af01292940d7426594d3d3e55ae17ee0
Do not use this generic UUID when your data source is listed in this table.
| \amazon\_route53\_raw (via old UUID)amazon\_route53\_raw (via new UUID)box\_admin\_logs\_rawbox\_shield\_alerts\_rawbox\_users\_rawbox\_groups\_rawThe BOX\_DIRECTORIES connector queries the following Box API endpoints:
Users
Groups
For setup details, see Ingest logs and data from Box.
| ### CrowdStrike | Product | UUID | Datasets | Collection Method | | --------------- | -------------------------------- | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Falcon incident | 230b2b0233bf4327806af72e6e5769f3 | `crowdstrike_falcon_incident_raw` |Currently not supported by Cribl
CrowdStrike Streaming API
Base URL: api.us-2.crowdstrike.com, api.eu-1.crowdstrike.com, etc.)
GET /sensors/entities/datafeed/v2
For setup details, see Ingest alerts and metadata from CrowdStrike APIs.
| | Hosts | 8b673ac8e2f34b4a8dc14c22f0e6063b | `crowdstrike_hosts_raw` |CrowdStrike Devices API
GET /devices/queries/devices-scroll/v1
POST /devices/entities/devices/v2
For setup details, see Ingest alerts and metadata from CrowdStrike APIs.
| ### Dropbox | Product | UUID | Datasets | Collection Method | | --------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Directory | e8d2c52bc9594621924fab0507264586 |dropbox\_members\_devices\_rawdropbox\_users\_rawdropbox\_groups\_rawBase URL:
Users (dropbox\_users\_raw)
/2/team/members/list\_v2Groups (dropbox\_groups\_raw)
/2/team/groups/listDevices (dropbox\_member\_devices\_raw)
/2/team/devices/list\_members\_devicesFor setup details, see Ingest logs and data from Dropbox.
| | Events | a6322b2fd9e545e0a4223ba754c48fb9 | `dropbox_events_raw` |Base URL:
Endpoint: /2/team\_log/get\_events
For setup details, see Ingest logs and data from Dropbox.
| ### Google | Product | UUID | Datasets | Collection Method | | ------------------------------------ | -------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloud Logging (audit logs/flow logs) | 00a8322c85e14beabfa7ad5f3d62db73 | `google_cloud_logging_raw` | For setup details, see [Ingest logs and data from a GCP Pub/Sub](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-cloud-platform/ingest-logs-and-data-from-a-gcp-pub-sub.md). | | Gmail | 8607490288d1407ba82b5c5ad9dc64a0 | `google_gmail_raw` |GET
For setup details, see Ingest logs and data from Google Workspace.
| | Workspace alerts | 4f263650cd29475c81f2ff953cf19827 | `google_workspace_alerts_raw` |Description: Ingests security and system alerts from the Google Workspace Alert Center.
API Details
v1beta1/v1beta1/alertsGET (List)Request Parameters
createTime.createTime >= "\[TIMESTAMP\_START]" AND createTime \< "\[TIMESTAMP\_END]"createTime ascData Mapping
alerts list.For setup details, see Ingest logs and data from Google Workspace.
| | Workspace ChromeOS devices | e82ae276e6b9442fa80920a03d2a38d6 | `google_workspace_chrome_raw` |GET
For setup details, see Ingest logs and data from Google Workspace.
| | Workspace groups | 689ae8ef14e848e3855b81e91d8af9bc | `google_workspace_enterprise_groups_raw` |GET
For setup details, see Ingest logs and data from Google Workspace.
| | Workspace rules | 2621aaf3334a4147ae727afe84db31a9 | `google_workspace_rules_raw` |GET
For setup details, see Ingest logs and data from Google Workspace.
| | Workspace users | 359ecd845fa54caab6ddb4b7c7a2764d | `google_workspace_user_acounts_raw` |GET
For setup details, see Ingest logs and data from Google Workspace.
| ### Microsoft | Product | UUID | Datasets | Collection Method | | ---------------------------- | -------------------------------- | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Azure | fce13a1d51294f84bae4a37851503060 | `msft_azure_raw` | Azure Event Hubs SDK (AMQP): For setup details, see [Ingest logs from Microsoft Azure Event Hub](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-event-hub/ingest-logs-from-microsoft-azure-event-hub.md). | | Azure AD | c00d6d52e5b141a8baa8db9d9345423d | `msft_azure_ad_raw` | For set up details, see [Ingest logs from Microsoft Office 365](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/ingest-logs-from-microsoft-office-365.md). | | Azure AD audit | 0e076d5abe864bf78e8145ea9e0d749e | `msft_azure_ad_audit_raw` |Microsoft Graph API: GET /v1.0/auditLogs/directoryaudits
For set up details, see Ingest logs from Microsoft Office 365.
| | Azure AD sign-ins | f56dcfdf6bca43e793a4b6e9290e7b12 | `msft_azure_ad_raw` |Microsoft Graph API: GET /v1.0/auditLogs/signIns
For set up details, see Ingest logs from Microsoft Office 365.
| | Defender | ce9e8cf36e0742c38aa89787a256855f | `msft_defender_raw` |Azure Event Hubs SDK (AMQP): For setup details, see Ingest raw EDR events from Microsoft Defender for Endpoint.
