloud Passage (FIM) | CLOUDPASSAGE_FIM |
Cloud Passage (LIDS) | CLOUDPASSAGE_LIDS |
Cloud Passage (SVM) | CLOUDPASSAGE_SVM |
cmd.com | CMD |
Cockroach DB | COCKROACH_DB |
Code42 CrashPlan | CODE42 |
Code42 Incydr | CODE42_INCYDR |
Code Worldwide | CODE_WORLDWIDE |
Cofense Vision | COFENSE_VISION |
Cohesity | COHESITY |
Cohesity Smartfiles | COHESITY_SMARTFILES |
CommVault Commcell | COMMVAULT_COMMCELL |
Commvault Metallic | COMMVAULT_METALLIC |
Confluent Audit | CONFLUENT_AUDIT |
ConnectWise Automate | CONNECTWISE_AUTOMATE |
ConnectWise Control | CONNECTWISE_CONTROL |
Cradlepoint NetCloud | CRADLEPOINT_NETCLOUD |
Cribl AppScope | CRIBL_APPSCOPE |
Cribl Cloud | CRIBL_CLOUD |
Cribl Edge | CRIBL_EDGE |
Cribl Search | CRIBL_SEARCH |
Cribl Stream | CRIBL_STREAM |
ProLion CryptoSpike | CRYPTOSPIKE |
CSG Custom Rules Engine | CSG_CUSTOMENGINE |
CSG Singleview | CSG_SINGLEVIEW |
CSV Custom CMDB | CSV_CUSTOM_CMDB |
CrowdStrike Falcon CEF | CS_CEF_EDR |
CTERA Drive | CTERA_DRIVE |
Culture AI | CULTURE_AI |
Customer Alerts | CUSTOMER_ALERT |
Custom Application Access Logs | CUSTOM_APPLICATION_ACCESS |
Custom Host Forensics | CUSTOM_HOST_FORENSICS |
CyberArk Privileged Access Manager (PAM) | CYBERARK_PAM |
CyberArk Identity Single Sign-On | CYBERARK_SSO |
Connectsecure | CYBERCNS |
Cyberhaven Data Detection and Response | CYBERHAVEN_DDR |
Cyberhaven | CYBERHAVEN_EVENTS |
Cyberint | CYBERINT |
Microsoft CyberX | CYBERX |
Cycode Platform | CYCODE |
Insider threat detection and response | CYDERES_INSIDER |
Cylance | CYLANCE |
Cylera IOT | CYLERA_IOT |
Cynet 360 AutoXDR | CYNET_360_AUTOXDR |
Cyolo Zero Trust | CYOLO_ZTNA |
D3 Security | D3_SECURITY |
Databricks | DATABRICKS |
DataLocker SafeConsole | DATALOCKER_SAFECONSOLE |
Datasunrise Dam | DATASUNRISE_DAM |
Datawatch | DATAWATCH |
DealCloud | DEAL_CLOUD |
Deepfence Network Monitoring | DEEPFENCE |
Delinea Privilege Manager | DELINEA_PRIVILEGE_MANAGER |
Delinea Secret Server | DELINEA_SECRET_SERVER |
Delinea Server Suite | DELINEA_SERVER_SUITE |
Dell Cyber Recovery Manager | DELL_CRM |
Dell CyberSense | DELL_CYBERSENSE |
Dell EMC Avamar | DELL_EMC_AVAMAR |
Dell EMC Cloudlink | DELL_EMC_CLOUDLINK |
Dell EMC PowerStore | DELL_EMC_POWERSTORE |
Dell EMC Unity | DELL_EMC_UNITY |
Dell SonicWALL WAF | DELL_WAF |
Design Profit Central Server | DESIGN_PROFIT_CENTRAL_SERVER |
Device 42 | DEVICE_42 |
Devolutions Remote Desktop Manager | DEVOLUTIONS_RDM |
Divvy Cloud | DIVVY_CLOUD |
Docker | DOCKER |
DomainTools Threat Intelligence | DOMAINTOOLS_THREATINTEL |
DOMO Business Cloud | DOMO |
Dragos | DRAGOS |
