Source | Data Type | SecOps (Chronicle) Log Type |
|---|---|---|
AWS | AWS CloudTrail management logs | AWS_CLOUDTRAIL |
AWS S3 Data events | AWS_CLOUDTRAIL | |
AWS EKS logs | AWS_EKS | |
AWS VPC flow logs | AWS_VPC_FLOW | |
AWS Route 53 Resolver Query logs | AWS_ROUTE_53 | |
Azure | Azure activity logs | AZURE_ACTIVITY |
Azure Storage Account logs | AZURE_STORAGE_AUDIT | |
Azure Key Vault logs | AZURE_KEYVAULT_AUDIT | |
Azure AKS logs | KUBERNETES_AUDIT_AZURE | |
Azure Virtual Network flow logs | AZURE_VNET_FLOW | |
GCP | GCP Admin activity audit logs | GCP_CLOUDAUDIT |
GCP Storage data access logs | GCP_CLOUDAUDIT | |
GKE audit logs | GCP_CLOUDAUDIT | |
GCP VPC flow logs | GCP_VPC_FLOW | |
OCI | OCI audit logs | OCI_AUDIT |
Identity | Azure Entra audit logs | AZURE_AD |
Google Workspace audit logs | WORKSPACE_ACTIVITY | |
Okta System Logs | OKTA | |
SaaS | Snowflake Login History | SNOWFLAKE |
Atlassian Cloud Organization Audit Logs | ATLASSIAN_AUDIT | |
Claude Enterprise - compliance events & chat message events | CLAUDE_COMPLIANCE_LOGS | |
M365 Audit Logs | OFFICE_365 | |
Salesforce Event Log Files | SALESFORCE | |
Salesforce Login History | SALESFORCE | |
Salesforce Setup Audit Trail | SALESFORCE | |
Slack Enterprise Grid Audit Logs | SLACK_AUDIT | |
VCS | GitHub Audit logs | GITHUB |
GitLab Audit Logs | GITLAB |
Disclaimer: This list of supported data sources and log types is provided for informational purposes only and is subject to change, modification, or deprecation.