|
AADManagedIdentitySignInLogs |
Microsoft Entra-ID |
Yes |
Yes |
|
AADNonInteractiveUserSignInLogs |
Microsoft Entra-ID |
Yes |
Yes |
|
AADProvisioningLogs |
Microsoft Entra-ID |
Yes |
Yes |
|
AADRiskyServicePrincipals |
Microsoft Entra-ID |
Yes |
Yes |
|
AADRiskyUsers |
Microsoft Entra-ID |
Yes |
Yes |
|
AADServicePrincipalRiskEvents |
Microsoft Entra-ID |
Yes |
Yes |
|
AADServicePrincipalSignInLogs |
Microsoft Entra-ID |
Yes |
Yes |
|
AADUserRiskEvents |
Microsoft Entra-ID |
Yes |
Yes |
|
ABAPAuditLog |
Pathlock Inc.: Bedrohungserkennung und -reaktion für SAP
ÖFFENTLICHE SAP S/4HANA Cloud Edition
SecurityBridge-Lösung für SAP |
Yes |
Yes |
| ABNORMAL_CASES_CL |
AbnormalSecurity (mit Azure Function) |
Nein |
Nein |
| ABNORMAL_THREAT_MESSAGES_CL |
AbnormalSecurity (mit Azure Function) |
Nein |
Nein |
|
ADFSSignInLogs |
Microsoft Entra-ID |
Yes |
Yes |
| ADOAuditLogs_CL |
Azure DevOps Überwachungsprotokolle (über die Codeless Connector Platform) |
Yes |
Yes |
| AIShield_CL |
AIShield |
Nein |
Nein |
|
AlertEvidence |
Microsoft Defender XDR |
Yes |
Yes |
| alertscompromisedcredentialdata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsctepdata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsdlpdata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsmalsitedata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsmalwaredata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertspolicydata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsquarantinedata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsremediationdata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertssecurityassessmentdata_CL |
Netskope Data Connector |
Nein |
Nein |
| alertsubadata_CL |
Netskope Data Connector |
Nein |
Nein |
| AliCloud_CL |
AliCloud (mit Azure Functions) |
Nein |
Nein |
| AliCloudActionTrailLogs_CL |
Alibaba Cloud ActionTrail (über Codeless Connector Framework) |
Yes |
Yes |
| Anvilogic_Alerts_CL |
Anvilogic |
Nein |
Nein |
| ApacheHTTPServer_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| ARGOS_CL |
ARGOS Cloud Security |
Nein |
Nein |
| argsentdc_CL |
Check Point Cyberint Alerts Connector (über Codeless Connector Platform) |
Yes |
Yes |
| Armis_Activities_CL |
Armis Alerts Activities (using Azure Functions) |
Nein |
Nein |
| Armis_Alerts_CL |
Armis Alerts Activities (using Azure Functions) |
Nein |
Nein |
| Armis_Devices_CL |
Armis-Geräte (mit Azure Functions) |
Nein |
Nein |
|
ASimAuditEventLogs |
Workday-Benutzeraktivität |
Yes |
Yes |
|
ASimDnsActivityLogs |
Windows DNS-Ereignisse über AMA |
Yes |
Yes |
|
ASimNetworkSessionLogs |
Cisco Meraki (mit REST-API) |
Yes |
Yes |
| atlassian_beacon_alerts_CL |
Atlassian Beacon Alerts |
Nein |
Nein |
| Audit_CL |
Mimecast-Überwachung |
Yes |
Yes |
|
AuditLogs |
Microsoft Entra-ID |
Yes |
Yes |
| Audits_Data_CL |
Vectra XDR (mit Azure Functions) |
Yes |
Yes |
| Auth0AM_CL |
Auth0 Access Management (mithilfe von Azure Functions) |
Nein |
Nein |
| Auth0Logs_CL |
Auth0 Logs(via Codeless Connector Framework) |
Yes |
Yes |
| Awareness_Performance_Details_CL |
Mimecast-Sensibilisierungsschulung |
Yes |
Yes |
| Awareness_SafeScore_Details_CL |
Mimecast-Sensibilisierungsschulung |
Yes |
Yes |
| Awareness_User_Data_CL |
Mimecast-Sensibilisierungsschulung |
Yes |
Yes |
| Awareness_Watchlist_Details_CL |
Mimecast-Sensibilisierungsschulung |
Yes |
Yes |
| AWSCloudFront_AccessLog_CL |
Amazon Web Services CloudFront (über Codeless Connector Framework) (Vorschau) |
Yes |
Yes |
|
AWSCloudTrail |
Amazon Web Services S3
Amazon Web Services |
Yes |
Yes |
|
AWSCloudWatch |
Amazon Web Services S3 |
Yes |
Yes |
| AWSEKSLogs_CL |
AWS EKS Data Connector (über Codeless Connector Framework) |
Nein |
Nein |
|
AWSGuardDuty |
Amazon Web Services S3 |
Yes |
Yes |
|
AWSNetworkFirewallFlow |
Amazon Web Services NetworkFirewall (über Codeless Connector Framework) |
Yes |
Yes |
|
AWSRoute53Resolver |
Amazon Web Services S3 DNS Route53 (über Codeless Connector Framework) |
Yes |
Yes |
|
AWSS3ServerAccess |
AWS S3 Server Access Logs (über Codeless Connector Framework) |
Yes |
Yes |
|
AWSSecurityHubFindings |
AWS Security Hub-Ergebnisse (über Codeless Connector Framework) |
Yes |
Yes |
|
AWSVPCFlow |
Amazon Web Services S3 |
Yes |
Yes |
|
AWSWAF |
Amazon Web Services S3 WAF |
Yes |
Yes |
|
AZFWApplicationRule |
Azure Firewall |
Yes |
Yes |
|
AZFWDnsQuery |
Azure Firewall |
Yes |
Yes |
|
AZFWFatFlow |
Azure Firewall |
Yes |
Yes |
|
AZFWFlowTrace |
Azure Firewall |
Yes |
Yes |
|
AZFWIdpsSignature |
Azure Firewall |
Yes |
Yes |
|
AZFWInternalFqdnResolutionFailure |
Azure Firewall |
Yes |
Yes |
|
AZFWNatRule |
Azure Firewall |
Yes |
Yes |
|
AZFWNetworkRule |
Azure Firewall |
Yes |
Yes |
|
AZFWThreatIntel |
Azure Firewall |
Yes |
Yes |
|
AzureActivity |
Azure-Aktivität |
Nein |
Nein |
|
AzureDiagnostics |
Azure Batch-Konto
Azure Cognitive Search
Azure DDoS Protection
Azure Event Hub
Azure Firewall
Azure Key Vault
Azure Kubernetes Service (AKS)
Azure Logic Apps
Azure SQL-Datenbanken
Azure Service Bus
Azure Stream Analytics
Azure Web Application Firewall (WAF)
Netzwerksicherheitsgruppen |
Nein |
Nein |
|
AzureMetrics |
Azure Storage Konto |