Draytek Firewall | DRAYTEK |
Dremio Data Lakehouse | DREMIO_DATA_LAKEHOUSE |
Dropbox | DROPBOX |
Drupal Logging | DRUPAL |
Druva Backup | DRUVA_BACKUP |
DSP Toolkit audit | DSP_AUDIT |
Duo Access Gateway | DUO_CASB |
Duo Network Gateway | DUO_NETWORK_GATEWAY |
Dynatrace | DYNATRACE |
CWT SatoTravel | E2_SOLUTIONS |
Eaton UPS | EATON_UPS |
eCAR | ECAR |
eCAR Bro | ECAR_BRO |
Edgio CDN | EDGIO_CDN |
Edgio Rate Limiting | EDGIO_RL |
Edgio WAF | EDGIO_WAF |
Efax | EFAX |
Egnyte | EGNYTE |
EclecticIQ EDR | EIQ_EDR |
Elastic File Beats | ELASTIC_FILEBEAT |
Elastic Metric Beats | ELASTIC_METRICBEAT |
Emerson Smart Firewall | EMERSON_FIREWALL |
Endgame | ENDGAME_EDR |
Ensono Cloud Mainframe Solution | ENSONO |
Entrust nShield HSM | ENTRUST_HSM |
Entrust NTP Server | ENTRUST_NTP_SERVER |
Entrust Secrets Vault | ENTRUST_SECRETS_VAULT |
Erlang Shell Logs | ERLANG_SHELL |
Ermes Web Protection | ERMES |
Ermetic | ERMETIC |
E-Share platform | ESHARE_PLATFORM |
Estar | ESTAR |
ETQ Reliance | ETQ_RELIANCE |
Exabeam Fusion XDR | EXABEAM_FUSION_XDR |
ExtraHop DHCP | EXTRAHOP_DHCP |
ExtremeWare Operating System (OS) | EXTREMEWARE_NETWORKS |
xtreme Networks ExtremeControl NAC Solution | EXTREME_CONTROL |
Extreme Management Center | EXTREME_MANAGEMENT |
Extreme Networks Switch | EXTREME_SWITCH |
EzProxy | EZPROXY |
F5 Bot | F5_BOT |
F5 IP Intelligence | F5_IP_INTELLIGENCE |
F5 Silverline | F5_SILVERLINE |
Fail2Ban Scan | FAIL2BAN |
Farsight DNSDB | FARSIGHT_DNSDB |
Feenics Access Control | FEENICS_ACCESS_CONTROL |
Fidelis Endpoint | FIDELIS_ENDPOINT |
FileMage SFTP | FILEMAGE_SFTP |
Firebase | FIREBASE |
Fireeye eMPS | FIREEYE_EMPS |
FireEye Helix | FIREEYE_HELIX |
FireMon Firewall | FIREMON_FIREWALL |
Fivetran | FIVETRAN |
Flashpoint IOC | FLASHPOINT_IOC |
Fleet DM | FLEET_DM |
Forcepoint Email Security | FORCEPOINT_EMAILSECURITY |
Forcepoint Insider Threat | FORCEPOINT_FIT |
Forcepoint V Series | FORCEPOINT_VSERIES |
Fortanix Data Security Manager | FORTANIX_DSM |
Fortinet Wireless Access Point | FORTINET_AP |
Fortinet FortiAuthenticator | FORTINET_FORTIAUTHENTICATOR |
Fortinet FortiSandbox | FORTINET_SANDBOX |
Fortinet Switch | FORTINET_SWITCH |
Fortinet Proxy | FORTINET_WEBPROXY |
Foundry Fastiron | FOUNDRY_FASTIRON |
Fox-IT | FOX_IT_STIX |
FreeIPA | FREEIPA |
FreeRADIUS | FREERADIUS |
Digital Defense Frontline VM | FRONTLINE_VM |
Futurex HSM | FUTUREX_HSM |
GCP Artifact Registry | GCP_ARTIFACT_REGISTRY |
GCP Google Kubernetes Container Security | GCP_KUBERNETES_CONTAINER_SECURITY |
reCAPTCHA Enterprise | GCP_RECAPTCHA_ENTERPRISE |
GCP Threat Detection | GCP_THREAT_DETECTION |
