| AADManagedIdentitySignInLogs |
Microsoft Entra ID |
Yes |
Yes |
| AADNonInteractiveUserSignInLogs |
Microsoft Entra ID |
Yes |
Yes |
| AADProvisioningLogs |
Microsoft Entra ID |
Yes |
Yes |
| AADRiskyServicePrincipals |
Microsoft Entra ID |
Yes |
Yes |
| AADRiskyUsers |
Microsoft Entra ID |
Yes |
Yes |
| AADServicePrincipalRiskEvents |
Microsoft Entra ID |
Yes |
Yes |
| AADServicePrincipalSignInLogs |
Microsoft Entra ID |
Yes |
Yes |
| AADUserRiskEvents |
Microsoft Entra ID |
Yes |
Yes |
| ABAPAuditLog |
Pathlock Inc.: Threat Detection and Response for SAP
SAP S/4HANA Cloud Public Edition
SecurityBridge Solution for SAP |
Yes |
Yes |
| ABNORMAL_CASES_CL |
AbnormalSecurity (using Azure Functions) |
Yes |
Yes |
| ABNORMAL_SECURITY_ABUSE_MAILBOX_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_ATO_CASE_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_AUDIT_LOG_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_CASE_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_LOGS_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_POSTURE_CHANGE_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_REMEDIATION_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_THREAT_LOG_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_SECURITY_VENDOR_CASE_CL |
Abnormal Security (Push) |
Yes |
Yes |
| ABNORMAL_THREAT_MESSAGES_CL |
AbnormalSecurity (using Azure Functions) |
Yes |
Yes |
| ADFSSignInLogs |
Microsoft Entra ID |
Yes |
Yes |
| ADOAuditLogs_CL |
Azure DevOps Audit Logs (via Codeless Connector Framework) |
Yes |
Yes |
| AgariAPDPolicyLog_CL |
Fortra Agari Data Connector (via Codeless Connector Framework) |
No |
No |
| AgariAPDTCLog_CL |
Fortra Agari Data Connector (via Codeless Connector Framework) |
No |
No |
| AgariBPAlertsLog_CL |
Fortra Agari Data Connector (via Codeless Connector Framework) |
No |
No |
| AgariBPThreatFeedSubs_CL |
Fortra Agari Data Connector (via Codeless Connector Framework) |
No |
No |
| AirlockDigitalExecutionHistories |
Airlock Digital connector (via Codeless Connector Framework) |
No |
No |
| AirlockDigitalExecutionHistories_CL |
Airlock Digital (Poll - SaaS)
Airlock Digital (Poll)
Airlock Digital (Push) |
No |
No |
| AirlockDigitalFileActivitySummary |
Airlock Digital connector (via Codeless Connector Framework) |
No |
No |
| AirlockDigitalPolicyChanges_CL |
Airlock Digital (Push) |
No |
No |
| AirlockDigitalServerActivities |
Airlock Digital connector (via Codeless Connector Framework) |
No |
No |
| AirlockDigitalServerActivities_CL |
Airlock Digital (Poll - SaaS)
Airlock Digital (Poll)
Airlock Digital (Push) |
No |
No |
| AIShield_CL |
AIShield |
No |
No |
| AkamaiSIEMEvent |
Akamai Security Events (via Codeless Connector Framework) |
No |
No |
| AlertEvidence |
Microsoft Defender XDR |
Yes |
Yes |
| alertscompromisedcredentialdata_CL |
Netskope Data Connector |
No |
No |
| alertsctepdata_CL |
Netskope Data Connector |
No |
No |
| alertsdlpdata_CL |
Netskope Data Connector |
No |
No |
| alertsmalsitedata_CL |
Netskope Data Connector |
No |
No |
| alertsmalwaredata_CL |
Netskope Data Connector |
No |
No |
| alertspolicydata_CL |
Netskope Data Connector |
No |
No |
| alertsquarantinedata_CL |
Netskope Data Connector |
No |
No |
| alertsremediationdata_CL |
Netskope Data Connector |
No |
No |
| alertssecurityassessmentdata_CL |
Netskope Data Connector |
No |
No |
| alertsubadata_CL |
Netskope Data Connector |
No |
No |
| AlibabaCloudVPCFlowLogs |
Alibaba Cloud Networking Data Connector (via Codeless Connector Framework) |
No |
No |
| AliCloud_CL |
AliCloud (using Azure Functions) |
No |
No |
| AliCloudActionTrailLogs_CL |
Alibaba Cloud ActionTrail (via Codeless Connector Framework) |
Yes |
Yes |
| Anvilogic_Alerts_CL |
Anvilogic |
Yes |
Yes |
| ApacheHTTPServer_CL |
Custom logs via AMA |
Yes |
Yes |
| apifirewall_log_1_CL |
API Protection |
No |
No |
| ARGOS_CL |
ARGOS Cloud Security |
No |
No |
| argsentdc_CL |
Check Point Cyberint Alerts Connector (via Codeless Connector Platform) |
Yes |
Yes |
| Armis_Activities_CL |
Armis Alerts Activities (using Azure Functions) |
Yes |
Yes |
| Armis_Alerts_CL |
Armis Alerts Activities (using Azure Functions) |
Yes |
Yes |
| Armis_Devices_CL |
Armis Devices (using Azure Functions) |
Yes |
Yes |
| ASimAuditEventLogs |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework)
Workday User Activity (via Codeless Connector Framework) |
Yes |
Yes |
| ASimDnsActivityLogs |
Windows DNS Events via AMA |
Yes |
Yes |
| ASimNetworkSessionLogs |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| ASimWebSessionLogs |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| AtlassianAuditEvents |
Atlassian Organization Audit Events (via Codeless Connector Framework) |
No |
No |
| Audit_CL |
Mimecast Audit |
Yes |
Yes |
| AuditLogs |
Microsoft Entra ID |
Yes |
Yes |
| Audits_Data_CL |
Vectra XDR (using Azure Functions) |
Yes |
Yes |
| Auth0AM_CL |
[DEPRECATED] Auth0 Logs (using Azure Function) (using Azure Functions) |
Yes |
Yes |
| Auth0Logs_CL |
Auth0 Logs (via Codeless Connector Framework) |
Yes |
Yes |
| Awareness_Performance_Details_CL |
Mimecast Awareness Training |
Yes |
Yes |
| Awareness_SafeScore_Details_CL |
Mimecast Awareness Training |
Yes |
Yes |
| Awareness_User_Data_CL |
Mimecast Awareness Training |
Yes |
Yes |
| Awareness_Watchlist_Details_CL |
Mimecast Awareness Training |
Yes |
Yes |
| AWSALBAccessLogsData |
Amazon Web Services Elastic Load Balancing (via Codeless Connector Framework) |
No |
No |
| AWSCloudFront_AccessLog_CL |
Amazon Web Services CloudFront (via Codeless Connector Framework) (Preview) |
Yes |
Yes |
| AWSCloudTrail |
Amazon Web Services S3
Amazon Web Services |
Yes |
Yes |
| AWSCloudWatch |
Amazon Web Services S3 |
Yes |
Yes |
| AWSEKSLogs_CL |
AWS EKS Data Connector (via Codeless Connector Framework) |
Yes |
Yes |
| AWSGuardDuty |
Amazon Web Services S3 |
Yes |
Yes |
| AWSNetworkFirewallFlow |
Amazon Web Services NetworkFirewall (via Codeless Connector Framework) |
Yes |
Yes |
| AWSRoute53Resolver |
Amazon Web Services S3 DNS Route53 (via Codeless Connector Framework) |
Yes |
Yes |
| AWSS3ServerAccess |
AWS S3 Server Access Logs (via Codeless Connector Framework) |
Yes |
Yes |
| AWSSecurityHubFindings |
AWS Security Hub Findings (via Codeless Connector Framework) |
Yes |
Yes |
| AWSVPCFlow |
Amazon Web Services S3 |
Yes |
Yes |
| AWSWAF |
Amazon Web Services S3 WAF |
Yes |
Yes |
| AZFWApplicationRule |
Azure Firewall |
Yes |
Yes |
| AZFWDnsQuery |
Azure Firewall |
Yes |
Yes |
| AZFWFatFlow |
Azure Firewall |
Yes |
Yes |
| AZFWFlowTrace |
Azure Firewall |
Yes |
Yes |
| AZFWIdpsSignature |
Azure Firewall |
Yes |
Yes |
| AZFWInternalFqdnResolutionFailure |
Azure Firewall |
Yes |
Yes |
| AZFWNatRule |
Azure Firewall |
Yes |
Yes |
| AZFWNetworkRule |
Azure Firewall |
Yes |
Yes |
| AZFWThreatIntel |
Azure Firewall |
Yes |
Yes |
| AzureActivity |
Azure Activity |
No |
No |
| AzureDiagnostics |
Azure Batch Account
Azure Cognitive Search
