The integration catalogue
Every source the platform reads, listed in full rather than summarised as a number with a plus sign.
This page is generated from the connector registry in the build, so it cannot drift from what ships. If a source is missing from this list, we ship no decoder for it yet. It can still arrive over a generic format or a plugin you install, and this page does not count those.
Sources
138
Each one installs and activates as a single unit — a decoder, its protocols and whatever detection content comes with it.
Ship detection content
79
Connecting the source also installs detectors for it. The rest feed events into the lake, where other rules and analytics read them.
Protocols and formats
325
Counted distinctly across the catalogue, because one source usually accepts several shapes of the same feed.
Industrial sources
12
Built-in decoders are implemented from published specifications. Where no specification is open, we do not reverse-engineer one into the core.
What one source gives you
Whatever it emits becomes the same kind of event as everything else on the platform. That is the point of the single lake: a rule written over process activity reads the same whether the events arrived from a Windows agent, a Linux audit feed or a macOS sensor.
Why some rows ship no detection content
Most are transports and formats rather than sources with a subject of their own: syslog and the industry log formats carry other people's events, and vulnerability scanners and estate feeds supply context that detectors elsewhere read. The rest — badge, DMARC and change-record feeds among them — carry a subject that no bundled rule reads yet. Marking them as detection sources would inflate the number that matters.
Ingest volume is the meter
On the Platform line, adding a source costs nothing by itself. What is billed is the raw volume you send, measured before enrichment — so filtering at the edge is the lever, not connecting fewer things. The pricing page sets out the mechanism.
FILTER
All 138 sources, grouped by what they are for.
Cloud and SaaS audit
18 sources
Atlassian Cloud organization audit log
atlassian · audit-log · confluence · jira · json
detection
AWS CloudTrail
aws · cloudtrail · json
detection
Azure Activity Log
activity-log · azure · json · monitor
detection
Bitbucket / Atlassian DC audit
atlassian · audit-event · bitbucket · json · vcs
detection
Box
audit-log · box · content-cloud · file-sharing · json
detection
Cloudflare Audit Logs
audit-log · cdn · cloudflare · json · waf
detection
Dropbox Business
audit-log · content-cloud · dropbox · file-sharing · json
detection
GCP Cloud Audit Logs
cloud-audit · gcp · json
detection
GitHub audit log
audit-log · github · json · vcs
detection
GitLab audit events
audit-event · gitlab · json · vcs
detection
Google Workspace audit
admin-sdk · google-workspace · gworkspace · json · reports
detection
Kubernetes audit
audit · container · json · k8s · kubernetes
detection
Microsoft 365 unified audit
json · m365 · management-activity · office365
detection
Salesforce
audit-trail · crm · event-monitoring · json · salesforce
detection
Slack
audit-log · collaboration · json · slack
detection
Snowflake
account-usage · data-warehouse · json · snowflake
detection
Workday
audit-log · hr · hris · json · workday
detection
Zoom
audit-log · collaboration · json · video · zoom
detection
Cloud and cluster configuration
4 sources
AWS resource configuration (CSPM)
aws · aws-config · config · cspm · json
detection
Azure resource configuration (CSPM)
azure · azure-resource-graph · config · cspm · json
detection
Google Cloud resource configuration (CSPM)
cloud-asset-inventory · config · cspm · gcp · json
detection
Kubernetes resource configuration (KSPM)
config · json · k8s · kspm · kubernetes
detection
Identity and access
6 sources
Auth0 (CIC) logs
auth0 · json · logs
detection