Nein |
Nein |
| BetterMTDAppLog_CL |
BETTER Mobile Threat Defense (MTD) |
Nein |
Nein |
| BetterMTDDeviceLog_CL |
BETTER Mobile Threat Defense (MTD) |
Nein |
Nein |
| BetterMTDIncidentLog_CL |
BETTER Mobile Threat Defense (MTD) |
Nein |
Nein |
| BetterMTDNetflowLog_CL |
BETTER Mobile Threat Defense (MTD) |
Nein |
Nein |
| BeyondTrustPM_ActivityAudits_CL |
BeyondTrust PM Cloud |
Yes |
Yes |
| BeyondTrustPM_ClientEvents_CL |
BeyondTrust PM Cloud |
Yes |
Yes |
| BigIDDSPMCatalog_CL |
BigID DSPM Connector |
Yes |
Yes |
| BitglassLogs_CL |
Bitglass (mit Azure Functions) |
Nein |
Nein |
| BitsightAlerts_data_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightBreaches_data_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightCompany_details_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightCompany_rating_details_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightDiligence_historical_statistics_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightDiligence_statistics_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightFindings_data_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightFindings_summary_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightGraph_data_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightIndustrial_statistics_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitsightObservation_statistics_CL |
Bitsight-Datenconnector (mit Azure Functions) |
Yes |
Yes |
| BitwardenEventLogs |
Bitwarden-Ereignisprotokolle |
Nein |
Nein |
| BoxEvents_CL |
Box (mit Azure Functions) |
Nein |
Nein |
| BoxEventsV2_CL |
Box-Ereignisse (CCP) |
Yes |
Yes |
| CarbonBlack_Alerts_CL |
VMware Carbon Black Cloud über AWS S3 (über Codeless Connector Framework) |
Nein |
Nein |
| CarbonBlackAuditLogs_CL |
VMware Carbon Black Cloud (mit Azure Functions) |
Nein |
Nein |
| CarbonBlackEvents_CL |
VMware Carbon Black Cloud (mit Azure Functions) |
Nein |
Nein |
| CarbonBlackNotifications_CL |
VMware Carbon Black Cloud (mit Azure Functions) |
Nein |
Nein |
| CBSLog_AzureV2_CL |
CTM360 CyberBlindSpot (Serverless) |
Nein |
Nein |
| Cisco_Umbrella_audit_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| Cisco_Umbrella_cloudfirewall_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_dlp_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| Cisco_Umbrella_dns_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_fileevent_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| Cisco_Umbrella_firewall_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_intrusion_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| Cisco_Umbrella_ip_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_proxy_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Yes |
Yes |
| Cisco_Umbrella_ravpnlogs_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| Cisco_Umbrella_ztaflow_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| Cisco_Umbrella_ztna_CL |
Cisco Cloud Security (mit Azure Functions)
Cisco Cloud Security (mit elastischem Premium-Plan) (mit Azure Functions) |
Nein |
Nein |
| CiscoDuo_CL |
Cisco Duo Security (mit Azure Functions) |
Nein |
Nein |
| CiscoETD_CL |
Cisco ETD (mit Azure Functions) |
Nein |
Nein |
| CiscoSDWANNetflow_CL |
Cisco Software Defined WAN |
Nein |
Nein |
| CiscoSecureEndpointAuditLogsV2_CL |
Cisco Secure Endpoint (über Codeless Connector Framework) |
Yes |
Yes |
| CiscoSecureEndpointEventsV2_CL |
Cisco Secure Endpoint (über Codeless Connector Framework) |
Yes |
Yes |
| Cloud_Integrated_CL |
Mimecast Cloud Integrated |
Yes |
Yes |
|
CloudAppEvents |
Microsoft Defender XDR |
Yes |
Yes |
| Cloudflare_CL |
Cloudflare (Vorschau) (mit Azure Functions) |
Yes |
Yes |
| CloudflareV2_CL |
Cloudflare (Using Blob Container) (via Codeless Connector Framework) |
Yes |
Yes |
| CloudGuard_SecurityEvents_CL |
Check Point CloudGuard CNAPP Connector für Microsoft Sentinel |
Yes |
Yes |
| CognniIncidents_CL |
Cognni |
Yes |
Yes |
| Cohesity_CL |
Cohesity (mit Azure Functions) |
Yes |
Yes |
|
CommonSecurityLog |
Cisco ASA/FTD über AMA
Claroty xDome
Infoblox Cloud Data Connector über AMA
Infoblox SOC Insight Data Connector über AMA
Silverfort Admin Console
VirtualMetric DataStream für Microsoft Sentinel Data Lake
VirtualMetric DataStream für Microsoft Sentinel
VirtualMetric Director Proxy
[Veraltet] Infoblox SOC Insight Data Connector über Legacy Agent |
Yes |
Yes |
| CommvaultAlerts_CL |
CommvaultSecurityIQ |
Yes |
Yes |
| ConfluenceAuditLogs_CL |
Atlassian Confluence Audit (über Codeless Connector Framework) |
Yes |
Yes |
| ContrastADR_CL |
ContrastADR |
Nein |
Nein |
| ContrastADRIncident_CL |
ContrastADR |
Nein |
Nein |
|
CopilotActivity |
Microsoft Copilot |
Nein |
Yes |
| Corelight |
Corelight Connector Exporter |
Nein |
Nein |
| CortexXDR_Incidents_CL |
Cortex XDR - Vorfälle |
Yes |
Yes |
| CortexXpanseAlerts_CL |
Palo Alto Cortex Xpanse (über Codeless Connector Framework) |
Yes |
Yes |
| CriblInternal_CL |
Cribl |
Nein |
Nein |
| CrowdStrike_Additional_Events_CL |
CrowdStrike Falcon Data Replicator (AWS S3) (über Codeless Connector Framework) |
Yes |
Yes |
|
CrowdStrikeAlerts |
CrowdStrike API Data Connector (über Codeless Connector Framework) |