Azure DDoS Protection
Azure Event Hub
Azure Firewall
Azure Key Vault
Azure Kubernetes Service (AKS)
Azure Logic Apps
Azure SQL Databases
Azure Service Bus
Azure Stream Analytics
Azure Web Application Firewall (WAF)
Network Security Groups |
No |
No |
| AzureMetrics |
Azure Storage Account |
No |
No |
| BeyondTrustPM_ActivityAudits_CL |
BeyondTrust PM Cloud |
Yes |
Yes |
| BeyondTrustPM_ClientEvents_CL |
BeyondTrust PM Cloud |
Yes |
Yes |
| BHEAttackPathsData_CL |
BloodHound Enterprise Data Connector (using Azure Functions) |
No |
No |
| BHEAttackPathsTimelineData_CL |
BloodHound Enterprise Data Connector (using Azure Functions) |
No |
No |
| BHEAuditLogsData_CL |
BloodHound Enterprise Data Connector (using Azure Functions) |
No |
No |
| BHEFindingTrendsData_CL |
BloodHound Enterprise Data Connector (using Azure Functions) |
No |
No |
| BHEPostureHistoryData_CL |
BloodHound Enterprise Data Connector (using Azure Functions) |
No |
No |
| BHETierZeroAssetsData_CL |
BloodHound Enterprise Data Connector (using Azure Functions) |
No |
No |
| BigIDDSPMCatalog_CL |
BigID DSPM connector |
No |
No |
| BitglassLogs_CL |
Bitglass (using Azure Functions) |
No |
No |
| BitwardenEventLogs |
Bitwarden Event Logs |
No |
No |
| blacklens_CL |
blacklens.io |
Yes |
Yes |
| BoxEvents_CL |
[DEPRECATED] Box Events (using Azure Function) (using Azure Functions) |
No |
No |
| BoxEventsV2_CL |
Box Events (via Codeless Connector Framework) |
Yes |
Yes |
| BV_ClaudeCompliance_ComplianceActivities_CL |
BV-ClaudeCompliance (via Codeless Connector Framework) |
Yes |
Yes |
| CarbonBlack_Alerts_CL |
VMware Carbon Black Cloud via AWS S3 (via Codeless Connector Framework) |
Yes |
Yes |
| CarbonBlackAuditLogs_CL |
[DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) |
No |
No |
| CarbonBlackEvents_CL |
[DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) |
No |
No |
| CarbonBlackNotifications_CL |
[DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) |
No |
No |
| CatoNetworksEvents_CL |
Cato Networks Events (Push) |
Yes |
Yes |
| CayosoftThreatAlerts_CL |
Cayosoft Guardian Threat Alerts |
No |
No |
| CBSLog_AzureV2_CL |
CTM360 CyberBlindSpot (Serverless) |
Yes |
Yes |
| CheckPointEmailSecAntiPhishingExceptions |
Check Point Email Security (via Codeless Connector Framework) |
No |
No |
| CheckPointEmailSecurityAuditLogs_CL |
Check Point Email Security (via Codeless Connector Framework) |
Yes |
Yes |
| CheckPointEmailSecurityEvents_CL |
Check Point Email Security (via Codeless Connector Framework) |
Yes |
Yes |
| CheckPointEmailSecuritySpamExceptions |
Check Point Email Security (via Codeless Connector Framework) |
No |
No |
| Cisco_Umbrella_audit_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| Cisco_Umbrella_cloudfirewall_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_dlp_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| Cisco_Umbrella_dns_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_fileevent_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| Cisco_Umbrella_firewall_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_intrusion_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| Cisco_Umbrella_ip_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_proxy_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_ravpnlogs_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| Cisco_Umbrella_ztaflow_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| Cisco_Umbrella_ztna_CL |
Cisco Cloud Security (using Azure Functions)
Cisco Cloud Security (using elastic premium plan) (using Azure Functions) |
No |
No |
| CiscoETD_CL |
Cisco ETD |
No |
No |
| CiscoETDv2_CL |
Cisco Email Threat Defense (ETD) |
Yes |
Yes |
| CiscoMerakiAirMarshalEvents_CL |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoMerakiFileScannedEvents_CL |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoMerakiNetworkClients_CL |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoMerakiOrganizationNetworks_CL |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoMerakiOrganizations_CL |
Cisco Meraki Events (using REST API) (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoSDWANNetflow_CL |
Cisco Software Defined WAN |
No |
No |
| CiscoSecureEndpointAuditLogsV2_CL |
Cisco Secure Endpoint (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoSecureEndpointEventsV2_CL |
Cisco Secure Endpoint (via Codeless Connector Framework) |
Yes |
Yes |
| CiscoUmbrellaAdminAudit_CL |
Cisco Umbrella (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixAnalytics_CVAD_Events_V1_CL |
Citrix Analytics (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixAnalytics_indicatorEventDetails_V1_CL |
Citrix Analytics (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixAnalytics_indicatorSummary_V1_CL |
Citrix Analytics (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixAnalytics_riskScoreChange_V1_CL |
Citrix Analytics (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixAnalytics_SPA_Events_V1_CL |
Citrix Analytics (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixAnalytics_userProfile_V1_CL |
Citrix Analytics (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixDaaSConfigOps_CL |
Citrix DaaS Audit & Sessions (via Codeless Connector Framework) |
Yes |
Yes |
| CitrixDaaSSessions_CL |
Citrix DaaS Audit & Sessions (via Codeless Connector Framework) |
Yes |
Yes |
| Cloud_Integrated_CL |
Mimecast Cloud Integrated |
Yes |
Yes |
| CloudAppEvents |
Microsoft Defender XDR |
Yes |
Yes |
| Cloudflare_CL |
Cloudflare (Preview) (using Azure Functions) |
Yes |
Yes |
| CloudflareV2_CL |
Cloudflare (Using Blob Container) (via Codeless Connector Framework) |
Yes |
Yes |
| CloudGuard_SecurityEvents_CL |
Check Point CloudGuard CNAPP Connector for Microsoft Sentinel |
Yes |
Yes |
| CognniIncidents_CL |
Cognni |
Yes |
Yes |
| Cohesity_CL |
Cohesity (using Azure Functions) |
Yes |
Yes |
| CommonSecurityLog |
Cisco ASA/FTD via AMA
Claroty xDome
Infoblox Cloud Data Connector via AMA
Infoblox IQ for Threat Defense Insight Data Connector via AMA
Silverfort Admin Console
VirtualMetric DataStream for Microsoft Sentinel data lake
VirtualMetric DataStream for Microsoft Sentinel
VirtualMetric Director Proxy
Zscaler Internet Access Cloud NSS Audit Log Push Connector
Zscaler Internet Access Cloud NSS CASB Activity Log Push Connector
Zscaler Internet Access Cloud NSS CASB CRM Log Push Connector
Zscaler Internet Access Cloud NSS CASB Cloud Storage Log Push Connector
Zscaler Internet Access Cloud NSS CASB Collaboration Log Push Connector
Zscaler Internet Access Cloud NSS CASB Email Log Push Connector
Zscaler Internet Access Cloud NSS CASB File Sharing Log Push Connector
Zscaler Internet Access Cloud NSS CASB ITSM Log Push Connector
Zscaler Internet Access Cloud NSS CASB Repo Log Push Connector
Zscaler Internet Access Cloud NSS DNS Log Push Connector
Zscaler Internet Access Cloud NSS Email DLP Log Push Connector
Zscaler Internet Access Cloud NSS Endpoint DLP Log Push Connector