Cisco Duo logs
duo · json · logs
detection
Identity proofing / KYC (biometric · liveness · document)
document-verify · face-match · idv · json · kyc · liveness
detection
MFA (identity/MFA)
http · mfa
detection
Microsoft Entra ID
azuread · entra · graph · json
detection
Okta System Log
json · okta · system-log
detection
Endpoint and host
9 sources
application log files
file · json
events only
Endpoint process monitor (osquery process_events)
osquery-result-log · process_events · procmon
detection
File Integrity Monitoring (osquery file_events)
file_events · fim · osquery-result-log
detection
Linux auditd
audisp · auditd · linux-audit
detection
macOS Endpoint Security (eslogger)
endpoint-security · esf · eslogger · json
detection
osquery
http · osquery
detection
systemd journal
journald · json · systemd-journal
detection
Windows Security Event Log
json · wef · windows-event-log · winevtx · winlogbeat
detection
Windows Sysmon
json · sysmon · wef · windows-event-log · winlogbeat
detection
Collected by the agent
9 sources
Sensor DLP sweep
dlpscan-report · ndjson
detection
Sensor inline-resolver DNS telemetry
dnswatch-query · ndjson
detection
Sensor native FIM sweep
fimscan-change · ndjson
detection
Sensor native logon sensor
logonwatch-session · ndjson
detection
Sensor native network sensor
ndjson · netwatch-connect
detection
Sensor native persistence sensor
ndjson · persistwatch-change
detection
Sensor native process sensor
ndjson · procwatch-exec
detection
Sensor software + host inventory
eventlake-inventory · json
events only
Sensor YARA sweep
ndjson · yarascan-report
detection
Operational technology and IIoT
10 sources
BACnet/IP (OT)
bacnet · bacnet-ip
detection
CoAP / RFC 7252 (IoT)
coap · udp
detection
DNP3 / IEEE-1815 (OT)
dnp3
detection
EtherNet/IP + CIP (OT)
cip · enip · ethernet-ip · tcp
detection
IEC 60870-5-104 (OT)
iec104 · iec60870-5-104 · tcp
detection
IEC 61850 / MMS (OT)
iec61850 · iec61850-8-1 · mms · tcp
detection
Modbus/TCP (OT)
modbus · tcp
detection
MQTT 3.1.1 (IoT/IIoT)
mqtt · tcp
detection
OPC UA (opc.tcp)
opc.tcp · opcua · tcp
detection
PROFINET (PN-DCP)
ethernet · pn-dcp · profinet
detection
Network and transport
13 sources
CEF (Common Event Format)
cef · syslog
events only
HTTP (raw request/response body tap)
http · icap · proxy-tap · rfc9112
detection
LEEF (QRadar)
leef · syslog
events only
NetFlow / IPFIX / sFlow
ipfix · netflow · sflow · udp
detection
NTP / RFC 5905 (time sync)
ntp · udp
detection
OCSF (Open Cybersecurity Schema)
http · json · ocsf
events only
OpenTelemetry (OTLP)
grpc · http · otlp
events only
OpenTelemetry metrics (infra monitoring)
grpc · http · otlp · otlp/json
detection
OpenTelemetry traces (APM)
grpc · http · otlp · otlp/json
detection
Packet capture (pcap/pcapng)
pcap · pcapng
detection
PTP / IEEE 1588 (precision time)
ethernet · ptp · udp
detection
SNMP traps
snmp · udp
detection
Syslog
syslog · tcp · udp
events only
Third-party control planes
12 sources
API gateway (authorization decisions)
api-gateway · authz · ext-authz · json · opa-decision-log
detection
Backup / data-protection control plane
aws-backup · backup · data-protection · json · object-lock · rubrik · veeam
detection
Build/deploy provenance (attestation verification)
admission · cosign · in-toto · json · sigstore · slsa
detection
Camera / VMS / edge-CV (computer-vision security)
anpr · cv · json · rtsp-analytics · vision · vms
detection
Database-activity-monitoring / database firewall
dam · database-activity-monitoring · database-firewall · guardium · immuta · imperva · json · oracle-dv · privacera
detection
Design-review / threat-model security gate
design-review · json · pr-check · sdlc · threat-model
detection
DLP / data-loss-prevention control plane
casb · data-loss-prevention · dlp · forcepoint · json · netskope · purview · symantec-dlp
detection
DMARC aggregate reports (RUA)