Gigamon | GIGAMON |
Gigya CIAM | GIGYA_CIAM |
GitGuardian Enterprise | GITGUARDIAN_ENTERPRISE |
Github Events | GITHUB_EVENTS |
Glean | GLEAN |
Globalscape SFTP | GLOBALSCAPE_SFTP |
GlusterFS | GLUSTER_FS |
GMV Checker User Context | GMV_CHECKER_CONTEXT |
GoAnywhere MFT | GOANYWHERE_MFT |
GoDaddy DNS | GODADDY_DNS |
GoldiLock | GOLDILOCK |
GrayhatWarfare | GRAYHATWARFARE |
Graylog Operations | GRAYLOG |
GreatHorn Email Security | GREATHORN |
GreyNoise | GREYNOISE |
GTB Technologies DLP | GTB_DLP |
H3C Comware Platform Switch | H3C_SWITCH |
HaProxy LoadBalancer | HAPROXY_LOADBALANCER |
Harbor | HARBOR |
Hirschmann Switch | HIRSCHMANN_SWITCH |
Hitachi PAM | HITACHI_ID_PAM |
Hornet Email Security | HORNET_SECURITY |
Hewlett Packard Enterprise SAN | HPE_SAN |
HP Printer logs | HP_PRINTER |
HP Wolf Pro Security | HP_WOLF |
Huawei NAC | HUAWEI_NAC |
HubSpot Activity Logs | HUBSPOT_ACTIVITY |
HubSpot CRM Platform | HUBSPOT_CRM |
HubSpot Authentication Logs | HUBSPOT_LOGIN |
HYPR MFA | HYPR_MFA |
3Com 8800 Series Switch | IBM_3COM |
IBM Cleversafe Object Storage | IBM_CLEVERSAFE |
IBM KNS | IBM_KNS |
IBM Tape Storages | IBM_LTO |
IBM MaaS360 | IBM_MAAS360 |
IBM Mainframe Storage | IBM_MAINFRAME_STORAGE |
IBM MQ File Transfer | IBM_MQ_FILE_TRANSFER |
IBM Security Identity Manager | IBM_SIM |
IBM Security QRadar SOAR | IBM_SOAR |
IBM Spectrum Protect | IBM_SPECTRUM_PROTECT |
IBM Switch | IBM_SWITCH |
IBM Tririga | IBM_TRIRIGA |
IBM WinCollect | IBM_WINCOLLECT |
IBM zSecure Alert | IBM_ZSECURE_ALERT |
Idecsi | IDECSI |
Dell iDRAC | IDRAC |
iManage Cloud Platform | IMANAGE_CLOUD |
Imperva Sonar | IMPERVA_SONAR |
Imprivata Confirm ID | IMPRIVATA_CONFIRM_ID |
Imprivata Identity Governance | IMPRIVATA_IDG |
Imprivata OneSign | IMPRIVATA_ONESIGN |
Infinidat | INFINIDAT |
Infoblox Loadbalancer | INFOBLOX_LOADBALANCER |
Infoblox NetMRI | INFOBLOX_NETMRI |
Infoblox RPZ | INFOBLOX_RPZ |
INKY Secure Email | INKY |
inWebo MFA | INWEBO_MFA |
Ipswitch MOVEit Automation | IPSWITCH_MOVEIT_AUTOMATION |
Ironscales | IRONSCALES |
Ivanti Application Control | IVANTI_APP_CONTROL |
Ivanti Device Control | IVANTI_DEVICE_CONTROL |
ISM Xtraction | IVANTI_XTRACTION |
Jamf Compliance Reporter | JAMF_COMPLIANCE_REPORTER |
Jamf Protect Network Traffic | JAMF_NETWORK_TRAFFIC |
JAMF Pro | JAMF_PRO |
Jamf pro context | JAMF_PRO_CONTEXT |
Jamf Pro MDM | JAMF_PRO_MDM |
Jamf Protect Threat Events | JAMF_THREAT_EVENTS |
IBM JDE | JDE |
Journald | JOURNALD |
JumpCloud Directory as a Service | JUMPCLOUD_DAAS |
Juniper Secure Connect VPN | JUNIPER_VPN |
Jupiter One | JUPITER_ONE |