Zscaler Internet Access Cloud NSS Firewall Log Push Connector
Zscaler Internet Access Cloud NSS Tunnel Log Push Connector
Zscaler Internet Access Cloud NSS Web Log Push Connector |
Yes |
Yes |
| CommvaultAlerts_CL |
CommvaultSecurityIQ |
Yes |
Yes |
| CommvaultAlertsCCF_CL |
Commvault Security IQ (via Codeless Connector Framework) |
Yes |
Yes |
| ConfluenceAuditLogs |
Atlassian Confluence Audit (via Codeless Connector Framework) |
No |
No |
| ContraForceEvents_CL |
ContraForce Events |
No |
No |
| ContrastADRAttackEvents_CL |
Contrast ADR Push Connector |
Yes |
Yes |
| ContrastADRIncidents_CL |
Contrast ADR Push Connector |
Yes |
Yes |
| CopilotActivity |
Microsoft Copilot |
No |
Yes |
| Corelight |
Corelight Connector Exporter |
No |
No |
| CortexXDR_Incidents_CL |
Cortex XDR - Incidents |
Yes |
Yes |
| CortexXpanseAlerts_CL |
Palo Alto Cortex Xpanse (via Codeless Connector Framework) |
Yes |
Yes |
| CriblInternal_CL |
Cribl |
No |
No |
| CrowdStrike_Additional_Events_CL |
CrowdStrike Falcon Data Replicator (User Managed AWS-S3) (via Codeless Connector Framework) |
Yes |
Yes |
| CrowdStrikeAlertsV2_CL |
CrowdStrike API Data Connector (via Codeless Connector Framework) |
Yes |
Yes |
| CrowdStrikeReplicatorV2 |
CrowdStrike Falcon Data Replicator (CrowdStrike Managed AWS-S3) (using Azure Functions) |
No |
No |
| CyberArk_AuditEvents_CL |
Idira Audit |
Yes |
Yes |
| CyberArkEPM_Events_CL |
Idira EPM (using Azure Functions)
Idira EPM |
Yes |
Yes |
| CyberpionActionItems_CL |
IONIX Security Logs (via Codeless Connector Framework)
[DEPRECATED] IONIX Security Logs (Push) |
Yes |
Yes |
| CyberSixgill_Alerts_CL |
Cybersixgill Actionable Alerts (using Azure Functions) |
No |
No |
| CybleVisionAlerts_CL |
Cyble Vision Alerts |
No |
No |
| CyeraAssets_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
No |
No |
| CyeraAssets_MS_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
No |
No |
| CyeraClassifications_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
No |
No |
| CyeraIdentities_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
No |
No |
| CyeraIssues_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
No |
No |
| CyfirmaASCertificatesAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASCloudWeaknessAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASConfigurationAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASDomainIPReputationAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASDomainIPVulnerabilityAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASOpenPortsAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaBIDomainITAssetAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBIExecutivePeopleAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBIMaliciousMobileAppsAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBIProductSolutionAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBISocialHandlersAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaCampaigns_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaCompromisedAccounts_CL |
CYFIRMA Compromised Accounts |
Yes |
Yes |
| CyfirmaDBWMDarkWebAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaDBWMPhishingAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaDBWMRansomwareAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaIndicators_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaMalware_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaSPEConfidentialFilesAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaSPEPIIAndCIIAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaSPESocialThreatAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaSPESourceCodeAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaThreatActors_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaVulnerabilities_CL |
CYFIRMA Vulnerabilities Intelligence |
Yes |
Yes |
| Cymru_Scout_Account_Usage_Data_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_Domain_Data_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Communications_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Details_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Fingerprints_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Foundation_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_OpenPorts_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_PDNS_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Summary_Certs_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Summary_Details_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Summary_Fingerprints_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Summary_OpenPorts_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_Summary_PDNS_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| Cymru_Scout_IP_Data_x509_CL |
Team Cymru Scout Data Connector (using Azure Functions) |
No |
No |
| CynerioEvent_CL |
Cynerio Security Events |
No |
No |
| Cyren_Indicators_CL |
Cyren Threat Intelligence |
No |
No |
| D3SOARIncidents_CL |
D3 Smart SOAR Incidents |
No |
No |
| darktrace_model_alerts_CL |
Darktrace Connector for Microsoft Sentinel REST API (Legacy) |
Yes |
Yes |
| DarktraceASM_CL |
Darktrace ActiveAI Security Platform Connector |
Yes |
Yes |
| DarktraceEMAIL_CL |
Darktrace ActiveAI Security Platform Connector |
Yes |
Yes |
| DarktraceIncidents_CL |
Darktrace ActiveAI Security Platform Connector |
Yes |
Yes |
| DarktraceModelAlerts_CL |
Darktrace ActiveAI Security Platform Connector |
Yes |
Yes |
| DarktraceResponseActions_CL |
Darktrace ActiveAI Security Platform Connector |
Yes |
Yes |
| DarktraceSystemStatusAlerts_CL |
Darktrace ActiveAI Security Platform Connector |
Yes |
Yes |
| databahn_alerts_CL |
DataBahn |
No |
No |
| databahn_audit_logs_CL |
DataBahn |
No |
No |
| databahn_device_inventory_CL |
DataBahn |
No |
No |
| DataminrPulse_Alerts_CL |
Dataminr Pulse Alerts Data Connector (using Azure Functions) |
No |
No |
| DataverseActivity |
Microsoft Dataverse |
Yes |
Yes |
| datawizaserveraccess_CL |
Datawiza DAP |
No |
No |
| DelineaAuditEvents_CL |
Delinea Platform Audit Events |
No |
No |
| Detections_Data_CCF_CL |
Vectra RUX Security Data Connector (via Codeless Connector Framework) |
Yes |
Yes |
| Detections_Data_CL |
Vectra XDR (using Azure Functions) |
Yes |
Yes |
| DeviceEvents |
Microsoft Defender XDR |
Yes |
Yes |
| DigitalShadows_V2_CL |
Digital Shadows Searchlight |
Yes |
Yes |
| DnsEvents |
DNS |
Yes |
Yes |
| DnsInventory |
DNS |
Yes |
Yes |
| DomainToolsThreatIntelDomains_CL |
DomainTools Threat Intelligence Domain Feed |
No |
No |
| DoppelTable_CL |
Doppel Data Connector |
No |
No |