gzip · xml · zip
events only
Email security (mail-gateway / M365 EmailEvents)
email-security · json · m365-emailevents · mail-gateway
detection
IaC security-scan / policy gate
checkov · iac-scan · json · kics · opa · terraform · tfsec
detection
LLM gateway (GenAI telemetry)
genai · json · llm-gateway · openai-chat · otel-genai
detection
Mobile device management (MDM/UEM · MTD)
android-management · intune · json · mdm · mobile · mtd · uem
detection
Vulnerability and intelligence
6 sources
Nessus (network vulnerability scan)
nessus · vulnerability · xml
events only
OpenVAS / Greenbone (network vulnerability scan)
greenbone · openvas · vulnerability · xml
events only
OSINT feed (RSS/Atom advisories)
atom · feed · rss · xml
events only
Qualys VM (network vulnerability scan)
qualys · vulnerability · xml
events only
SARIF (vulnerability scanner output)
json · sarif · vulnerability
events only
SBOM (CycloneDX / SPDX)
cyclonedx · json · spdx
events only
Physical and estate context
5 sources
Change records (change-management system)
change-management · itsm · json · servicenow
events only
DFIR triage collection (forensic artifacts · chain of custody)
chain-of-custody · dfir · forensic · json · triage
events only
DHCP / address-assignment leases
csv · json · syslog
events only
Email (raw RFC 5322 / MIME message)
email-journal · eml · mime · rfc5322 · smtp-data
detection
Physical access control (PACS · badge / door)
access-control · badge · json · pacs · physical-access
events only
Not yet placed in a group
46 sources
5G Core & RAN 3GPP NGAP / PFCP / GTP-U
gtpu · ngap · pfcp
events only
5G core analytics (NWDAF, TS 29.520)
3gpp-ts29520-nnwdaf-eventssubscription
events only
5G NF profiles (NRF, TS 29.510 NFProfile)
3gpp-ts29510-nfprofile
events only
5G NF security configuration (ConfigMap · TS 29.503 UP security)
3gpp-ts29503-sm-subscription-data · 3gpp-ts33501-security-config · kubernetes-configmap
events only
Android Management API usage logs (security + network log)
android-management · json · network-log · security-log · usage-log
detection
Application business events (eventlake.business/1)
business-event · json
events only
Authoritative DNS zone-transfer log
file · syslog
events only
Automotive CAN Bus & ISO 14229 UDS
canbus · iso14229 · socketcan · uds
events only
Aviation Mode-S / ADS-B (SBS-1 & DF17)
adsb · modes · sbs1
events only
AWS WAF traffic log
aws-waf-log · json
events only
Capital Markets FIX 4.2 / 4.4 / 5.0
fix
events only
CAPTCHA / challenge verdicts (reCAPTCHA · hCaptcha · Turnstile)
hcaptcha · json · recaptcha · siteverify · turnstile
events only
Cloud billing and usage export
aws-cur · azure-cost-management · gcp-billing-export · json · oci-usage
events only
Container registry notifications (CNCF Distribution)
distribution-notifications · oci-registry-webhook
events only
Enterprise telephony call records
asterisk-cdr · json · msgraph-callrecords
events only
EV Charging OCPP 1.6J / 2.0.1
ocpp · ocpp16j · ocpp201
events only
Exchange Online mailbox rules and forms (Inbox associated contents)
csv · ews · json · mailbox-rules-export
events only
Financial ISO 8583 Card Switch
iso8583
events only
Healthcare DICOM PACS / DIMSE
dicom · dimse
events only
Healthcare HL7 v2 / FHIR AuditEvent
fhir-auditevent · hl7v2 · json · mllp
events only
IBM z/OS SMF security records
json · key-value · racf · smf · zcdp
events only
Interconnect signalling firewall / SEPP verdicts
json · signalling-firewall-verdict
events only
Malicious packages (OSV MAL- advisories)
json · ossf-malicious-packages · osv
events only
Maritime NMEA 0183 / AIS & GNSS
ais · aivdm · gnss · nmea0183
events only
Measured-boot event log (TCG PC Client)
tcg-pc-client-event-log
events only
MES operations records (B2MML / ISA-95)
b2mml · file · https · isa-95
events only
Microsoft Teams messages (Graph chatMessage)
chatMessage · json · microsoft-graph · teams-export-api