KACE Service Desk | KACE_SERVICE_DESK |
KACE Systems Management Appliance | KACE_SMA |
Kamailio | KAMAILIO |
Kandji | KANDJI |
Kaseya IT Management | KASEYA |
Kaspersky Endpoint | KASPERSKY_ENDPOINT |
Keeper Enterprise Security | KEEPER |
Keycloak | KEYCLOAK |
Keysight Packet Brokers | KEYSIGHT |
Kibana audit logs | KIBANA |
Kion | KION |
KnowBe4 PhishER | KNOWBE4_PHISHER |
Kustomer CRM | KUSTOMER_CRM |
Lansweeper Asset Management | LANSWEEPER |
LastPass Password Management | LASTPASS |
LOAD_BALANCER_ADC | LB_ADC |
Lepide | LEPIDE |
Lexmark Printer logs | LEXMARK_PRINTER |
Liaison NuBridges Platform | LIAISON_NUBRIDGES |
Libraesva Email Security | LIBRAESVA_EMAIL |
Lira | LIRA |
Logic Monitor | LOGICMONITOR |
LogonBox | LOGONBOX |
LookingGlass Aenoik IDPS | LOOKINGGLASS_IPS |
Looking Glass | LOOKING_GLASS_IOC |
LSI Badge Management System | LSI_BMS |
Lumen DDoS Hyper | LUMEN_DDOS_HYPER |
Lumos | LUMOS |
Lenovo XClarity Orchestrator | LXC_ORCHESTRATOR |
MailScanner | MAILSCANNER |
Malwarebytes | MALWAREBYTES_EDR |
Mambu | MAMBU |
Manage Engine Endpoint | MANAGEENGINE_ENDPOINT |
ManageEngine Remote Access Plus | MANAGEENGINE_RAP |
ManageEngine Password Manager Pro | MANAGE_ENGINE_PASSWORD_MANAGER |
Mandiant Attack Surface Management Entity | MANDIANT_ASM_ENTITY |
Mandiant Attack Surface Management Discovered Issue | MANDIANT_ASM_ISSUE |
Mandiant Attack Surface Management Technology | MANDIANT_ASM_TECHNOLOGY |
Mango Apps | MANGOAPPS |
Maria Database | MARIA_DB |
Material Security | MATERIAL_SECURITY |
Matrix Frontier Badge Management | MATRIX_FRONTIER |
Mattermost | MATTERMOST |
McAfee Application Control | MCAFEE_APP_CONTROL |
McAfee Advanced Threat Defense | MCAFEE_ATD |
McAfee MVISION EDR | MCAFEE_EDR |
McAfee Solid Core | MCAFEE_SOLID_CORE |
Medigate CMDB | MEDIGATE_CMDB |
Micro Focus iManager | MICROFOCUS_IMANAGER |
MicroSemi NTP | MICROSEMI_NTP |
Microsoft Dynamics 365 User Activity | MICROSOFT_DYNAMICS_365 |
Microsoft Defender External Attack Surface Management | MICROSOFT_EASM |
Microsoft IAS Server | MICROSOFT_IAS |
Microsoft Identity Protection | MICROSOFT_IDENTITY_PROTECTION |
Microsoft Netlogon | MICROSOFT_NETLOGON |
Microsoft Azure AD Risk Detections | MICROSOFT_RISK_DETECTIONS |
Microsoft System Center Endpoint Protection | MICROSOFT_SCEP |
Microsoft Security Actions | MICROSOFT_SECURITY_ACTIONS |
Microsoft Security Advisories Alerts | MICROSOFT_SECURITY_ALERTS |
Microsoft SSTP VPN | MICROSOFT_SSTP |
Microsoft Threat Indicators | MICROSOFT_THREAT_INDICATORS |
Mikrotik Router | MIKROTIK_ROUTER |
Mimecast Attachment Logs | MIMECAST_ATTACHMENT_LOGS |