Yes |
Yes |
| CrowdStrikeReplicatorV2 |
CrowdStrike Falcon Data Replicator (CrowdStrike Managed AWS-S3) (mit Azure Functions) |
Nein |
Nein |
| CyberArk_AuditEvents_CL |
CyberArk Audit
CyberArkAudit (mit Azure Functions) |
Yes |
Yes |
| CyberpionActionItems_CL |
IONIX-Sicherheitsprotokolle (über Codeless Connector Framework)
[VERALTET] IONIX Sicherheitsprotokolle (Push) |
Nein |
Nein |
| CyberSixgill_Alerts_CL |
Cybersixgill Actionable Alerts (using Azure Functions) |
Nein |
Nein |
| CybleVisionAlerts_CL |
Cyble Vision Alerts |
Nein |
Nein |
| CyeraAssets_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
Nein |
Nein |
| CyeraAssets_MS_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
Nein |
Nein |
| CyeraClassifications_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
Nein |
Nein |
| CyeraIdentities_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
Nein |
Nein |
| CyeraIssues_CL |
Cyera DSPM Microsoft Sentinel Data Connector |
Nein |
Nein |
| CyfirmaASCertificatesAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASCloudWeaknessAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASConfigurationAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASDomainIPReputationAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASDomainIPVulnerabilityAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaASOpenPortsAlerts_CL |
CYFIRMA Attack Surface |
Yes |
Yes |
| CyfirmaBIDomainITAssetAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBIExecutivePeopleAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBIMaliciousMobileAppsAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBIProductSolutionAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaBISocialHandlersAlerts_CL |
CYFIRMA Brand Intelligence |
Yes |
Yes |
| CyfirmaCampaigns_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaCompromisedAccounts_CL |
CYFIRMA Kompromittierte Konten |
Yes |
Yes |
| CyfirmaDBWMDarkWebAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaDBWMPhishingAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaDBWMRansomwareAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaIndicators_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaMalware_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaSPEConfidentialFilesAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaSPEPIIAndCIIAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaSPESocialThreatAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaSPESourceCodeAlerts_CL |
CYFIRMA Digital Risk |
Yes |
Yes |
| CyfirmaThreatActors_CL |
CYFIRMA Cyber Intelligence |
Yes |
Yes |
| CyfirmaVulnerabilities_CL |
CYFIRMA Vulnerabilities Intelligence |
Yes |
Yes |
| Cymru_Scout_Account_Usage_Data_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_Domain_Data_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Communications_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Details_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Fingerprints_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Foundation_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_OpenPorts_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_PDNS_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Summary_Certs_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Summary_Details_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Summary_Fingerprints_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Summary_OpenPorts_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_Summary_PDNS_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| Cymru_Scout_IP_Data_x509_CL |
Team Cymru Scout Data Connector (mit Azure Functions) |
Nein |
Nein |
| CynerioEvent_CL |
Cynerio-Sicherheitsereignisse |
Nein |
Nein |
| Cyren_Indicators_CL |
Cyren Threat Intelligence |
Nein |
Nein |
| darktrace_model_alerts_CL |
Darktrace Connector für Microsoft Sentinel REST-API |
Yes |
Yes |
| databahn_alerts_CL |
DataBahn |
Nein |
Nein |
| databahn_audit_logs_CL |
DataBahn |
Nein |
Nein |
| databahn_device_inventory_CL |
DataBahn |
Nein |
Nein |
| DataminrPulse_Alerts_CL |
Dataminr Pulse Alerts Data Connector (mit Azure Functions) |
Nein |
Nein |
|
DataverseActivity |
Microsoft Dataverse |
Yes |
Yes |
| datawizaserveraccess_CL |
Datawiza DAP |
Nein |
Nein |
| Detections_Data_CL |
Vectra XDR (mit Azure Functions) |
Yes |
Yes |
|
DeviceEvents |
Microsoft Defender XDR |
Yes |
Yes |
| DigitalShadows_CL |
Digital Shadows Searchlight (mit Azure Functions) |
Yes |
Yes |
|
DnsEvents |
DNS |
Yes |
Yes |
|
DnsInventory |
DNS |
Yes |
Yes |
| DoppelTable_CL |
Doppeldatenconnector |
Nein |
Nein |
| dossier_atp_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_atp_threat_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_dns_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_geo_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_infoblox_web_cat_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_inforank_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_malware_analysis_v3_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_nameserver_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_nameserver_matches_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_ptr_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_rpz_feeds_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_rpz_feeds_records_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_threat_actor_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_tld_risk_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_whitelist_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| dossier_whois_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| DragosAlerts_CL |