To enable analytics, contact Customer Support.
| | DHCP | b55819e8959c49728d5d98a6d87eafb6 | `msft_dhcp_raw` |File Collection: C:\Windows\System32\dhcp\DhcpSrvLog-\*.log
For set up details, see Ingest logs from Windows DHCP using Elasticsearch Filebeat.
| | Graph security alerts | 5619f2f691fc46c4b202587fdaa031c3 | `msft_graph_security_alerts_raw` |Microsoft Graph API: /v1.0/security/alerts\_v2
For set up details, see Ingest logs from Microsoft Office 365.
| | Office 365 Azure AD | e1f109f886ea42fbb96be6ec0cc597a9 | `msft_o365_azure_ad_raw` |The Base URLs for the APIs are (depending on the environment):
Worldwide:
GCC:
GCC High:
DoD:
Endpoints:
Start Subscription: /api/v1.0/{tenantID}/activity/feed/subscriptions/start?contentType={type}
List Available Content: /api/v1.0/{tenantID}/activity/feed/subscriptions/content?contentType={type}
Fetch Content Blob: Dynamic URI returned from the “List Available Content” call.
Content Types: audit.exchange, audit.sharepoint, audit.general, audit.azureactivedirectory, dlp.all.
For set up details, see Ingest logs from Microsoft Office 365.
| | Office 365 DLP | 8f052782739d4b8389644cca23b994ac | `msft_o365_dlp_raw` |See Office 365 Azure AD.
For set up details, see Ingest logs from Microsoft Office 365.
| | Office 365 domains | cae29fd87b554bd9a5694afb225e8dc9 | `msft_o365_domains_raw` | Microsoft Graph API: `GET /v1.0/domains` | | Office 365 Exchange Online | dee8e85ce7db4573a8bc21b807e1d73a | `msft_o365_exchange_online_raw` |See Office 365 Azure AD.
For set up details, see Ingest logs from Microsoft Office 365.
| | Office 365 General | c7655e83805b4a058e66043a6715156c | `msft_o365_general_raw` |See Office 365 Azure AD.
For set up details, see Ingest logs from Microsoft Office 365.
| | Office 365 Sharepoint Online | 3a37f519e9094a3f8c4185fa572cd111 | `msft_o365_sharepoint_online_raw` |See Office 365 Azure AD.
For set up details, see Ingest logs from Microsoft Office 365.
| | Office 365 contacts (email) | de1b694a6c8341958bc08c4b7c140874 | `msft_o365_contacts_raw` |Microsoft Graph API: GET /v1.0/users/{id}/mailFolders/inbox/messageRules
For set up details, see Ingest logs and data from Microsoft 365.
| | Office 365 devices (email) | de229685f708413fad46289657ea09de | `msft_o365_devices_raw` |Microsoft Graph API: GET /v1.0/users/{id}/registeredDevices
For set up details, see Ingest logs and data from Microsoft 365.
| | Office 365 groups (email) | 0b0499ac0d984145b201c6d674771dbf | `msft_o365_groups_raw` |Microsoft Graph API: GET /v1.0/groups
For set up details, see Ingest logs and data from Microsoft 365.
| | Office 365 mailboxes (email) | 9855a03559ce4263b568671e695d1fa8 | `msft_o365_mailboxes_raw` |The Base URLs for the APIs are (depending on the environment): [https://graph.microsoft.com\</code>](https://graph.microsoft.com\</code>) (or \
Incoming Messages: GET /v1.0/users/{id}/messages
Outgoing Messages: GET /v1.0/users/{id}/mailFolders/sentitems/messages/delta
For set up details, see Ingest logs and data from Microsoft 365.
| | Office 365 rules (email) | 6b925df8923d4038bf78998d1ffde77c | `msft_o365_rules_raw` |Microsoft Graph API: /users/{id}/mailFolders/inbox/messageRules
For set up details, see Ingest logs and data from Microsoft 365.
| | Office 365 users (email) | dcfb7a412e654efd868de0b8cf81766a | `msft_o365_users_raw` |Microsoft Graph API: GET /v1.0/users
For set up details, see Ingest logs and data from Microsoft 365.