Mimecast Audit Logs | MIMECAST_AUDIT_LOGS |
Mimecast DLP Logs | MIMECAST_DLP_LOGS |
Mimecast impersonation Logs | MIMECAST_IMPERSONATION_LOGS |
Mimecast URL Logs | MIMECAST_URL_LOGS |
Mimecast Web Security | MIMECAST_WEBPROXY |
Minerva AV | MINERVA_AV |
Mirth OnPrem Appliances NextGen | MIRTH_NEXTGEN |
Mitel Communications Director | MITEL_MCD |
Mode Analytics | MODE_ANALYTICS |
Monday | MONDAY |
Mulesoft | MULESOFT |
MultiPay | MULTIPAY |
Nagios Infrastructure Monitoring | NAGIOS |
NCC Scout Suite | NCC_SCOUTSUITE |
NCR Digital Insight FSG | NCR_DIGITAL_INSIGHT_FSG |
NCR Digital Insight Global Logging | NCR_DIGITAL_INSIGHT_GL |
Neo4j | NEO4J |
Nessus | NESSUS |
NetDisco | NETDISCO |
Netenrich Entity Behaviour | NETENRICH_ENTITY_BEHAVIOR |
Netgear Switch | NETGEAR_SWITCH |
NetIQ Access Manager | NETIQ_ACCESS_MANAGER |
NetIQ eDirectory | NETIQ_EDIRECTORY |
Netmotion | NETMOTION |
Netskope CASB | NETSKOPE_CASB |
Netscope Client | NETSKOPE_CLIENT |
Netsurion ProtectWise | NETSURION_PROTECTWISE |
Neustar SiteProtect | NEUSTAR_SITEPROTECT |
New Relic Platform | NEW_RELIC |
Nextcloud Hub | NEXTCLOUD_HUB |
Ne Silent Log | NE_SILENT_LOG |
Ninja One | NINJAONE |
NIST National Vulnerability Database | NIST_NVD |
NNT File Integrity monitoring | NNT_FIM |
Noname API Security | NONAME_API_SECURITY |
NordLayer VPN | NORD_LAYER |
Nortel Contivity VPN Switch | NORTEL_SWITCH |
Nucleus Vulnerability Scan Delta | NUCLEUS_VULNERABILITY_DELTA |
Nutanix Frame | NUTANIX_FRAME |
Obsidian | OBSIDIAN |
Okta RADIUS | OKTA_RADIUS |
Onapsis | ONAPSIS |
OnBase CMS | ONBASE_CMS |
One Identity Active Role Service | ONEIDENTITY_ARS |
One Identity Change Auditor | ONEIDENTITY_CHANGE_AUDITOR |
One Identity Defender | ONEIDENTITY_DEFENDER |
One Identity TPAM | ONEIDENTITY_TPAM |
OneLogin User Context | ONELOGIN_USER_CONTEXT |
1Password Audit Events | ONEPASSWORD_AUDIT_EVENTS |
Opengear Remote Management | OPENGEAR |
Opentelemetry | OPENTELEMETRY |
OpenText Fax2Mail | OPENTEXT_FAX2MAIL |
Opswat Kiosk | OPSWAT_KIOSK |
Opswat Metadefender | OPSWAT_METADEFENDER |
Oracle HCM Human resources platform solution | ORACLE_HCM |
Oracle SSO Audit Logging | ORACLE_SSO_AUDIT |
Oracle WebLogic Server | ORACLE_WEBLOGIC |
Orca Cloud Security Platform | ORCA |
Oscar Claims | OSCAR_CLAIMS |
Open Source Intelligence | OSINT_IOC |
Osirium PAM | OSIRIUM_PAM |
Outpost24 | OUTPOST24 |
Packetlight Dwdm | PACKETLIGHT_DWDM |
Packet Viper | PACKET_VIPER |
PACOM Systems | PACOM_SYSTEMS |
PagerDuty | PAGERDUTY |
Pagerduty Audit | PAGERDUTY_AUDIT |
Palo Alto DNS Security | PAN_DNS_SECURITY |