Dragos-Benachrichtigungen über Cloud Sitestore |
Yes |
Yes |
| DruvaSecurityEvents_CL |
Druva Events Connector |
Yes |
Yes |
| Dynamics365Activity |
Dynamics365 |
Yes |
Nein |
| DynatraceAttacks_CL |
Dynatrace-Angriffe |
Nein |
Nein |
| DynatraceAuditLogs_CL |
Dynatrace-Überwachungsprotokolle |
Yes |
Yes |
| DynatraceProblems_CL |
Dynatrace-Probleme |
Nein |
Nein |
| DynatraceSecurityProblems_CL |
Sicherheitsanfälligkeiten in Dynatrace Runtime |
Nein |
Nein |
| ElasticAgentEvent |
Elastic Agent (eigenständig) |
Nein |
Nein |
|
EmailEvents |
Microsoft Defender XDR |
Yes |
Yes |
| Entities_Data_CL |
Vectra XDR (mit Azure Functions) |
Yes |
Yes |
| Entity_Scoring_Data_CL |
Vectra XDR (mit Azure Functions) |
Yes |
Yes |
| ErmesBrowserSecurityEvents_CL |
Ermes Browser-Sicherheitsereignisse |
Yes |
Yes |
| ESIExchangeConfig_CL |
Exchange Security Insights On-Premises Collector |
Nein |
Nein |
| ESIExchangeOnlineConfig_CL |
Exchange Security Insights Online Collector (mit Azure Functions) |
Nein |
Nein |
|
Ereignis |
Automatisierte Logik-WebCTRL
Microsoft Exchange Administratorüberwachungsprotokolle nach Ereignisprotokollen
Microsoft Exchange Protokolle und Ereignisse
[veraltet] Microsoft Exchange Protokolle und Ereignisse |
Yes |
Nein |
| eventsapplicationdata_CL |
Netskope Data Connector |
Nein |
Nein |
| eventsauditdata_CL |
Netskope Data Connector |
Nein |
Nein |
| eventsconnectiondata_CL |
Netskope Data Connector |
Nein |
Nein |
| eventsincidentdata_CL |
Netskope Data Connector |
Nein |
Nein |
| eventsnetworkdata_CL |
Netskope Data Connector |
Nein |
Nein |
| eventspagedata_CL |
Netskope Data Connector |
Nein |
Nein |
| ExchangeHttpProxy_CL |
Microsoft Exchange HTTP-Proxyprotokolle
[veraltet] Microsoft Exchange Protokolle und Ereignisse |
Yes |
Yes |
| ExtraHop_Detections_CL |
ExtraHop Detections Data Connector (mithilfe von Azure Functions) |
Nein |
Nein |
| F5Telemetry_ASM_CL |
F5 BIG-IP |
Nein |
Nein |
| F5Telemetry_LTM_CL |
F5 BIG-IP |
Nein |
Nein |
| F5Telemetry_system_CL |
F5 BIG-IP |
Yes |
Yes |
| Failed_Range_To_Ingest_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| feedly_indicators_CL |
Feedly IoC |
Nein |
Nein |
| FinanceOperationsActivity_CL |
Dynamics 365 Finance und Operations |
Yes |
Yes |
| FireworkV2_CL |
Flare Push Connector |
Yes |
Yes |
| fluentbit_CL |
Azure CloudNGFW by Palo Alto Networks |
Yes |
Yes |
| FncEventsDetections_CL |
Fortinet FortiNDR Cloud |
Nein |
Nein |
| FncEventsObservation_CL |
Fortinet FortiNDR Cloud |
Nein |
Nein |
| FncEventsSuricata_CL |
Fortinet FortiNDR Cloud |
Nein |
Nein |
| ForcepointDLPEvents_CL |
Erzwingen von DLP |
Nein |
Nein |
| ForefinderEvent |
Forefinder |
Nein |
Nein |
| ForescoutHostProperties_CL |
Forefinder Host Property Monitor |
Yes |
Yes |
| Garrison_ULTRARemoteLogs_CL |
Garrison ULTRA Remote Logs (mit Azure Functions) |
Nein |
Nein |
|
GCPApigee |
Google ApigeeX (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPAuditLogs |
GCP Pub/Sub-Überwachungsprotokolle |
Yes |
Yes |
|
GCPCDN |
Google Cloud Platform CDN (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPCloudRun |
GCP Cloud Run (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPCloudSQL |
GCP Cloud SQL (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPComputeEngine |
Google Cloud Platform Compute Engine (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPDNS |
Google Cloud Platform DNS (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPIAM |
Google Cloud Platform IAM (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPIDS |
Google Cloud Platform Cloud IDS (über Codeless Connector Framework) |
Yes |
Yes |
| GCPLoadBalancerLogs_CL |
GCP Pub/Sub Load Balancer Logs (via Codeless Connector Platform). |
Yes |
Yes |
|
GCPMonitoring |
Google Cloud Platform Cloud Monitoring (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPNAT |
Google Cloud Platform NAT (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPNATAudit |
Google Cloud Platform NAT (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPResourceManager |
Google Cloud Platform Resource Manager (über Codeless Connector Framework) |
Yes |
Yes |
|
GCPVPCFlow |
GCP Pub/Sub FEATURE FLOW Logs (via Codeless Connector Framework) |
Yes |
Yes |
| GigamonV2_CL |
Gigamon AMX Connector |
Nein |
Nein |
| GitHubAuditLogPolling_CL |
[Veraltet] GitHub Unternehmensüberwachungsprotokoll |
Yes |
Yes |
| GitHubAuditLogsV2_CL |
GitHub Enterprise-Überwachungsprotokoll (über Codeless Connector Framework) |
Yes |
Yes |
| githubscanaudit_CL |
GitHub (mit Webhooks) |
Yes |
Yes |
|
GKEAudit |
Google Kubernetes Engine (über Codeless Connector Framework) |