| dossier_atp_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_atp_threat_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_dns_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_geo_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_infoblox_web_cat_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_inforank_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_malware_analysis_v3_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_nameserver_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_nameserver_matches_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_ptr_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_rpz_feeds_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_rpz_feeds_records_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_threat_actor_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_tld_risk_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_whitelist_CL |
Infoblox Data Connector via REST API |
No |
No |
| dossier_whois_CL |
Infoblox Data Connector via REST API |
No |
No |
| DragonCopilot |
Dragon Copilot |
Yes |
Yes |
| DragosAlerts_CL |
Dragos Notifications via Cloud Sitestore |
Yes |
Yes |
| DruvaSecurityEvents_CL |
Druva Events Connector |
Yes |
Yes |
| DuoActivity_CL |
Cisco Duo Activity Logs |
Yes |
Yes |
| DuoAuthentication_CL |
Cisco Duo Authentication |
Yes |
Yes |
| DuoTelephony_CL |
Cisco Duo Telephony Logs |
Yes |
Yes |
| Dynamics365Activity |
Dynamics365 |
Yes |
No |
| DynatraceAttacks_CL |
[Deprecated] Dynatrace Attacks V1 |
No |
No |
| DynatraceAttacksV2_CL |
Dynatrace Attacks V2 |
No |
No |
| DynatraceAttacksV3_CL |
Dynatrace Attacks V3 |
No |
No |
| DynatraceAuditLogs_CL |
[Deprecated] Dynatrace Audit Logs V1 |
Yes |
Yes |
| DynatraceAuditLogsV2_CL |
Dynatrace Audit Logs V2 |
No |
No |
| DynatraceAuditLogsV3_CL |
Dynatrace Audit Logs V3 |
No |
No |
| DynatraceProblems_CL |
[Deprecated] Dynatrace Problems V1 |
No |
No |
| DynatraceProblemsV2_CL |
Dynatrace Problems V2 |
Yes |
Yes |
| DynatraceProblemsV3_CL |
Dynatrace Problems V3 |
No |
No |
| DynatraceSecurityProblems_CL |
[Deprecated] Dynatrace Runtime Vulnerabilities V1 |
No |
No |
| DynatraceSecurityProblemsV2_CL |
Dynatrace Runtime Vulnerabilities V2 |
No |
No |
| DynatraceSecurityProblemsV3_CL |
Dynatrace Runtime Vulnerabilities V3 |
No |
No |
| EgressDefend_CL |
Egress Defend |
Yes |
Yes |
| EgressDefend_v4_CL |
Egress Defend v2 |
No |
No |
| ElasticAgentEvent |
Elastic Agent |
No |
No |
| ElasticAgentLogsV2_CL |
Elastic Agent (via Codeless Connector Framework) |
No |
No |
| EmailEvents |
Microsoft Defender XDR |
Yes |
Yes |
| emiocintel_CL |
Check Point EM ThreatCloud Intelligence Feed Connector |
Yes |
Yes |
| Entities_Data_CL |
Vectra XDR (using Azure Functions) |
Yes |
Yes |
| Entity_Scoring_Data_CL |
Vectra XDR (using Azure Functions) |
Yes |
Yes |
| ErmesBrowserSecurityEvents_CL |
Ermes Browser Security Events |
Yes |
Yes |
| ESIExchangeConfig_CL |
Exchange Security Insights On-Premises Collector |
No |
No |
| ESIExchangeOnlineConfig_CL |
Exchange Security Insights Online Collector (using Azure Functions) |
Yes |
Yes |
| Event |
Automated Logic WebCTRL
Microsoft Exchange Admin Audit Logs by Event Logs
Microsoft Exchange Logs and Events
[Deprecated] Microsoft Exchange Logs and Events |
Yes |
No |
| eventsapplicationdata_CL |
Netskope Data Connector |
No |
No |
| eventsauditdata_CL |
Netskope Data Connector |
No |
No |
| eventsconnectiondata_CL |
Netskope Data Connector |
No |
No |
| eventsincidentdata_CL |
Netskope Data Connector |
No |
No |
| eventsnetworkdata_CL |
Netskope Data Connector |
No |
No |
| eventspagedata_CL |
Netskope Data Connector |
No |
No |
| ExchangeHttpProxy_CL |
Microsoft Exchange HTTP Proxy Logs
[Deprecated] Microsoft Exchange Logs and Events |
Yes |
Yes |
| ExtraHop_Detections_CL |
ExtraHop Detections Data Connector |
Yes |
Yes |
| F5Telemetry_ASM_CL |
F5 BIG-IP |
No |
No |
| F5Telemetry_LTM_CL |
F5 BIG-IP |
Yes |
Yes |
| F5Telemetry_system_CL |
F5 BIG-IP |
Yes |
Yes |
| FCRisks_CL |
FireCompass Risks |
No |
No |
| FilewallExchange_CL |
Filewall for Microsoft 365 |
Yes |
Yes |
| FinanceOperationsActivity_CL |
Dynamics 365 Finance and Operations |
Yes |
Yes |
| FireworkV2_CL |
Flare Push Connector |
Yes |
Yes |
| fluentbit_CL |
Azure CloudNGFW By Palo Alto Networks |
Yes |
Yes |
| ForcepointDLPEvents_CL |
Forcepoint DLP |
No |
No |
| ForescoutEvent |
Forescout |
No |
No |
| FortinetFortiNdrCloudRaw_CL |
Fortinet FortiNDR Cloud |
No |
No |
| FortyTwoCrunchAPIProtectionV2 |
42Crunch API Protection (Push Connector via Codeless Connector Framework) |
No |
No |
| GambitPoliciesIssues_CL |
Gambit Security Policy Issues (Push) |
No |
No |
| Garrison_ULTRARemoteLogs_CL |
Garrison ULTRA Remote Logs (using Azure Functions) |
No |
No |
| GCPApigee |
Google ApigeeX (via Codeless Connector Framework) |
Yes |
Yes |
| GCPAuditLogs |
GCP Pub/Sub Audit Logs |
Yes |
Yes |
| GCPCDN |
Google Cloud Platform CDN (via Codeless Connector Framework) |
Yes |
Yes |
| GCPCloudRun |
GCP Cloud Run (via Codeless Connector Framework) |
Yes |
Yes |
| GCPCloudSQL |
GCP Cloud SQL (via Codeless Connector Framework) |
Yes |
Yes |
| GCPComputeEngine |
Google Cloud Platform Compute Engine (via Codeless Connector Framework) |
Yes |
Yes |
| GCPDNS |
Google Cloud Platform DNS (via Codeless Connector Framework) |
Yes |
Yes |
| GCPIAM |
Google Cloud Platform IAM (via Codeless Connector Framework) |
Yes |
Yes |
| GCPIDS |
Google Cloud Platform Cloud IDS (via Codeless Connector Framework) |
Yes |
Yes |
| GCPLoadBalancerLogs_CL |
GCP Pub/Sub Load Balancer Logs (via Codeless Connector Platform). |
Yes |
Yes |
| GCPMonitoring |
Google Cloud Platform Cloud Monitoring (via Codeless Connector Framework) |
Yes |
Yes |
| GCPNAT |
Google Cloud Platform NAT (via Codeless Connector Framework) |
Yes |
Yes |
| GCPNATAudit |
Google Cloud Platform NAT (via Codeless Connector Framework) |
Yes |
Yes |
| GCPResourceManager |
Google Cloud Platform Resource Manager (via Codeless Connector Framework) |
Yes |
Yes |
| GCPVPCFlow |
GCP Pub/Sub VPC Flow Logs (via Codeless Connector Framework) |
Yes |
Yes |
| GigamonV2_CL |
Gigamon AMX Connector |
No |
No |
| GitHubAdvancedSecurityAlerts_CL |
GitHub (using Webhooks) V2 |
Yes |
Yes |
| GitHubAuditLogPolling_CL |
[Deprecated] GitHub Enterprise Audit Log |
Yes |
Yes |
| GitHubAuditLogsV2_CL |
GitHub Enterprise Audit Log (via Codeless Connector Framework) |
Yes |
Yes |
| GitHubAuditLogsV3_CL |
GitHub Enterprise Audit Log (via Azure Storage) |
Yes |
Yes |
| githubscanaudit_CL |
GitHub (using Webhooks) |
Yes |
Yes |
| GKEAudit |
Google Kubernetes Engine (via Codeless Connector Framework) |
Yes |
Yes |
| GoogleWorkspaceReports |
Google Workspace Activities (via Codeless Connector Framework) |
Yes |
Yes |
| GTI_Vulnerabilities_CL |
Google Threat Intelligence Vulnerabilities (CCF) |
Yes |
Yes |
| GuardicoreAgents_CL |
Akamai Guardicore |
No |
No |
| GuardicoreApplications_CL |
Akamai Guardicore |
No |
No |
| GuardicoreAssets_CL |
Akamai Guardicore |
No |
No |
| GuardicorePolicyRules_CL |
Akamai Guardicore |
No |
No |
| GzSecurityEvents_CL |
GravityZone Data Connector |
Yes |
Yes |
| HackerViewLog_AzureV2_CL |
CTM360 HackerView (Serverless) |
Yes |
Yes |
| HalcyonAlertUpdatesV2_CL |
Halcyon Connector (v2) |
Yes |
Yes |
| HalcyonEventsV2_CL |
Halcyon Connector (v2) |
Yes |
Yes |
| Health_Data_CL |