Palo Alto Networks Global Protect | PAN_GLOBAL_PROTECT |
Palo Alto Networks IoT Security | PAN_IOT |
Palo Alto Networks XSOAR Audit | PAN_XSOAR |
PaperCut Printing Management System | PAPER_CUT |
Passwordstate | PASSWORDSTATE |
Paxton Access Control Systems | PAXTON_ACS |
SSL pcap | PCAP_SSL_CLIENT_HELLO |
Pentera | PENTERA |
Pentera ASV | PENTERA_ASV |
Pentera Leef | PENTERA_LEEF |
PeopleSoft | PEOPLESOFT |
Peplink Loadbalancer | PEPLINK_LOADBALANCER |
Peplink Router | PEPLINK_ROUTER |
Peplink Switch | PEPLINK_SWITCH |
PerimeterX Bot Protection | PERIMETERX_BOT_PROTECTION |
Perimeter 81 | PERIMETER_81 |
Domain Tools Phisheye | PHISHEYE_ALERT |
Phishlabs | PHISHLABS |
Pingsafe | PINGSAFE |
Ping Access | PING_ACCESS |
Ping One | PING_ONE |
Ping SDK | PING_SDK |
Plaso Super Timeline | PLASO |
Plixer Scrutinizer | PLIXER_SCRUTINIZER |
Pomerium | POMERIUM |
Portnix Audit | PORTNOX_AUDIT |
Portnix CEF | PORTNOX_CEF |
PostgreSQL | POSTGRESQL |
MS Powershell Transcript | POWERSHELL_TRANSCRIPT |
Power DNS | POWER_DNS |
Preveil Enterprise | PREVEIL_ENTERPRISE |
ProofID | PROOFID |
Proofpoint CASB | PROOFPOINT_CASB |
Proofpoint Secure Share | PROOFPOINT_SECURE_SHARE |
Proofpoint Security Awareness Training | PROOFPOINT_SECURITY_AWARENESS_TRAINING |
Proofpoint Sendmail Sentrion | PROOFPOINT_SENDMAIL_SENTRION |
Protegrity Defiance | PROTEGRITY_DEFIANCE |
Honeywell Pro-Watch | PROWATCH |
ProxMax | PROXMAX |
PRTG Network Monitor | PRTG_NETWORKMONITOR |
Puppet | PUPPET |
Pure Storage | PURE_STORAGE |
QLIK Audit | QLIK_AUDIT |
QNAP Systems NAS | QNAP_NAS |
Qualys User Activity | QUALYS_ACTIVITY |
RSA RADIUS | RADIUS |
Radware DDoS Protection | RADWARE_DDOS |
RAD ETX | RAD_ETX |
Rapid7 Security Onion | RAPID7_SECURITY_ONION |
Raritan Dominion SX II | RARITAN_DOMINION |
Recordia | RECORDIA |
Red Canary Cloud Protection | REDCANARY_CLOUD_PROTECTION_RAW |
Red Hat Identity Management | REDHAT_IM |
Red Hat Keycloak | REDHAT_KEYCLOAK |
RedHat Satellite Server | REDHAT_SATELLITE |
RedHat StackRox | REDHAT_STACKROX |
Remediant SecureONE | REMEDIANT_SECUREONE |
Ribbon Session Border Controller | RIBBON_SBC |
Ring Central | RING_CENTRAL |
RiskIQ Digital Footprint | RISKIQ_DIGITAL_FOOTPRINT |
RSA SecurID Access Identity Router | RSA_SECURID |
Rubrik Polaris | RUBRIK_POLARIS |
Rumble Network Discovery | RUMBLE_NETWORK_DISCOVERY |
SafeConnect NAC | SAFECONNECT_NAC |
Salesforce Context | SALESFORCE_CONTEXT |
Sangfor Next Generation Firewall | SANGFOR_NGAF |
SAP Cloud for Customer | SAP_C4C |
SAP HANA | SAP_HANA |
SAP Identity Management | SAP_IDM |
SAP Insurance | SAP_INSURANCE |