Yes |
Yes |
|
GoogleCloudSCC |
Google Security Command Center |
Yes |
Yes |
|
GoogleWorkspaceReports |
Google Workspace-Aktivitäten (über Codeless Connector Framework) |
Yes |
Yes |
| HackerViewLog_AzureV2_CL |
CTM360 HackerView (Serverless) |
Nein |
Nein |
| HalcyonAuthenticationEvents_CL |
Halcyon Connector |
Yes |
Yes |
| HalcyonDnsActivity_CL |
Halcyon Connector |
Yes |
Yes |
| HalcyonFileActivity_CL |
Halcyon Connector |
Yes |
Yes |
| HalcyonNetworkSession_CL |
Halcyon Connector |
Yes |
Yes |
| HalcyonProcessEvent_CL |
Halcyon Connector |
Yes |
Yes |
| Health_Data_CL |
Vectra XDR (mit Azure Functions) |
Yes |
Yes |
|
IdentityLogonEvents |
Microsoft Defender XDR |
Yes |
Yes |
| Illumio_Auditable_Events_CL |
Illumio SaaS (mit Azure Functions) |
Yes |
Yes |
| Illumio_Flow_Events_CL |
Illumio SaaS (mit Azure Functions) |
Yes |
Yes |
| IllumioInsightsSummary_CL |
Illumio Insights Zusammenfassung |
Nein |
Nein |
|
IlumioInsights |
Illumio Insights |
Yes |
Yes |
| ImpervaWAFCloud_CL |
Imperva Cloud WAF (mit Azure Functions) |
Yes |
Yes |
| Infoblox_Failed_Indicators_CL |
Infoblox Data Connector über REST-API |
Nein |
Nein |
| InfobloxInsight_CL |
Infoblox SOC Insight Data Connector über REST-API |
Nein |
Nein |
| InfoSecAnalytics_CL |
InfoSecGlobal Data Connector |
Nein |
Nein |
| IntegrationTable_CL |
ESET Protect Platform (mit Azure Functions) |
Yes |
Yes |
| IntegrationTableIncidents_CL |
ESET Protect Platform (mit Azure Functions) |
Yes |
Yes |
| iocsent_CL |
Check Point Cyberint IOC Connector |
Nein |
Nein |
| Ipinfo_Abuse_CL |
IPinfo–Datenkonnektor für Missbrauch |
Nein |
Nein |
| Ipinfo_ASN_CL |
IPinfo ASN Data Connector |
Nein |
Nein |
| Ipinfo_Carrier_CL |
IPinfo-Netzbetreiberdatenkonnektor |
Nein |
Nein |
| Ipinfo_Company_CL |
IPinfo Company Data Connector |
Nein |
Nein |
| Ipinfo_CORE_CL |
IPinfo Core Data Connector |
Nein |
Nein |
| Ipinfo_Country_CL |
IPinfo Country ASN Data Connector |
Nein |
Nein |
| Ipinfo_Domain_CL |
IPinfo Domain Data Connector |
Nein |
Nein |
| Ipinfo_Location_CL |
IPinfo Iplocation Data Connector |
Nein |
Nein |
| Ipinfo_Location_extended_CL |
IPinfo Iplocation Extended Data Connector |
Nein |
Nein |
| Ipinfo_PLUS_CL |
IPinfo Plus Data Connector |
Nein |
Nein |
| Ipinfo_Privacy_CL |
IPinfo Privacy Data Connector |
Nein |
Nein |
| Ipinfo_Privacy_extended_CL |
IPinfo Privacy Extended Data Connector |
Nein |
Nein |
| Ipinfo_RESIDENTIAL_PROXY_CL |
IPinfo ResProxy Data Connector |
Nein |
Nein |
| Ipinfo_RIRWHOIS_CL |
IPinfo RIRWHOIS Data Connector |
Nein |
Nein |
| Ipinfo_RWHOIS_CL |
IPinfo RWHOIS Data Connector |
Nein |
Nein |
| Ipinfo_WHOIS_ASN_CL |
IPinfo WHOIS ASN Data Connector |
Nein |
Nein |
| Ipinfo_WHOIS_MNT_CL |
IPinfo WHOIS MNT Data Connector |
Nein |
Nein |
| Ipinfo_WHOIS_NET_CL |
IPinfo WHOIS NET Data Connector |
Nein |
Nein |
| Ipinfo_WHOIS_ORG_CL |
IPinfo WHOIS ORG Data Connector |
Nein |
Nein |
| Ipinfo_WHOIS_POC_CL |
IPinfo WHOIS POC Data Connector |
Nein |
Nein |
| Island_Admin_CL |
Island Enterprise Browser Admin Audit (Polling CCP) |
Yes |
Yes |
| Island_User_CL |
Island Enterprise-Browser-Benutzeraktivität (Polling CCP) |
Yes |
Yes |
| jamfprotectalerts_CL |
Jamf Protect Push Connector |
Yes |
Yes |
| jamfprotecttelemetryv2_CL |
Jamf Protect Push Connector |
Yes |
Yes |
| jamfprotectunifiedlogs_CL |
Jamf Protect Push Connector |
Yes |
Yes |
| JBossEvent_CL |
Benutzerdefinierte Protokolle über AMA |
Nein |
Nein |
| Jira_Audit_CL |
Atlassian Jira Audit (mit Azure Functions) |
Nein |
Nein |
| Jira_Audit_v2_CL |
Atlassian Jira Audit (über Codeless Connector Framework) |
Yes |
Yes |
| JuniperIDP_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| KeeperSecurityEventNewLogs_CL |
Keeper Security Push Connector |
Yes |
Yes |
| LastPassNativePoller_CL |
LastPass Enterprise - Reporting (Polling CCP) |
Nein |
Nein |
| LightningAttackPaths_CL |
Semperis Lightning Logs |
Nein |
Nein |
| LightningIOEResults_CL |
Semperis Lightning Logs |
Nein |
Nein |
| LightningTier0Nodes_CL |
Semperis Lightning Logs |
Nein |
Nein |
| Lockdown_Data_CL |
Vectra XDR (mit Azure Functions) |
Yes |
Yes |
| Lookout_CL |
[VERALTET] Suche |
Nein |
Nein |
| LookoutMtdV2_CL |
Lookout Mobile Threat Detection Connector (über Codeless Connector Framework) (Vorschau) |
Yes |
Yes |
| MailGuard365_Threats_CL |
MailGuard 365 |
Yes |
Yes |
| MailRiskEmails_CL |
MailRisk by Secure Practice (using Azure Functions) |
Nein |
Nein |
| MarkLogicAudit_CL |
Benutzerdefinierte Protokolle über AMA |
Nein |
Nein |
| McasShadowItReporting |
Microsoft Defender für Cloud-Apps |
Nein |
Nein |
| MDBALogTable_CL |
MongoDB Atlas Logs |
Yes |
Yes |
| meraki_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| MessageTrackingLog_CL |
Microsoft Exchange Nachrichtenverfolgungsprotokolle
[veraltet] Microsoft Exchange Protokolle und Ereignisse |
Yes |
Yes |
|
MicrosoftPurviewInformationProtection |
Microsoft Purview Information Protection |
Yes |
Yes |
| MimecastAudit_CL |
Mimecast Audit & Authentifizierung (mit Azure Functions) |
Nein |
Nein |
| MimecastDLP_CL |
Mimecast Secure Email Gateway (mit Azure Functions) |
Nein |
Nein |
| MimecastSIEM_CL |