Vectra XDR (using Azure Functions) |
Yes |
Yes |
| IdentityLogonEvents |
Microsoft Defender XDR |
Yes |
Yes |
| Illumio_Auditable_Events_CL |
Illumio SaaS (using Azure Functions) |
Yes |
Yes |
| Illumio_Flow_Events_CL |
Illumio SaaS (using Azure Functions) |
Yes |
Yes |
| IllumioInsights_CL |
Illumio Insights |
Yes |
Yes |
| IllumioInsightsGraph |
Illumio Insights Graph |
No |
No |
| IllumioInsightsSummary_CL |
Illumio Insights Summary |
No |
No |
| ImpervaWAFCloud |
Imperva Cloud WAF (via Codeless Connector Framework) |
No |
No |
| ImpervaWAFCloud_CL |
Imperva Cloud WAF (using Azure Functions) |
Yes |
Yes |
| InfobloxInsight_CL |
Infoblox IQ for Threat Defense Insight Data Connector via REST API |
No |
No |
| InfoSecAnalytics_CL |
InfoSecGlobal Data Connector |
No |
No |
| IntegrationTable_CL |
ESET Protect Platform (using Azure Functions) |
Yes |
Yes |
| IntegrationTableIncidents_CL |
ESET Protect Platform (using Azure Functions) |
Yes |
Yes |
| iocsent_CL |
Check Point Cyberint IOC Connector |
Yes |
Yes |
| Ipinfo_Abuse_CL |
IPinfo Abuse Data Connector |
No |
No |
| Ipinfo_ASN_CL |
IPinfo ASN Data Connector |
No |
No |
| Ipinfo_Carrier_CL |
IPinfo Carrier Data Connector |
No |
No |
| Ipinfo_Company_CL |
IPinfo Company Data Connector |
No |
No |
| Ipinfo_CORE_CL |
IPinfo Core Data Connector |
No |
No |
| Ipinfo_Country_CL |
IPinfo Country ASN Data Connector |
No |
No |
| Ipinfo_Domain_CL |
IPinfo Domain Data Connector |
No |
No |
| Ipinfo_Location_CL |
IPinfo Iplocation Data Connector |
No |
No |
| Ipinfo_Location_extended_CL |
IPinfo Iplocation Extended Data Connector |
No |
No |
| Ipinfo_PLUS_CL |
IPinfo Plus Data Connector |
No |
No |
| Ipinfo_Privacy_CL |
IPinfo Privacy Data Connector |
No |
No |
| Ipinfo_Privacy_extended_CL |
IPinfo Privacy Extended Data Connector |
No |
No |
| Ipinfo_RESIDENTIAL_PROXY_CL |
IPinfo ResProxy Data Connector |
No |
No |
| Ipinfo_RIRWHOIS_CL |
IPinfo RIRWHOIS Data Connector |
No |
No |
| Ipinfo_RWHOIS_CL |
IPinfo RWHOIS Data Connector |
No |
No |
| Ipinfo_WHOIS_ASN_CL |
IPinfo WHOIS ASN Data Connector |
No |
No |
| Ipinfo_WHOIS_MNT_CL |
IPinfo WHOIS MNT Data Connector |
No |
No |
| Ipinfo_WHOIS_NET_CL |
IPinfo WHOIS NET Data Connector |
No |
No |
| Ipinfo_WHOIS_ORG_CL |
IPinfo WHOIS ORG Data Connector |
No |
No |
| Ipinfo_WHOIS_POC_CL |
IPinfo WHOIS POC Data Connector |
No |
No |
| Island_Admin_CL |
Island Enterprise Browser Admin Events (Legacy) |
Yes |
Yes |
| Island_User_CL |
Island Enterprise Browser User Events (Legacy) |
Yes |
Yes |
| Island_UserEvents_V2_CL |
Island Enterprise Browser V2 |
Yes |
Yes |
| jamfprotectalerts_CL |
Jamf Protect Push Connector |
Yes |
Yes |
| jamfprotecttelemetryv2_CL |
Jamf Protect Push Connector |
Yes |
Yes |
| jamfprotectunifiedlogs_CL |
Jamf Protect Push Connector |
Yes |
Yes |
| JBossEvent_CL |
Custom logs via AMA |
No |
No |
| Jira_Audit_CL |
[DEPRECATED] Atlassian Jira Audit (using Azure Function) (using Azure Functions) |
Yes |
Yes |
| Jira_Audit_v2_CL |
Atlassian Jira Audit (via Codeless Connector Framework) |
Yes |
Yes |
| JuniperIDP_CL |
Custom logs via AMA |
Yes |
Yes |
| KeeperSecurityEventNewLogs_CL |
Keeper Security Push Connector |
Yes |
Yes |
| LastPassNativePoller_CL |
LastPass Enterprise - Reporting (Polling CCP) |
Yes |
Yes |
| LightningAttackPathLinksV2_CL |
Semperis Lightning (via Codeless Connector Framework) |
No |
No |
| LightningAttackPaths_CL |
Semperis Lightning Logs |
No |
No |
| LightningAttackPathsV2_CL |
Semperis Lightning (via Codeless Connector Framework) |
No |
No |
| LightningIndicatorExecutionsV2_CL |
Semperis Lightning (via Codeless Connector Framework) |
No |
No |
| LightningIOEResults_CL |
Semperis Lightning Logs |
No |
No |
| LightningIOEsMetadataV2_CL |
Semperis Lightning (via Codeless Connector Framework) |
No |
No |
| LightningTier0AttackersV2_CL |
Semperis Lightning (via Codeless Connector Framework) |
No |
No |
| LightningTier0Nodes_CL |
Semperis Lightning Logs |
No |
No |
| LightningTier0NodesV2_CL |
Semperis Lightning (via Codeless Connector Framework) |
No |
No |
| Lockdown_Data_CL |
Vectra XDR (using Azure Functions) |
Yes |
Yes |
| Lookout_CL |
[DEPRECATED] Lookout |
No |
No |
| LookoutMtdV2_CL |
Lookout Mobile Threat Detection Connector (via Codeless Connector Framework) (Preview) |
Yes |
Yes |
| MailGuard365_Threats_CL |
MailGuard 365 |
Yes |
Yes |
| MailRiskEventEmails_CL |
MailRisk by Secure Practice |
Yes |
Yes |
| MarkLogicAudit_CL |
Custom logs via AMA |
No |
No |
| McasShadowItReporting |
Microsoft Defender for Cloud Apps |
No |
No |
| MDBALogTable_CL |
MongoDB Atlas Logs |
Yes |
Yes |
| meraki_CL |
Custom logs via AMA |
Yes |
Yes |
| meshStackEventLogs_CL |
meshStack Event Logs |
No |
No |
| MessageTrackingLog_CL |
Microsoft Exchange Message Tracking Logs
[Deprecated] Microsoft Exchange Logs and Events |
Yes |
Yes |
| MicrosoftPurviewInformationProtection |
Microsoft Purview Information Protection |
Yes |
Yes |
| MimecastAudit_CL |
Mimecast Audit & Authentication (using Azure Functions) |
No |
No |
| MimecastDLP_CL |
Mimecast Secure Email Gateway (using Azure Functions) |
No |
No |
| MimecastSIEM_CL |
Mimecast Secure Email Gateway (using Azure Functions) |
No |
No |
| MimecastTTPAttachment_CL |
Mimecast Targeted Threat Protection (using Azure Functions) |
No |
No |
| MimecastTTPImpersonation_CL |
Mimecast Targeted Threat Protection (using Azure Functions) |
No |
No |
| MimecastTTPUrl_CL |
Mimecast Targeted Threat Protection (using Azure Functions) |
No |
No |
| MongoDBAudit_CL |
Custom logs via AMA |
Yes |
Yes |
| MuleSoft_Cloudhub_CL |
MuleSoft Cloudhub |
No |
No |
| MulesoftCloudhubAlerts_CL |
Mulesoft CloudHub Alerts Connector (via Codeless Connector Framework) |
Yes |
Yes |
| MuleSoftCloudhubLogs |
MuleSoft CloudHub Logs (Push Connector via Codeless Connector Framework) |
No |
No |
| NCProtectUAL_CL |
NC Protect |
No |
No |
| NetcraftTakedown_CL |
Netcraft Integration Gateway |
Yes |
Yes |
| Netskope_WebTx_metrics_CL |
Netskope Data Connector |
No |
No |
| NetskopeAISecOps_CL |
Netskope AI SecOps |
No |
No |
| NetskopeAlerts_CL |
Netskope Alerts and Events |
Yes |
Yes |
| NetskopeClientStatus_CL |
Netskope Client Status |
No |
No |
| NetskopeWebTransactions_CL |
Netskope Web Transactions (via Blob Storage) |
Yes |
Yes |
| NetskopeWebtxData_CL |
[DEPRECATED] Netskope Web Transactions Data Connector (using Azure Function) |
No |
No |
| NetskopeWebtxErrors_CL |
[DEPRECATED] Netskope Web Transactions Data Connector (using Azure Function) |
No |
No |
| NetworkAccessTraffic |
Microsoft Entra ID |
Yes |
Yes |
| NexposeInsightVMCloud_assets_CL |
Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) |
Yes |
Yes |
| NexposeInsightVMCloud_vulnerabilities_CL |
Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) |
Yes |
Yes |
| NGINX_CL |
Custom logs via AMA |
Yes |
Yes |
| NordPassEventLogs_CL |
NordPass |
Yes |
Yes |
| NordStellar_CL |
NordStellar (Push) |
Yes |
Yes |
| ObsidianActivity_CL |
Obsidian Datasharing Connector |