| | Windows Event Logs | 63b0fbeb501e4650896e7064d3412e14 | `microsoft_windows_raw` | For more information, see [Collect Windows Event Logs for Cortex XSIAM via Cribl](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/ingest-data-from-cribl/collect-windows-event-logs-for-cortex-xsiam-via-cribl.md). | ### Okta | Product | UUID | Datasets | Collection Method | | ------- | -------------------------------- | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SSO | 5faf4c1fdb8443d9920d6a54815432c1 | `okta_sso_raw` |Okta System Log API
Base URL: https\://{your-okta-domain}.okta.com
GET /api/v1/logs
For set up details, see Ingest logs and data from Okta.
| ### OneLogin | Product | UUID | Datasets | Collection Method | | -------- | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Events | 22b23a3f9f1e49998645b683d5dc3a6f | `onelogin_events_raw` |Base URL: https\://\
Endpoint: /api/1/events\`
For set up details, see Ingest logs and data from OneLogin.
| | OneLogin | 88cfbd3e7b974d999b10edac83995b8a |onelogin\_users\_rawonelogin\_groups\_rawonelogin\_apps\_rawBase URL: https\://\
Endpoints: /api/1/users/api/1/groups/api/2/apps
For set up details, see Ingest logs and data from OneLogin.
| ### PingID | Product | UUID | Datasets | Collection Method | | ------- | -------------------------------- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | PingONE | 924951a8394b4605b1725f943292ab4f | `pingid_pingone_raw` |PingOne API:
Base URL:
Endpoint: /v3/reports/{account\_id}/poll-subscriptions/{subscription\_id}/events
For set up details, see Ingest authentication logs and data from PingOne.
| ### Proofpoint | Product | UUID | Datasets | Collection Method | | ------- | -------------------------------- | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | TAP | 3eefce0f791e4391a3643b8cf860a361 | `proofpoint_tap_raw` |API Base URL:
Resource Path: /v2/siem/all
For set up details, see Ingest logs from Proofpoint Targeted Attack Protection.
| ### Salesforce: Salesforce logs | UUID | Datasets | Collection Method | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | ab109687acd24978aabcb7ad8b5742e3 |salesforce\_login\_rawsalesforce\_audit\_rawsalesforce\_eventlogfile\_rawThe data schema for salesforce\_eventlogfile\_raw is dynamic and not hardcoded in the data collector's source code.
Here's how it works:
Dynamic Field Discovery: The collector calls the Salesforce describe endpoint (/services/data/v56.0/sobjects/EventLogFile/describe) to retrieve the list of all available fields for the EventLogFile object.
Query Construction: It constructs a SOQL query selecting all these discovered fields, such as SELECT Id, LogFile, LogDate,.... FROM EventLogFile).
CSV to JSON: The downloaded log files are in CSV format. The collector converts each CSV row into a JSON object where the keys are the CSV headers (which correspond to the fields discovered in the Dynamic Field Discovery explained above).
For set up details, see Ingest logs and data from Salesforce.
| ### Salesforce: Salesforce snapshots | UUID | | | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | addbf31a6372491e88d45934dff5b5b0 |The data fetched by this data collector is written to datasets based on the Salesforce object being retrieved. The data collector dynamically sets the Product field in the response to the name of the Salesforce object. Assuming the standard naming convention \ (where Vendor is salesforce); the data will be written to the following datasets (corresponding to the objects defined in consts.go):
salesforce\_ConnectedApplication\_rawsalesforce\_PermissionSet\_rawsalesforce\_Profile\_rawsalesforce\_GroupMember\_rawsalesforce\_Group\_rawsalesforce\_User\_rawsalesforce\_UserRole\_rawsalesforce\_TenantSecurityLogin\_rawsalesforce\_UserAccountTeamMember\_rawsalesforce\_TenantSecurityUserPerm\_rawAuthentication:
Path: /services/oauth2/token
Purpose: Used for obtaining and refreshing access tokens.
Data Query:
Path: /services/data/v56.0/queryAll
Purpose: Used to execute SOQL queries to fetch records for the snapshot objects, such as User, Profile, and Group.
Object Description:
Path: /services/data/v56.0/sobjects/{object}/describe
Purpose: Used to dynamically retrieve the list of fields for a specific object before querying it.
All endpoints are relative to the base URL: https\://{domain}.my.salesforce.com.
For set up details, see Ingest logs and data from Salesforce.
| ### Sentinel One: Deep Visibility | UUID | Datasets | Collection Method | | -------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | b9fa55e6fa564c709358425ce0f61517 | `sentinelone_deep_visibility_raw` |For set up details, see Ingest raw EDR events from SentinelOne DeepVisibility.
To enable analytics, contact Customer Support.
| ### Service Now: CDMB | UUID | Datasets | Collection Method | | -------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 8b3e767247e44471a95e563378d0b9be |servicenow\_cmdb\_
\ ServiceNow Table API Base URL: For set up details, see Ingest data from ServiceNow CMDB. Workday Report-as-a-Service (RaaS) Endpoint: Configurable Report URL For set up details, see Ingest report data from Workday.\_raw |
https\://{instance}.service-now\.comGET /api/now/table/{table\_name}