Data source UUIDs - Data source UUIDs - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

<Vendor>_<Product>_raw

aws_s3_raw

These AWS logs are collected via Amazon S3. To ensure compatibility, see Ingest audit logs from AWS Cloud Trail.

These AWS logs are collected via Amazon CloudWatch. To ensure collector compatibility, see Ingest logs from Amazon CloudWatch.

These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest network flow logs from Amazon S3.

These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest generic logs from Amazon S3.

For setup details, see Prompt log collection in AWS.

These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest Network Route 53 Logs from Amazon S3.

The BOX_DIRECTORIES connector queries the following Box API endpoints:

For setup details, see Ingest Logs and Data from Box.

crowdstrike_falcon_incident_raw

Currently not supported by Cribl

CrowdStrike Streaming API

Base URL: https://api.crowdstrike.com (or `api.us-2.crowdstrike.com`, `api.eu-1.crowdstrike.com`, etc.)

GET /sensors/entities/datafeed/v2

For setup details, see Ingest alerts and metadata from CrowdStrike APIs.

CrowdStrike Devices API

GET /devices/queries/devices-scroll/v1

POST /devices/entities/devices/v2

For setup details, see Ingest alerts and metadata from CrowdStrike APIs.

Base URL: https://api.dropboxapi.com

For setup details, see Ingest Logs and Data from Dropbox.

Base URL: https://api.dropboxapi.com

Endpoint: /2/team_log/get_events

For setup details, see Ingest Logs and Data from Dropbox.

google_cloud_logging_raw

For setup details, see Ingest Logs and Data from a GCP Pub/Sub.

google_gmail_raw

GET https://gmail.googleapis.com/gmail/v1/users/{userId}/messages

For setup details, see Ingest Logs and Data from Google Workspace.

google_workspace_alerts_raw

Description: Ingests security and system alerts from the Google Workspace Alert Center.

For setup details, see Ingest Logs and Data from Google Workspace.

google_workspace_chrome_raw

GET https://admin.googleapis.com/admin/directory/v1/customer/{customer}/devices/chromeos

For setup details, see Ingest Logs and Data from Google Workspace.

google_workspace_enterprise_groups_raw

GET https://admin.googleapis.com/admin/directory/v1/groups

For setup details, see Ingest Logs and Data from Google Workspace.

google_workspace_rules_raw

GET https://gmail.googleapis.com/gmail/v1/users/{userId}/settings/filters

For setup details, see Ingest Logs and Data from Google Workspace.

google_workspace_user_acounts_raw

GET https://admin.googleapis.com/admin/directory/v1/users/{userKey}

For setup details, see Ingest Logs and Data from Google Workspace.

msft_azure_raw

Azure Event Hubs SDK (AMQP): For setup details, see Ingest Logs from Microsoft Azure Event Hub.

msft_azure_ad_raw

For set up details, see Ingest Logs from Microsoft Office 365.

msft_azure_ad_audit_raw

Microsoft Graph API: GET /v1.0/auditLogs/directoryaudits

For set up details, see Ingest Logs from Microsoft Office 365.

msft_azure_ad_raw

Microsoft Graph API: GET /v1.0/auditLogs/signIns

For set up details, see Ingest Logs from Microsoft Office 365.

msft_defender_raw

Azure Event Hubs SDK (AMQP): For setup details, see Ingest raw EDR events from Microsoft Defender for Endpoint.

msft_dhcp_raw

File Collection: C:\Windows\System32\dhcp\DhcpSrvLog-*.log

For set up details, see Ingest logs from Windows DHCP using Elasticsearch Filebeat.

msft_graph_security_alerts_raw

Microsoft Graph API: /v1.0/security/alerts_v2

For set up details, see Ingest Logs from Microsoft Office 365.

msft_o365_azure_ad_raw

The Base URLs for the APIs are (depending on the environment):

Worldwide: `https://manage.office.com`

GCC: `https://manage-gcc.office.com`

GCC High: `https://manage.office365.us`

DoD: `https://manage.protection.apps.mil`

Endpoints:

Start Subscription: /api/v1.0/{tenantID}/activity/feed/subscriptions/start?contentType={type}

List Available Content: /api/v1.0/{tenantID}/activity/feed/subscriptions/content?contentType={type}

Fetch Content Blob: Dynamic URI returned from the “List Available Content” call.

Content Types: `audit.exchange`, `audit.sharepoint`, `audit.general`, `audit.azureactivedirectory`, `dlp.all`.

For set up details, see Ingest Logs from Microsoft Office 365.

msft_o365_dlp_raw

See Office 365 Azure AD.