SAP SAST Suite | SAP_SAST |
SAP SM20 | SAP_SM20 |
SAP SuccessFactors | SAP_SUCCESSFACTORS |
Microsoft System Center Configuration Manager | SCCM |
Secberus Cloud Security Governance | SECBERUS |
SecurityScorecard Platform | SECURITYSCORECARD |
Semperis ADFR | SEMPERIS_ADFR |
Sendgrid Api | SENDGRID |
Senhasegura PAM | SENHASEGURA_PAM |
SentinelOne Singularity Cloud Funnel | SENTINELONE_CF |
ServiceNow Audit | SERVICENOW_AUDIT |
ServiceNow Roles | SERVICENOW_ROLES |
Sevco Security CMDB | SEVCO_CMDB |
Microsoft SharePoint | SHAREPOINT |
Sharepoint Unified Logging Service (ULS) | SHAREPOINT_ULS |
shodan.io | SHODAN_IO |
Siebel Monitoring | SIEBEL |
Siemens SiPass | SIEMENS_SIPASS |
Silver Peak Firewall | SILVERPEAK_FIREWALL |
Single Store | SINGLE_STORE |
SKYSEA Client View | SKYSEA |
Smart Simple | SMART_SIMPLE |
Snapattack | SNAPATTACK |
Snipe-IT | SNIPE_IT |
Snowflake | SNOWFLAKE |
Socomec UPS | SOCOMEC_UPS |
Software House Access Control | SOFTWARE_HOUSE_ACS |
Solaris system | SOLARIS_SYSTEM |
SolarWinds Serv-U | SOLARWINDS_SERV_U |
SonarQube | SONARQUBE |
Sophos Email Appliance | SOPHOS_EMAIL |
Sophos URL filtering | SOPHOS_URL |
Spamhaus | SPAMHAUS |
Symantec Protection Engine | SPE |
Splashtop Remote Access and Support software | SPLASHTOP |
Splunk Attack Analyzer | SPLUNK_ATTACK_ANALYZER |
Splunk DNS | SPLUNK_DNS |
Splunk Phantom | SPLUNK_PHANTOM |
Splunk Intel Management | SPLUNK_TRUSTAR |
Stairwell Inception | STAIRWELL_INCEPTION |
Stellar Cyber | STELLAR_CYBER |
Stream Alert | STREAMALERT |
StrongDM | STRONGDM |
Sublime Security | SUBLIMESECURITY |
Supermicro IPMI | SUPERMICRO_IPMI |
Superna Eyeglass | SUPERNA_EYEGLASS |
SureView Systems Activity | SUREVIEW_SYSTEMS |
Swift Alliance Messaging Hub | SWIFT_AMH |
Swimlane Platform | SWIMLANE |
Symantec Messaging Gateway | SYMANTEC_MAIL |
Symphony Summit AI | SYMPHONYAI |
Synology | SYNOLOGY |
Tableau | TABLEAU |
Tailscale | TAILSCALE |
Talon | TALON |
Tanium Deploy | TANIUM_DEPLOY |
Tanium Question | TANIUM_QUESTION |
Tanium TanOS | TANIUM_TANOS |
Tenable OT | TENABLE_OT |
Tenable Web App Scanning | TENABLE_WAS |
Teradici PCoIP | TERADICI_PCOIP |
Terraform Enterprise Audit | TERRAFORM_ENTERPRISE |
Tessian Cloud Email Security Platform | TESSIAN_PLATFORM |
TGDetect | TGDETECT |
ThreatQuotient | THREATQ_IOC |
ThreatX WAF | THREATX_WAF |
Thycotic devops secret vault | THYCOTIC_DEVOPS_SECRETVAULT |
Trend Micro | TIPPING_POINT |
Traceable API Security | TRACEABLE_PLATFORM |
Traefik Labs | TRAEFIK |
TrendMicro Apex Central | TRENDMICRO_APEX_CENTRAL |
Trend Micro Apex one | TRENDMICRO_APEX_ONE |