No |
No |
| ObsidianThreat_CL |
Obsidian Datasharing Connector |
No |
No |
| OCI_LogsV2_CL |
Oracle Cloud Infrastructure (via Codeless Connector Framework) |
Yes |
Yes |
| OfficeActivity |
Microsoft 365 (formerly, Office 365) |
Yes |
Yes |
| OktaSSO |
Okta Single Sign-On (via Codeless Connector Framework) |
No |
No |
| Onapsis_Defend_CL |
Onapsis Defend: Integrate Unmatched SAP Threat Detection & Intel with Microsoft Sentinel |
Yes |
Yes |
| OneLoginEventsV2_CL |
OneLogin IAM Platform (via Codeless Connector Framework) |
Yes |
Yes |
| OneLoginUsersV2_CL |
OneLogin IAM Platform (via Codeless Connector Framework) |
Yes |
Yes |
| OnePasswordEventLogs_CL |
1Password (Serverless)
1Password |
Yes |
Yes |
| OneTrustMetadataV3_CL |
OneTrust |
Yes |
Yes |
| OpenAIAuditLogs |
OpenAI (via Codeless Connector Framework) |
No |
No |
| OracleWebLogicServer_CL |
Custom logs via AMA |
Yes |
Yes |
| OrcaAlerts_CL |
Orca Security Alerts (via Microsoft Entra ID)
Orca Security Alerts |
Yes |
Yes |
| PaloAltoCortexXDR_Alerts_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Audit_Agent_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Audit_Management_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Endpoints_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Incidents_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoPrismaCloudAlertV2_CL |
Palo Alto Prisma Cloud CSPM (via Codeless Connector Framework) |
Yes |
Yes |
| PanoraysCompanyFindingPOC_CL |
Panorays |
Yes |
Yes |
| Perimeter81_CL |
Perimeter 81 Activity Logs |
No |
No |
| Phosphorus_CL |
Phosphorus Devices |
No |
No |
| PingOne_AuditActivitiesV2_CL |
Ping One (via Codeless Connector Framework) |
Yes |
Yes |
| PostgreSQL_CL |
Custom logs via AMA |
Yes |
Yes |
| PowerAutomateActivity |
Microsoft Power Automate |
Yes |
Yes |
| PowerBIActivity |
Microsoft PowerBI |
Yes |
Yes |
| PowerPlatformAdminActivity |
Microsoft Power Platform Admin Activity |
Yes |
Yes |
| prancer_CL |
Prancer Data Connector |
No |
No |
| PrismaCloudCompute_CL |
Palo Alto Prisma Cloud CWPP (using REST API) |
Yes |
Yes |
| PRODAFTUstaCompromisedCards_CL |
PRODAFT USTA - Payment Card Fraud Intelligence (via Codeless Connector Framework) |
Yes |
Yes |
| PRODAFTUstaCompromisedCredentials_CL |
PRODAFT USTA - Account Takeover Prevention (via Codeless Connector Framework) |
Yes |
Yes |
| ProjectActivity |
Microsoft Project |
Yes |
Yes |
| ProofpointPODMailLog_CL |
Proofpoint On Demand Email Security (via Codeless Connector Platform) |
Yes |
Yes |
| ProofpointPODMessage_CL |
Proofpoint On Demand Email Security (via Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPClicksBlockedV2_CL |
Proofpoint TAP (via Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPClicksPermittedV2_CL |
Proofpoint TAP (via Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPMessagesBlockedV2_CL |
Proofpoint TAP (via Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPMessagesDeliveredV2_CL |
Proofpoint TAP (via Codeless Connector Platform) |
Yes |
Yes |
| PulumiAuditLogs_CL |
Pulumi Cloud Audit Logs |
No |
No |
| PurviewDataSensitivityLogs |
Microsoft Purview |
Yes |
Yes |
| QscoutAppEvents_CL |
QscoutAppEventsConnector (via Codeless Connector Framework) |
No |
No |
| QualysHostDetectionV3_CL |
Qualys Vulnerability Management (via Codeless Connector Framework) |
Yes |
Yes |
| QualysKB_CL |
Qualys VM KnowledgeBase (using Azure Functions) |
Yes |
Yes |
| QualysKnowledgeBase |
Qualys Knowledge Base (via Codeless Connector Framework) |
Yes |
Yes |
| RadiflowEvent |
Radiflow iSID via AMA |
No |
No |
| Rapid7InsightVMCloudAssets |
Rapid7 Insight Platform Vulnerability Management Reports (via Codeless Connector Framework) |
Yes |
Yes |
| Rapid7InsightVMCloudVulnerabilities |
Rapid7 Insight Platform Vulnerability Management Reports (via Codeless Connector Framework) |
Yes |
Yes |
| RecordedFutureClassicAlerts_V2_CL |
Recorded Future - Log Ingestion |
Yes |
Yes |
| RecordedFuturePlaybookAlerts_V2_CL |
Recorded Future - Log Ingestion |
Yes |
Yes |
| RecordedFutureSandboxResults_V2_CL |
Recorded Future - Log Ingestion |
Yes |
Yes |
| RecordedFutureThreatMap_V2_CL |
Recorded Future - Log Ingestion |
Yes |
Yes |
| RecordedFutureThreatMapMalware_V2_CL |
Recorded Future - Log Ingestion |
Yes |
Yes |
| RedSiftAuth_CL |
Red Sift Events (CCP Push) |
No |
No |
| RedSiftEmailForensics_CL |
Red Sift Events (CCP Push) |
No |
No |
| RelevanceSystemAlerts_CL |
Google Threat Intelligence Relevance System Alerts |
Yes |
Yes |
| RFI_PlaybookAlertResults_V2_CL |
Recorded Future Identity - Playbook Alert Importer |
Yes |
Yes |
| RSAIDPlus_AdminLogs_CL |
RSA ID Plus Admin Logs Connector |
No |
No |
| Rubrik_Anomaly_Data_CL |
Rubrik Security Cloud Security Events (Push)
Rubrik Security Cloud data connector (using Azure Functions) |
Yes |
Yes |
| Rubrik_Events_Data_CL |
Rubrik Security Cloud Security Events (Push)
Rubrik Security Cloud data connector (using Azure Functions) |
Yes |
Yes |
| Rubrik_Ransomware_Data_CL |
Rubrik Security Cloud Security Events (Push)
Rubrik Security Cloud data connector (using Azure Functions) |
Yes |
Yes |
| Rubrik_ThreatHunt_Data_CL |
Rubrik Security Cloud Security Events (Push)
Rubrik Security Cloud data connector (using Azure Functions) |
Yes |
Yes |
| RubrikProtectionStatus_CL |
Rubrik Security Cloud Protection Status (using Codeless Connector Framework) |
Yes |
Yes |
| SailPointISC_Events_CL |
SailPoint Identity Security Cloud (via Codeless Connector Framework) |
Yes |
Yes |
| SalesforceAuditTrailV2_CL |
Salesforce Audit Logs (via Codeless Connector Framework) |
Yes |
Yes |
| SalesforceMarketingCloudAuditEvents |
Salesforce Marketing Cloud (via Codeless Connector Framework) |
No |
No |
| SalesForceRealTimeEventMonitoring_CL |
SalesForce Real-Time Event Monitoring Connector (via Codeless Connector Framework) |
Yes |
Yes |
| SalesforceServiceCloudV3_CL |
Salesforce Service Cloud (via Codeless Connector Framework) |
Yes |
Yes |
| Samsung_Knox_Audit_CL |
Samsung Knox Asset Intelligence |
Yes |
Yes |
| SAPBTPAuditLog_CL |
SAP BTP |
Yes |
Yes |
| SAPBTPAVL_CL |
Application Vulnerability Report for SAP BTP |
Yes |
Yes |
| SAPETDAlerts_CL |
SAP Enterprise Threat Detection, cloud edition |
Yes |
Yes |
| SAPETDInvestigations_CL |
SAP Enterprise Threat Detection, cloud edition |
Yes |
Yes |
| SAPLogServ_CL |
SAP LogServ (RISE), S/4HANA Cloud private edition |
Yes |
Yes |
| SecurityAlert |
Microsoft 365 Insider Risk Management
Microsoft Defender XDR
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft Defender for IoT
Microsoft Defender for Office 365 (Preview)
Microsoft Entra ID Protection
Subscription-based Microsoft Defender for Cloud (Legacy)
Tenant-based Microsoft Defender for Cloud |
Yes |
Yes |
| SecurityAlert |
Microsoft Defender for Cloud Apps |
No |
No |
| SecurityBridgeLogs_CL |
Custom logs via AMA |
Yes |
Yes |
| SecurityEvent |
Cyborg Security HUNTER Hunt Packages
Microsoft Active-Directory Domain Controllers Security Event Logs