For set up details, see Ingest Logs from Microsoft Office 365.

msft_o365_domains_raw

Microsoft Graph API: GET /v1.0/domains

msft_o365_exchange_online_raw

See Office 365 Azure AD.

For set up details, see Ingest Logs from Microsoft Office 365.

msft_o365_general_raw

See Office 365 Azure AD.

For set up details, see Ingest Logs from Microsoft Office 365.

msft_o365_sharepoint_online_raw

See Office 365 Azure AD.

For set up details, see Ingest Logs from Microsoft Office 365.

msft_o365_contacts_raw

Microsoft Graph API: GET /v1.0/users/{id}/mailFolders/inbox/messageRules

For set up details, see Ingest logs and data from Microsoft 365.

msft_o365_devices_raw

Microsoft Graph API: GET /v1.0/users/{id}/registeredDevices

For set up details, see Ingest logs and data from Microsoft 365.

msft_o365_groups_raw

Microsoft Graph API: GET /v1.0/groups

For set up details, see Ingest logs and data from Microsoft 365.

msft_o365_mailboxes_raw

The Base URLs for the APIs are (depending on the environment): https://graph.microsoft.com` (or `https://graph.microsoft.us` for FedRAMP)

Incoming Messages: GET /v1.0/users/{id}/messages

Outgoing Messages: GET /v1.0/users/{id}/mailFolders/sentitems/messages/delta

For set up details, see Ingest logs and data from Microsoft 365.

msft_o365_rules_raw

Microsoft Graph API: /users/{id}/mailFolders/inbox/messageRules

For set up details, see Ingest logs and data from Microsoft 365.

msft_o365_users_raw

Microsoft Graph API: GET /v1.0/users

For set up details, see Ingest logs and data from Microsoft 365.

okta_sso_raw

Okta System Log API

Base URL: https://{your-okta-domain}.okta.com

GET /api/v1/logs

For set up details, see Ingest Logs and Data from Okta.

onelogin_events_raw

Base URL: https://<subdomain>.onelogin.com

Endpoint: /api/1/events`

For set up details, see Ingest Logs and Data from OneLogin.

Base URL: https://<subdomain>.onelogin.com

Endpoints: /api/1/users/api/1/groups/api/2/apps

For set up details, see Ingest Logs and Data from OneLogin.

pingid_pingone_raw

PingOne API:

Base URL: https://admin-api.pingone.com

Endpoint: /v3/reports/{account_id}/poll-subscriptions/{subscription_id}/events

For set up details, see Ingest Authentication Logs and Data from PingOne.

proofpoint_tap_raw

API Base URL: https://tap-api-v2.proofpoint.com

Resource Path: `/v2/siem/all`

For set up details, see Ingest Logs from Proofpoint Targeted Attack Protection.

The data schema for salesforce_eventlogfile_raw is dynamic and not hardcoded in the data collector's source code.

Here's how it works:

Dynamic Field Discovery: The collector calls the Salesforce describe endpoint (/services/data/v56.0/sobjects/EventLogFile/describe) to retrieve the list of all available fields for the EventLogFile object.

Query Construction: It constructs a SOQL query selecting all these discovered fields, such as SELECT Id, LogFile, LogDate,.... FROM EventLogFile).

CSV to JSON: The downloaded log files are in CSV format. The collector converts each CSV row into a JSON object where the keys are the CSV headers (which correspond to the fields discovered in the Dynamic Field Discovery explained above).

For set up details, see Ingest logs and data from Salesforce.com.

Authentication:

Path: /services/oauth2/token

Purpose: Used for obtaining and refreshing access tokens.

Data Query:

Path: /services/data/v56.0/queryAll

Purpose: Used to execute SOQL queries to fetch records for the snapshot objects, such as User, Profile, and Group.

Object Description:

Path: /services/data/v56.0/sobjects/{object}/describe

Purpose: Used to dynamically retrieve the list of fields for a specific object before querying it.

All endpoints are relative to the base URL: https://{domain}.my.salesforce.com.

For set up details, see Ingest logs and data from Salesforce.com.

sentinelone_deep_visibility_raw

For set up details, see Ingest raw EDR events from SentinelOne DeepVisibility.

servicenow_cmdb_<table name>_raw

ServiceNow Table API

Base URL: https://{instance}.service-now.com

GET /api/now/table/{table_name}

For set up details, see Ingest Data from ServiceNow CMDB.

workday_workday_raw

Workday Report-as-a-Service (RaaS)

Endpoint: Configurable Report URL

For set up details, see Ingest Report Data from Workday.