Mimecast Secure Email Gateway (mit Azure Functions) |
Nein |
Nein |
| MimecastTTPAttachment_CL |
Mimecast Targeted Threat Protection (mit Azure Functions) |
Nein |
Nein |
| MimecastTTPImpersonation_CL |
Mimecast Targeted Threat Protection (mit Azure Functions) |
Nein |
Nein |
| MimecastTTPUrl_CL |
Mimecast Targeted Threat Protection (mit Azure Functions) |
Nein |
Nein |
| MongoDBAudit_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| MuleSoft_Cloudhub_CL |
MuleSoft Cloudhub (mit Azure Functions) |
Nein |
Nein |
| NCProtectUAL_CL |
NC Protect |
Nein |
Nein |
| net_assets_CL |
Holm Security Asset Data (using Azure Functions) |
Nein |
Nein |
| Netskope_WebTx_metrics_CL |
Netskope Data Connector |
Nein |
Nein |
| NetskopeAlerts_CL |
Netskope-Warnungen und -Ereignisse |
Yes |
Yes |
| NetskopeWebtxData_CL |
Netskope Web Transactions Data Connector |
Nein |
Nein |
| NetskopeWebtxErrors_CL |
Netskope Web Transactions Data Connector |
Nein |
Nein |
|
NetworkAccessTraffic |
Microsoft Entra-ID |
Yes |
Yes |
| NexposeInsightVMCloud_assets_CL |
Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) |
Nein |
Nein |
| NexposeInsightVMCloud_vulnerabilities_CL |
Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) |
Nein |
Nein |
| NGINX_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| NordPassEventLogs_CL |
NordPass |
Yes |
Yes |
| ObsidianActivity_CL |
Obsidian Datasharing Connector |
Nein |
Nein |
| ObsidianThreat_CL |
Obsidian Datasharing Connector |
Nein |
Nein |
| OCI_LogsV2_CL |
Oracle Cloud Infrastructure (über Codeless Connector Framework) |
Yes |
Yes |
|
OfficeActivity |
Microsoft 365 (früher Office 365) |
Yes |
Yes |
| Okta_CL |
Okta Single Sign-On (mit Azure Functions) |
Nein |
Nein |
| OktaSSO |
Okta Single Sign-On |
Nein |
Nein |
| Onapsis_Defend_CL |
Onapsis defend: Integration nicht übereinstimmender SAP-Bedrohungserkennung & Intel mit Microsoft Sentinel |
Yes |
Yes |
| OneLoginEventsV2_CL |
OneLogin IAM Platform (über Codeless Connector Framework) |
Yes |
Yes |
| OneLoginUsersV2_CL |
OneLogin IAM Platform (über Codeless Connector Framework) |
Yes |
Yes |
| OnePasswordEventLogs_CL |
1Password (Serverless)
1Password (mit Azure Functions) |
Yes |
Yes |
| OneTrustMetadataV3_CL |
OneTrust |
Yes |
Yes |
| OpenSystemsAuthenticationLogs_CL |
Open Systems Data Connector |
Nein |
Nein |
| OpenSystemsFirewallLogs_CL |
Open Systems Data Connector |
Nein |
Nein |
| OpenSystemsProxyLogs_CL |
Open Systems Data Connector |
Nein |
Nein |
| OpenSystemsZtnaLogs_CL |
Open Systems Data Connector |
Nein |
Nein |
| OracleWebLogicServer_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| OrcaAlerts_CL |
Orca-Sicherheitswarnungen |
Yes |
Yes |
| PaloAltoCortexXDR_Alerts_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Audit_Agent_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Audit_Management_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Endpoints_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoCortexXDR_Incidents_CL |
Palo Alto Cortex XDR |
Yes |
Yes |
| PaloAltoPrismaCloudAlertV2_CL |
Palo Alto Prisma Cloud CSPM (über Codeless Connector Framework) |
Yes |
Yes |
| Perimeter81_CL |
Perimeter 81-Aktivitätsprotokolle |
Nein |
Nein |
| Phosphorus_CL |
Phosphorgeräte |
Nein |
Nein |
| PingOne_AuditActivitiesV2_CL |
Ping One (über Codeless Connector Framework) |
Yes |
Yes |
| PostgreSQL_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
|
PowerAutomateActivity |
Microsoft Power Automate |
Yes |
Yes |
|
PowerBIActivity |
Microsoft PowerBI |
Yes |
Yes |
|
PowerPlatformAdminActivity |
Microsoft Power Platform Administratoraktivität |
Yes |
Yes |
| prancer_CL |
Prancer Data Connector |
Nein |
Nein |
| PrismaCloudCompute_CL |
Palo Alto Prisma Cloud CWPP (mit REST-API) |
Yes |
Yes |
|
ProjectActivity |
Microsoft Project |
Yes |
Yes |
| ProofpointPODMailLog_CL |
Proofpoint On Demand-E-Mail-Sicherheit (über codeless Connector Platform) |
Yes |
Yes |
| ProofpointPODMessage_CL |
Proofpoint On Demand-E-Mail-Sicherheit (über codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPClicksBlockedV2_CL |
Proofpoint TAP (über Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPClicksPermittedV2_CL |
Proofpoint TAP (über Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPMessagesBlockedV2_CL |
Proofpoint TAP (über Codeless Connector Platform) |
Yes |
Yes |
| ProofPointTAPMessagesDeliveredV2_CL |
Proofpoint TAP (über Codeless Connector Platform) |
Yes |
Yes |
|
PurviewDataSensitivityLogs |
Microsoft Purview |
Yes |
Yes |
| QscoutAppEvents_CL |
QfinderAppEventsConnector (über Codeless Connector Framework) |
Nein |
Nein |
| QualysHostDetectionV3_CL |
Qualys Vulnerability Management (über Codeless Connector Framework) |
Yes |
Yes |
| QualysKB_CL |
Qualys VM KnowledgeBase (mit Azure Functions) |
Yes |
Yes |
| RadiflowEvent |
Radiflow iSID via AMA |
Nein |
Nein |
| RSAIDPlus_AdminLogs_CL |
RSA ID Plus Admin Logs Connector |
Nein |
Nein |
| Rubrik_Anomaly_Data_CL |
Rubrik Security Cloud Data Connector (mit Azure Functions) |
Yes |
Yes |
| Rubrik_Events_Data_CL |
Rubrik Security Cloud Data Connector (mit Azure Functions) |
Yes |
Yes |
| Rubrik_Ransomware_Data_CL |