Security Events via Legacy Agent
Windows Security Events via AMA
[Deprecated] Microsoft Exchange Logs and Events |
Yes |
Yes |
| SecurityIncident |
Derdack SIGNL4
Microsoft Defender XDR |
Yes |
Yes |
| SecurityScorecardFactor_CL |
[DEPRECATED] SecurityScorecard Factor (using Azure Functions) |
No |
No |
| SecurityScorecardFactorHistory_CL |
SecurityScorecard Factors (via Codeless Connector Framework) |
No |
No |
| SecurityScorecardIssues_CL |
[DEPRECATED] SecurityScorecard Issue (using Azure Functions) |
No |
No |
| SecurityScorecardIssuesHistory_CL |
SecurityScorecard Issues (via Codeless Connector Framework) |
No |
No |
| SecurityScorecardRatings_CL |
[DEPRECATED] SecurityScorecard Cybersecurity Ratings (using Azure Functions) |
No |
No |
| SecurityScorecardRatingsHistory_CL |
SecurityScorecard Ratings (via Codeless Connector Framework) |
No |
No |
| Seg_Cg_CL |
Mimecast Secure Email Gateway |
Yes |
Yes |
| Seg_Dlp_CL |
Mimecast Secure Email Gateway |
Yes |
Yes |
| SentinelOneActivities_CL |
SentinelOne (via Codeless Connector Framework)
SentinelOne V2 (via Codeless Connector Framework) |
Yes |
Yes |
| SentinelOneAgents_CL |
SentinelOne (via Codeless Connector Framework)
SentinelOne V2 (via Codeless Connector Framework) |
Yes |
Yes |
| SentinelOneAlerts_CL |
SentinelOne (via Codeless Connector Framework) |
Yes |
Yes |
| SentinelOneAlertsV2_CL |
SentinelOne V2 (via Codeless Connector Framework) |
Yes |
Yes |
| SentinelOneGroups_CL |
SentinelOne (via Codeless Connector Framework)
SentinelOne V2 (via Codeless Connector Framework) |
Yes |
Yes |
| SentinelOneThreats_CL |
SentinelOne (via Codeless Connector Framework)
SentinelOne V2 (via Codeless Connector Framework) |
Yes |
Yes |
| SeraphicWebSecurity_CL |
Seraphic Web Security |
No |
No |
| ServiceNowAlmAsset |
ServiceNow CMDB (via Codeless Connector Framework) |
No |
No |
| ServiceNowCmdbCi |
ServiceNow CMDB (via Codeless Connector Framework) |
No |
No |
| ServiceNowCmdbCiComputer |
ServiceNow CMDB (via Codeless Connector Framework) |
No |
No |
| ServiceNowCmdbCiServer |
ServiceNow CMDB (via Codeless Connector Framework) |
No |
No |
| ServiceNowCmdbRelCi |
ServiceNow CMDB (via Codeless Connector Framework) |
No |
No |
| SigninLogs |
Microsoft Entra ID |
Yes |
Yes |
| SlackAuditV2_CL |
SlackAudit (via Codeless Connector Framework) |
Yes |
Yes |
| SLP_Feeds_CL |
SilentPush Feeds |
No |
No |
| SnowflakeLoadV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeLoginV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeMaterializedViewV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeQueryV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeRoleGrantV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeRolesV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeTableStorageMetricsV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeTablesV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeUserGrantV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SnowflakeUsersV3_CL |
Snowflake (via Codeless Connector Framework) |
No |
No |
| SOCPrimeAuditLogs_CL |
SOC Prime Platform Audit Logs Data Connector |
Yes |
Yes |
| Sonrai_Tickets_CL |
Sonrai Data Connector |
No |
No |
| SophosEP_CL |
[DEPRECATED] Sophos Endpoint Protection (using Azure Function) (using Azure Functions) |
Yes |
Yes |
| SophosEPEvents_CL |
Sophos Endpoint Protection (via Codeless Connector Platform) |
Yes |
Yes |
| SquidProxy_CL |
Custom logs via AMA |
Yes |
Yes |
| StealthTalkAnomalousAuth_CL |
StealthTalk Anomalous Authentication |
No |
No |
| StorageBlobLogs |
Azure Storage Account |
Yes |
Yes |
| StorageFileLogs |
Azure Storage Account |
Yes |
Yes |
| StorageQueueLogs |
Azure Storage Account |
Yes |
Yes |
| StorageTableLogs |
Azure Storage Account |
Yes |
Yes |
| SymantecICDx_CL |
Symantec Integrated Cyber Defense Exchange |
No |
No |
| Syslog |
CTERA Syslog
Cisco Software Defined WAN
Syslog via AMA
Syslog via Legacy Agent |
Yes |
Yes |
| TacitRed_Findings_CL |
TacitRed Compromised Credentials |
No |
No |
| Talon_CL |
Talon Insights |
No |
No |
| TaniumComplyCompliance_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumComplyVulnerabilities_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumDefenderHealth_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumDiscoverUnmanagedAssets_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumHighUptime_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumPatchCoverageStatus_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumPatchListApplicability_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumPatchListCompliance_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumSCCMClientHealth_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| TaniumThreatResponse_CL |
Tanium's CCF Push Connector |
Yes |
Yes |
| Tenable_IE_CL |
Tenable Identity Exposure |
Yes |
Yes |
| Tenable_VM_Asset_CL |
Tenable Vulnerability Management (using Azure Functions) |
Yes |
Yes |
| Tenable_VM_Compliance_CL |
Tenable Vulnerability Management (using Azure Functions) |
Yes |
Yes |
| Tenable_VM_Vuln_CL |
Tenable Vulnerability Management (using Azure Functions) |
Yes |
Yes |
| Tenable_WAS_Asset_CL |
Tenable Vulnerability Management (using Azure Functions) |
Yes |
Yes |
| Tenable_WAS_Vuln_CL |
Tenable Vulnerability Management (using Azure Functions) |
Yes |
Yes |
| TheHiveData |
TheHive (via Codeless Connector Framework) |
No |
No |
| TheomAlerts_CL |
Theom |
No |
No |
| TheomAlertsV2_CL |
Theom (via Codeless Connector Framework) |
No |
No |
| ThinkstCanaryIncidents_CL |
Thinkst Canary |
Yes |
Yes |
| ThreatIntelIndicators |
CrowdStrike Falcon Adversary Intelligence (using Azure Functions)
Cyjax Threat Intelligence IOC Connector (using Azure Functions)
Feedly IoC
GreyNoise Threat Intelligence
JoeSandboxThreatIntelligence (using Azure Functions)
PRODAFT USTA - IoC Threat Intelligence |
Yes |
No |
| ThreatIntelligenceIndicator |
Datalake2Sentinel
Luminar IOCs and Leaked Credentials (using Azure Functions)
MISP2Sentinel
Microsoft Defender Threat Intelligence
Mimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)
Premium Microsoft Defender Threat Intelligence
Threat Intelligence Platforms
Threat Intelligence Upload API (Preview)
Threat intelligence - TAXII
VMRayThreatIntelligence (using Azure Functions) |
Yes |
No |
| Tomcat_CL |
Custom logs via AMA |
Yes |
Yes |
| TransmitSecurityActivity_V2_CL |
Transmit Security Data Connector (via Codeless Connector Framework) |
No |
No |
| TrellixEvents |
Trellix Endpoint Security (via Codeless Connector Framework) |
No |
No |
| TrendAI_XDR_OAT_V2_CL |
TrendAI Vision One™ - OAT Detections (via Codeless Connector Framework) |
Yes |
Yes |
| TrendAI_XDR_WORKBENCH_V2_CL |
TrendAI Vision One™ - Workbench Alerts (via Codeless Connector Framework) |
Yes |
Yes |
| TrendMicro_XDR_OAT_CL |
Trend Vision One (using Azure Functions) |
Yes |
Yes |
| TrendMicro_XDR_RCA_Result_CL |
Trend Vision One (using Azure Functions) |
No |
No |