events only
ModSecurity audit log (JSON)
modsecurity-json-audit-log
events only
NETCONF notifications (RFC 5277 / RFC 6470 — the O-RAN M-plane)
ietf-rfc5277-notification · ietf-rfc6470-base-notifications · o-ran-m-plane
events only
Network-device command accounting
json · syslog · tacacs+
events only
OMRON FINS (OT)
fins · omronfins · tcp
detection
Open vSwitch daemon log (ovs-vswitchd)
ovs-vlog
events only
OpenStack / CADF audit (VIM and VNFM)
dmtf-cadf · openstack-audit-middleware · oslo-notification
events only
RADIUS network admission (FreeRADIUS detail)
802.1x · freeradius-detail · radius-accounting
events only
RAN / 5G core PM files (3GPP TS 32.435)
3gpp-pm-file · 3gpp-ts32435-meascollec · o-ran-o1-pm
events only
RAN / transport alarms (ONAP · O-RAN VES)
o-ran-o1 · onap-ves · ves
events only
SAP Security Audit Log, transports and change documents
json · key-value · sap-cdhdr · sap-rsau · sap-stms
events only
Sensor container-escape detection
mote-container-escape · ndjson
detection
Sensor edge canary files
canarywatch-access · ndjson
detection
Server BMC events (DMTF Redfish)
redfish
events only
Service-mesh access log (Envoy / Istio)
envoy-json-access-log · istio-access-log
events only
Siemens S7comm (ISO-on-TCP / TPKT / COTP)
iso-on-tcp · s7comm · tpkt
detection
SMS provider send log
aws-sns-sms-log · json · twilio-rest
events only
SWIFT FIN & ISO 20022 Financial Messaging
iso20022 · swift-fin · xml
events only
VMware ESXi host shell log
file · syslog
events only
Wireless access point (hostapd) event log
file · syslog
events only
Your format is not on the list. Proprietary and OEM formats are decoded by a plugin that runs in WebAssembly (wazero), sandboxed away from the host and loaded only when its signature verifies. That path is how a format nobody else supports becomes a first-class source, with the same canonical events and the same detections as every built-in above. All 138 sources above are compiled into the platform; none is a plugin today.
What this sheet deliberately does not carry. Not the per-source integration documentation, and not the event-by-event mapping each decoder performs. The first belongs in product documentation you get with the platform; the second, for the endpoint sources, would amount to telling an adversary which records we read and which we skip. The coverage we publish is measured at the framework level, where a gap is something you can weigh — see what we do not detect.
Scope & Honest Limits Honest limits of this catalogue Expand · Full ledger →
A source in the list is not a promise about your version of it
Vendors change their log shapes. Each decoder is written against a documented format, and where a product emits something the documentation does not describe, that variant is a gap until somebody hits it.
Connecting a source is not the same as covering a technique
A detector needs the specific field its rule reads, and plenty of feeds arrive configured to omit it. Measured detection coverage, and what blocks the rest, is on the proof page.
One industrial protocol is deliberately not decoded
A widely deployed factory protocol has no published specification, so decoding it would mean working from reverse-engineered material. We refused to write that decoder; its traffic and connection envelope are still recorded from the open transport standards, with the protocol itself treated as opaque.
This list is a snapshot of a build
Generated 2026-10-28. A running deployment can be asked for its own catalogue, and that answer is the authoritative one for the version you hold.
Missing something you need to read?
There is a documented way to bring an unlisted source in without waiting for us, and if a feed matters to your estate we would rather hear which one than guess. A trial is the fastest way to find out whether your own feeds decode cleanly.