Rubrik Security Cloud Data Connector (mit Azure Functions) |
Yes |
Yes |
| Rubrik_ThreatHunt_Data_CL |
Rubrik Security Cloud Data Connector (mit Azure Functions) |
Yes |
Yes |
| SailPointIDN_Events_CL |
SailPoint IdentityNow (mit Azure Functions) |
Yes |
Yes |
| SailPointIDN_Triggers_CL |
SailPoint IdentityNow (mit Azure Functions) |
Nein |
Nein |
| SalesforceServiceCloudV2_CL |
Salesforce Service Cloud (über Codeless Connector Framework) |
Yes |
Yes |
| Samsung_Knox_Audit_CL |
Samsung Knox Asset Intelligence |
Yes |
Yes |
| SAPBTPAuditLog_CL |
SAP BTP |
Yes |
Yes |
| SAPETDAlerts_CL |
SAP Enterprise Threat Detection, Cloud Edition |
Yes |
Yes |
| SAPETDInvestigations_CL |
SAP Enterprise Threat Detection, Cloud Edition |
Yes |
Yes |
| SAPLogServ_CL |
SAP LogServ (RISE), S/4HANA Cloud Private Edition |
Yes |
Yes |
|
SecurityAlert |
Microsoft 365 Insider-Risikomanagement
Microsoft Defender XDR
Microsoft Defender für Endpunkt
Microsoft Defender for Identity
Microsoft Defender für IoT
Microsoft Defender for Office 365 (Vorschau)
Microsoft Entra ID-Schutz
Subscription-basierte Microsoft Defender for Cloud (Legacy)
Tenant-basierte Microsoft Defender for Cloud |
Yes |
Yes |
| SecurityAlert |
Microsoft Defender für Cloud-Apps |
Nein |
Nein |
| SecurityBridgeLogs_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
|
SecurityEvent |
Cyborg Security HUNTER Hunt Pakete
Sicherheitsprotokolle für Microsoft Active-Directory-Domänencontroller
Sicherheitsereignisse über Legacy-Agent
Windows Security Ereignisse über AMA
[veraltet] Microsoft Exchange Protokolle und Ereignisse |
Yes |
Yes |
| SecurityIncident |
Derdack SIGNL4
Microsoft Defender XDR |
Yes |
Yes |
| Seg_Cg_CL |
Mimecast Secure Email Gateway |
Yes |
Yes |
| Seg_Dlp_CL |
Mimecast Secure Email Gateway |
Yes |
Yes |
| SentinelOne_CL |
SentinelOne (mit Azure Functions) |
Yes |
Yes |
| SentinelOneActivities_CL |
SentinelOne |
Yes |
Yes |
| SentinelOneAgents_CL |
SentinelOne |
Yes |
Yes |
| SentinelOneAlerts_CL |
SentinelOne |
Yes |
Yes |
| SentinelOneGroups_CL |
SentinelOne |
Yes |
Yes |
| SentinelOneThreats_CL |
SentinelOne |
Yes |
Yes |
| SeraphicWebSecurity_CL |
Seraphic Web Security |
Nein |
Nein |
|
SigninLogs |
Microsoft Entra-ID |
Yes |
Yes |
| SlackAuditV2_CL |
SlackAudit (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeLoad_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeLogin_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeMaterializedView_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeQuery_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeRoleGrant_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeRoles_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeTables_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeTableStorageMetrics_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeUserGrant_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SnowflakeUsers_CL |
Snowflake (über Codeless Connector Framework) |
Yes |
Yes |
| SOCPrimeAuditLogs_CL |
SOC Prime Platform Audit Logs Data Connector |
Yes |
Yes |
| Sonrai_Tickets_CL |
Sonrai Data Connector |
Nein |
Nein |
| SophosEP_CL |
Sophos Endpoint Protection (mit Azure Functions) |
Yes |
Yes |
| SophosEPEvents_CL |
Sophos Endpoint Protection (über Codeless Connector Platform) |
Yes |
Yes |
| SquidProxy_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
|
StorageBlobLogs |
Azure Storage Konto |
Yes |
Yes |
|
StorageFileLogs |
Azure Storage Konto |
Yes |
Yes |
|
StorageQueueLogs |
Azure Storage Konto |
Yes |
Yes |
|
StorageTableLogs |
Azure Storage Konto |
Yes |
Yes |
| SymantecICDx_CL |
Symantec Integrated Cyber Defense Exchange |
Nein |
Nein |
|
Syslog |
CTERA Syslog
Cisco Software Defined WAN
Syslog über AMA
Syslog über Legacy-Agent |
Yes |
Yes |
| TacitRed_Findings_CL |
Implizite kompromittierte Anmeldeinformationen |
Nein |
Nein |
| Talon_CL |
Talon Insights |
Nein |
Nein |
| Tenable_VM_Asset_CL |
Tenable Vulnerability Management (mithilfe von Azure Functions) |
Yes |
Yes |
| Tenable_VM_Compliance_CL |
Tenable Vulnerability Management (mithilfe von Azure Functions) |
Yes |
Yes |
| Tenable_VM_Vuln_CL |
Tenable Vulnerability Management (mithilfe von Azure Functions) |
Yes |
Yes |
| Tenable_WAS_Asset_CL |
Tenable Vulnerability Management (mithilfe von Azure Functions) |
Yes |
Yes |
| Tenable_WAS_Vuln_CL |
Tenable Vulnerability Management (mithilfe von Azure Functions) |
Yes |
Yes |
| TheHiveData |
TheHive (über Codeless Connector Framework) |
Nein |
Nein |
| TheomAlerts_CL |
Theom |
Nein |
Nein |
|
ThreatIntelIndicators |
CrowdStrike Falcon Adversary Intelligence (mit Azure Functions) |
Yes |
Nein |
|
ThreatIntelligenceIndicator |
Datalake2Sentinel
GreyNoise Threat Intelligence
JoeSandboxThreatIntelligence (mit Azure Functions)
Luminar IOCs und durchleckte Anmeldeinformationen (mit Azure Functions)
MISP2Sentinel
Microsoft Defender Threat Intelligence
Mimecast Intelligence für Microsoft – Microsoft Sentinel (mit Azure Functions)
Premium Microsoft Defender Threat Intelligence
Threat Intelligence-Plattformen
Threat Intelligence-Upload-API (Vorschau)
Bedrohungserkennung - TAXII
VMRayThreatIntelligence (mit Azure Functions) |
Yes |