| TrendMicro_XDR_RCA_Task_CL |
Trend Vision One (using Azure Functions) |
No |
No |
| TrendMicro_XDR_WORKBENCH_CL |
Trend Vision One (using Azure Functions) |
Yes |
Yes |
| TrendMicroCAS_CL |
Trend Micro Cloud App Security (using Azure Functions) |
Yes |
Yes |
| TrendMicroCASV2_CL |
Trend Micro Cloud App Security (via Codeless Connector Framework) |
Yes |
Yes |
| Ttp_Attachment_CL |
Mimecast Targeted Threat Protection |
Yes |
Yes |
| Ttp_Impersonation_CL |
Mimecast Targeted Threat Protection |
Yes |
Yes |
| Ttp_Url_CL |
Mimecast Targeted Threat Protection |
Yes |
Yes |
| Ubiquiti_CL |
Custom logs via AMA |
Yes |
Yes |
| union ASimAgentEventLogs, ASimAlertEventLogs, ASimAssetEntityLogs, ASimAuditEventLogs, ASimAuthenticationEventLogs, ASimDhcpEventLogs, ASimDnsActivityLogs, ASimFileEventLogs, ASimNetworkSessionLogs, ASimProcessEventLogs, ASimRegistryEventLogs, ASimUserManagementActivityLogs, ASimWebSessionLogs |
Synqly Integration Connector |
No |
No |
| UniqkeyEvents_CL |
Uniqkey Security Events |
Yes |
Yes |
| UpwindCatalogAssets_CL |
Upwind Catalog Loader (Ingestion API) |
Yes |
Yes |
| UtimacoESKMKmipServerLogs_CL |
Utimaco Enterprise Secure Key Manager (ESKM) |
No |
No |
| Vaikora_AgentSignals_CL |
Vaikora AI Agent Behavioral Signals |
Yes |
Yes |
| ValenceAlert_CL |
SaaS Security |
No |
No |
| ValimailEnforceEvents_CL |
Valimail Enforce Configuration Events |
Yes |
Yes |
| VaronisAlerts_CL |
[Deprecated] Varonis SaaS |
Yes |
Yes |
| VaronisAlertsV2_CL |
Varonis SaaS (Push) |
Yes |
Yes |
| VaronisResources_CL |
Varonis Purview Push Connector |
Yes |
Yes |
| vcenter_CL |
Custom logs via AMA |
Yes |
Yes |
| VectraStream_CL |
Custom logs via AMA |
No |
No |
| VeeamAuthorizationEvents_CL |
Veeam Data Connector (using Azure Functions) |
Yes |
Yes |
| VeeamCovewareFindings_CL |
Veeam Data Connector (using Azure Functions) |
Yes |
Yes |
| VeeamMalwareEvents_CL |
Veeam Data Connector (using Azure Functions) |
Yes |
Yes |
| VeeamOneTriggeredAlarms_CL |
Veeam Data Connector (using Azure Functions) |
Yes |
Yes |
| VeeamSecurityComplianceAnalyzer_CL |
Veeam Data Connector (using Azure Functions) |
Yes |
Yes |
| VeeamSessions_CL |
Veeam Data Connector (using Azure Functions) |
Yes |
Yes |
| VersasecCmsErrorLogs_CL |
VersasecCms |
No |
No |
| VersasecCmsSysLogs_CL |
VersasecCms |
No |
No |
| VMwareWorkspaceOneDeviceApps |
VMware Workspace ONE (via Codeless Connector Framework) |
No |
No |
| VMwareWorkspaceOneDevices |
VMware Workspace ONE (via Codeless Connector Framework) |
No |
No |
| W3CIISLog |
IIS Logs of Microsoft Exchange Servers
[Deprecated] Microsoft Exchange Logs and Events |
Yes |
No |
| web_assets_CL |
Holm Security Data Connector |
No |
No |
| WhoisFreaksThreat_CL |
WhoisFreaks Threat & NRD Feeds (via Codeless Connector Framework) |
No |
No |
| WindowsEvent |
Windows Forwarded Events |
Yes |
Yes |
| WizAuditLogsV3_CL |
Wiz for Microsoft Sentinel |
No |
No |
| WizDetectionsV3_CL |
Wiz for Microsoft Sentinel |
Yes |
Yes |
| WizIssuesV3_CL |
Wiz for Microsoft Sentinel |
Yes |
Yes |
| Workplace_Facebook_CL |
Workplace from Facebook (using Azure Functions) |
No |
No |
| WsSecurityEvents_CL |
WithSecure Elements (CCF)
WithSecure Elements API (Azure Function) |
Yes |
Yes |
| XbowAssessments_CL |
XBOW Security Platform (via Azure Function) |
No |
No |
| XbowAssets_CL |
XBOW Security Platform (via Azure Function) |
No |
No |
| XbowFindings_CL |
XBOW Security Platform (via Azure Function) |
No |
No |
| ZeroFox_CTI_advanced_dark_web_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_botnet_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_breaches_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_C2_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_compromised_credentials_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_credit_cards_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_dark_web_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_discord_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_disruption_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_email_addresses_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_exploits_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_irc_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_malware_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_national_ids_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_phishing_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_phone_numbers_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_ransomware_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_telegram_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_threat_actors_CL |
ZeroFox CTI |
No |
No |
| ZeroFox_CTI_vulnerabilities_CL |
ZeroFox CTI |
No |
No |
| ZeroFoxAdvancedDarkWeb_CL |
ZeroFox Enterprise - Advanced Dark Web |
Yes |
Yes |
| ZeroFoxAlertPoller_CL |
ZeroFox Alerts
ZeroFox Enterprise - Alerts (Polling CCF) |
Yes |
Yes |
| ZeroFoxBotnet_CL |
ZeroFox Enterprise - Botnet |
Yes |
Yes |
| ZeroFoxBotnetCC_CL |
ZeroFox Enterprise - Botnet Compromised Credentials |
Yes |
Yes |
| ZeroFoxBreaches_CL |
ZeroFox Enterprise - Breaches |
Yes |
Yes |
| ZeroFoxCompromisedCredentials_CL |
ZeroFox Enterprise - Compromised Credentials |
Yes |
Yes |
| ZeroFoxCreditCards_CL |
ZeroFox Enterprise - Credit Cards |
Yes |
Yes |
| ZeroFoxDarkWeb_CL |
ZeroFox Enterprise - Dark Web |
Yes |
Yes |
| ZeroFoxDiscord_CL |
ZeroFox Enterprise - Discord |
Yes |
Yes |
| ZeroFoxDisruption_CL |
ZeroFox Enterprise - Disruption |
Yes |
Yes |
| ZeroFoxEmailAddresses_CL |
ZeroFox Enterprise - Email Addresses |
Yes |
Yes |
| ZeroFoxExploits_CL |
ZeroFox Enterprise - Exploits |
Yes |
Yes |
| ZeroFoxIndicators_CL |
ZeroFox Enterprise - Indicators |
Yes |
Yes |
| ZeroFoxKeyIncidents_CL |
ZeroFox Enterprise - Key Incidents |
Yes |
Yes |
| ZeroFoxNationalIds_CL |
ZeroFox Enterprise - National IDs |
Yes |
Yes |
| ZeroFoxPhysicalThreats_CL |
ZeroFox Enterprise - Physical Threats |
Yes |
Yes |
| ZeroFoxTelegram_CL |
ZeroFox Enterprise - Telegram |
Yes |
Yes |
| ZeroFoxVulnerabilities_CL |
ZeroFox Enterprise - Vulnerabilities |
Yes |
Yes |
| ZimperiumIncidentLog_CL |
Zimperium Mobile Threat Defense CCF |
Yes |
Yes |
| ZimperiumIncidentMitigationLog_CL |
Zimperium Mobile Threat Defense CCF |
Yes |
Yes |
| ZimperiumMitigationLogV2_CL |
Zimperium Mobile Threat Defense CCF |
Yes |
Yes |
| ZimperiumThreatLogV2_CL |
Zimperium Mobile Threat Defense CCF |
Yes |
Yes |
| ZNAudit_CL |
Zero Networks Segment (Push) |
Yes |
Yes |
| ZNIdentityActivity_CL |
Zero Networks Segment (Push) |
Yes |
Yes |
| ZNNetworkActivity_CL |
Zero Networks Segment (Push) |
Yes |
Yes |
| ZNRPCActivity_CL |
Zero Networks Segment (Push) |
Yes |
Yes |
| ZNSegmentAuditNativePoller_CL |
Zero Networks Segment Audit |
Yes |
Yes |
| Zoom_CL |
[DEPRECATED] Zoom Reports (using Azure Functions) |
No |
No |
| ZoomV2_CL |
Zoom Reports Connector (via Codeless Connector Framework) |
Yes |
Yes |
| ZPA_CL |
Custom logs via AMA |
Yes |
Yes |