Trend Micro Cloud App Security | TRENDMICRO_CLOUDAPPSECURITY |
Trend Micro Cloud one | TRENDMICRO_CLOUDONE |
TrendMicro Deep Discovery Inspector | TRENDMICRO_DDI |
TrendMicro EDR | TRENDMICRO_EDR |
TrendMicro Webproxy DSM | TRENDMICRO_WEBPROXY_DSM |
Tripp Lite | TRIPP_LITE |
Twilio Audit | TWILIO_AUDIT |
Twilio Authy | TWILIO_AUTHY |
Twingate | TWINGATE |
Tyk IO | TYK_IO |
Ubiquiti UDM Firewall | UBIQUITI_FIREWALL |
UDM | UDM |
Uipath | UIPATH |
UltraDNS | ULTRADNS |
Ultra Electronics CyberFence | ULTRA_CYBERFENCE |
Unifi Switch | UNIFI_SWITCH |
Unit 21 | UNIT21 |
UpGuard | UPGUARD |
Vector Dev | VECTOR_DEV |
Vectra Protect | VECTRA_PROTECT |
Veeam | VEEAM |
Velo Firewall | VELO_FIREWALL |
Venafi | VENAFI |
Veritas NetBackup | VERITAS_NETBACKUP |
Verizon Network Detection and Response | VERIZON_NDR |
Verkada | VERKADA |
Virsec Event Logs | VIRSEC_EVENT |
Virsec Attack and Threat Logs | VIRSEC_THREAT |
Virtru Email Encryption | VIRTRU_EMAIL_ENCRYPTION |
VirusTotal Threat Hunter | VIRUSTOTAL_THREAT_HUNTER |
VMRay Analyzer | VMRAY_FLOG_XML |
VMware Aria Logs | VMWARE_ARIA_LOGS |
Vmware Avinetworks iWAF | VMWARE_AVINETWORKS_IWAF |
VMware Avi Vantage Platform | VMWARE_AVI_VANTAGE |
VMware Cloud Director | VMWARE_CD |
VMware HCX | VMWARE_HCX |
VMware NSX AVI | VMWARE_NSX_AVI |
VMware SDDC | VMWARE_SDDC |
VMware SDWN Events | VMWARE_SDWN_EVENTS |
VMware Unified Access Gateway | VMWARE_UNIFIED_ACCESS_GATEWAY |
VMware vShield | VMWARE_VSHIELD |
Voltage | VOLTAGE |
Vonage | VONAGE |
VSFTPD Audit | VSFTPD_AUDIT |
Wallix Bastion | WALLIX_BASTION |
Wallix Endpoint Privilege Management | WALLIX_EPM |
Wallix Privileged Access Management | WALLIX_PAM |
Waterfall Data Security Manager | WATERFALL_DSM |
WebEx | WEBEX_SAAS |
White Cloud | WHITECLOUD_EDR |
Windows Filtering Platform | WINDOWS_WFP |
wiz.io | WIZ_IO |
Wordpress Simple History | WORDPRESS_SIMPLE_HISTORY |
Workato Audit Logs | WORKATO |
Workday Audit Logs | WORKDAY_AUDIT |
Workday User Activity | WORKDAY_USER_ACTIVITY |
Workspot Control | WORKSPOT_CONTROL |
WP Engine | WP_ENGINE |
Western Telematic Inc Console Servers | WTI_CONSOLE_SERVERS |
Ysoft Data Security Manager | YSOFT_DSM |
Zabbix | ZABBIX |
Zendesk CRM | ZENDESK_CRM |
ZeroFox Platform | ZEROFOX_PLATFORM |
Zoho Analytics Audits | ZOHO_AUDIT |
ZScaler Deception | ZSCALER_DECEPTION |
Zscaler Digital Experience | ZSCALER_DIGITAL_EXPERIENCE |
Zscaler DLP | ZSCALER_DLP |
Zscaler Client Connector | ZSCALER_ZCC |
Zscaler ZDX | ZSCALER_ZDX |
Zscaler Secure Private Access Audit Logs | ZSCALER_ZPA_AUDIT |
Zuora App Logs | ZUORA_APP_LOGS |