Nein |
| Tomcat_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| TransmitSecurityActivity_CL |
Transmit Security Connector (mit Azure Functions) |
Nein |
Nein |
| TrellixEvents |
Trellix Endpoint Security (über Codeless Connector Framework) |
Nein |
Nein |
| TrendMicro_XDR_OAT_CL |
Trend Vision One (mit Azure Functions) |
Nein |
Nein |
| TrendMicro_XDR_RCA_Result_CL |
Trend Vision One (mit Azure Functions) |
Nein |
Nein |
| TrendMicro_XDR_RCA_Task_CL |
Trend Vision One (mit Azure Functions) |
Nein |
Nein |
| TrendMicro_XDR_WORKBENCH_CL |
Trend Vision One (mit Azure Functions) |
Nein |
Nein |
| Ttp_Attachment_CL |
Mimecast Targeted Threat Protection |
Yes |
Yes |
| Ttp_Impersonation_CL |
Mimecast Targeted Threat Protection |
Yes |
Yes |
| Ttp_Url_CL |
Mimecast Targeted Threat Protection |
Yes |
Yes |
| Ubiquiti_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| union ASimAuditEventLogs, ASimAuthenticationEventLogs, ASimDhcpEventLogs, ASimDnsActivityLogs, ASimFileEventLogs, ASimNetworkSessionLogs, ASimProcessEventLogs, ASimRegistryEventLogs, ASimUserManagementActivityLogs, ASimWebSessionLogs |
Synqly-Integrationsconnector |
Nein |
Nein |
| union isfuzzy=true (WizAuditLogs_CL),(WizAuditLogsV2_CL) |
Wiz (mit Azure Functions) |
Nein |
Nein |
| union isfuzzy=true (WizIssues_CL),(WizIssuesV2_CL) |
Wiz (mit Azure Functions) |
Nein |
Nein |
| union isfuzzy=true (WizVulnerabilities_CL),(WizVulnerabilitiesV2_CL) |
Wiz (mit Azure Functions) |
Nein |
Nein |
| ValenceAlert_CL |
SaaS-Sicherheit |
Nein |
Nein |
| VaronisAlerts_CL |
Varonis SaaS |
Nein |
Nein |
| varonisresources_CL |
Varonis Purview Push Connector |
Nein |
Nein |
| vcenter_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |
| VectraStream_CL |
Benutzerdefinierte Protokolle über AMA |
Nein |
Nein |
| VeeamAuthorizationEvents_CL |
Veeam Data Connector (mit Azure Functions) |
Yes |
Yes |
| VeeamCovewareFindings_CL |
Veeam Data Connector (mit Azure Functions) |
Yes |
Yes |
| VeeamMalwareEvents_CL |
Veeam Data Connector (mit Azure Functions) |
Yes |
Yes |
| VeeamOneTriggeredAlarms_CL |
Veeam Data Connector (mit Azure Functions) |
Yes |
Yes |
| VeeamSecurityComplianceAnalyzer_CL |
Veeam Data Connector (mit Azure Functions) |
Yes |
Yes |
| VeeamSessions_CL |
Veeam Data Connector (mit Azure Functions) |
Yes |
Yes |
| VersasecCmsErrorLogs_CL |
VersasecCms |
Nein |
Nein |
| VersasecCmsSysLogs_CL |
VersasecCms |
Nein |
Nein |
|
W3CIISLog |
IIS-Protokolle von Microsoft Exchange Servern
[veraltet] Microsoft Exchange Protokolle und Ereignisse |
Yes |
Nein |
| web_assets_CL |
Holm Security Asset Data (using Azure Functions) |
Nein |
Nein |
|
WindowsEvent |
Windows Weitergeleitete Ereignisse |
Yes |
Yes |
| Workplace_Facebook_CL |
Workplace von Facebook (mit Azure Functions) |
Nein |
Nein |
| WsSecurityEvents_CL |
WithSecure Elements API (Azure Function) |
Yes |
Yes |
| XbowAssessments_CL |
XBOW-Sicherheitsplattform (über Azure-Funktion) |
Nein |
Nein |
| XbowAssets_CL |
XBOW-Sicherheitsplattform (über Azure-Funktion) |
Nein |
Nein |
| XbowFindings_CL |
XBOW-Sicherheitsplattform (über Azure-Funktion) |
Nein |
Nein |
| ZeroFox_CTI_advanced_dark_web_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_botnet_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_breaches_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_C2_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_compromised_credentials_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_credit_cards_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_dark_web_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_discord_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_disruption_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_email_addresses_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_exploits_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_irc_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_malware_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_national_ids_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_phishing_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_phone_numbers_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_ransomware_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_telegram_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_threat_actors_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFox_CTI_vulnerabilities_CL |
ZeroFox CTI |
Nein |
Nein |
| ZeroFoxAlertPoller_CL |
ZeroFox Enterprise - Alerts (Polling CCF) |
Yes |
Yes |
| ZimperiumThreatLog_CL |
Zimperium Mobile Threat Defense |
Nein |
Nein |
| ZNAudit_CL |
Zero Networks Segment (Push) |
Nein |
Nein |
| ZNIdentityActivity_CL |
Zero Networks Segment (Push) |
Nein |
Nein |
| ZNNetworkActivity_CL |
Zero Networks Segment (Push) |
Nein |
Nein |
| ZNRPCActivity_CL |
Zero Networks Segment (Push) |
Nein |
Nein |
| ZNSegmentAuditNativePoller_CL |
Zero Networks Segment Audit |
Nein |
Nein |
| Zoom_CL |
Zoom-Berichte (mithilfe von Azure Functions) |
Yes |
Yes |
| ZoomV2_CL |
Zoomberichtsconnector (über Codeless Connector Framework) |
Nein |
Nein |
| ZPA_CL |
Benutzerdefinierte Protokolle über AMA |
Yes |
Yes |