01_List of Supported LogSources
S.NO
Log Source
Log Category
Log Format
1
Apache WebServer
webserver
clf
2
Apache Tomcat
webserver
clf
3
AWS Cloudtrail
aws
json
4
AWS Cloudwatch
aws
json
5
AWS ELB
aws
json
6
AWS Guardduty
aws
json
7
AWS Security Hub
aws
json
8
AWS VPCflow
aws
json
9
AWS WAF
aws
json
10
AZURE AD logs
azure
json
11
Azure Application Gateway
azure
json
12
Azure Firewall
azure
json
13
Azure Graph Activity
azure
json
14
Azure Identity Protection
azure
json
15
Barracuda Web Application Firewall
proxy-web
syslog
16
Brocade Switch
network
syslog
17
Check Point Harmony Endpoint
epp
syslog-kv
18
Check Point NGAV
epp
cef
19
Checkpoint Firewall
ngfw
syslog
20
Cisco ASA Firewall
ngfw
syslog
21
Cisco DNAC
wireless
syslog-json
22
Cisco Duo
auth
json
23
Cisco Fabric Controller (NX-OS)
network
syslog
24
Cisco Firepower Threat Defense
ngfw
syslog
25
Cisco Firewall Management Center
ngfw
syslog
26
Cisco Identity Services Engine
nac
syslog-kv
27
Cisco IOS Devices (Router, Switch)
network
syslog
28
Cisco Meraki Firewall
ngfw
syslog -kv
29
Cisco Meraki Switch
network
syslog
30
Cisco Remote Management Service (RMS)
linux
syslog
31
Cisco Secure Endpoint (AMP)
epp
json
32
Cisco Umbrella
dns
csv
33
Cisco Wireless Access Point
wireless
syslog-kv
34
Cloudflare Events
proxy-web
json
35
Crowdstrike Falcon
epp
json
36
Cyber20-IT
epp
json
37
CyberArk Pas
auth
syslog-json/cef
38
Dell CloudIQ
nas
syslog-kv
39
Dell Remote Management Service (RMS)
linux
syslog
40
Dellemc Switch
network
syslog
41
ERP SAP
erp
json
42
Escan Antivirus
epp
syslog
43
Forcepoint Web Security
proxy-web
json or cef
44
Fortinet FortiAnalyzer
ngfw
syslog
45
Fortinet FortiClient EMS
epp
syslog-kv
46
Fortinet FortiGate Firewall
ngfw
syslog
47
Fortinet FortiManager
ngfw
syslog
48
Fortinet Fortinac
nac
cef
49
FreeIPA
auth
syslog-kv
50
Gajshield Firewall
ngfw
syslog-kv
51
GCP CloudSQL MySQL
gcp
json
52
GCP Firewall
gcp
json
53
GCP Loadbalancer
gcp
json
54
HPE Aruba Switch
network
syslog
55
HPE Aruba Wireless
wireless
syslog
56
HPE Remote Management Service (RMS)
linux
syslog
57
IBM Remote Management Service (RMS)
linux
syslog
58
IBM Storwize
nas
syslog -kv
59
Imperva WAF
proxy-web
cef
60
JumpCloud Directory Events
auth
json
61
Juniper Firewall
ngfw
syslog
62
Juniper Router
network
syslog
63
Kaspersky Antivirus
epp
cef
64
Lenovo NAS
nas
syslog-json
65
Lenovo Remote Management Service (RMS)
linux
syslog
66
Lenovo Switch
network
syslog
67
Liferay CMS
webserver
syslog
68
Linux
linux
syslog
69
ManageEngine ADAudit Plus
auth
syslog
70
ManageEngine Endpoint Central
epp
syslog-kv
71
ManageEngine OpManager
webserver
syslog
72
Mcafee Epolicy Orchestrator
epp
syslog-xml
73
Microsoft DHCP
microsoft dhcp
csv
74
Microsoft DNS Server
microsoft dns
json
75
Microsoft IIS
webserver
clf
76
Microsoft Intune
mdm
json
77
Microsoft Office-365
azure
json
78
Microsoft SQL Server
db
kv
79
Mimecast Email Security
proxy-mail
json
80
MySQL Enterprise
db
json
81
Netgate PfSense Firewall
ngfw
syslog-kv
82
Netgear Switch
network
syslog
83
Netskope Security
proxy-web
json or syslog-cef
84
NetXGate Firewall
ngfw
syslog-kv
85
Nginx WebServer
webserver
clf
86
Nutanix HCI
virtual
syslog-kv
87
Okta
auth
json
88
OneLogin
auth
json
89
OpenVPN
ra
json
90
Oracle Database
db
json
91
PaloAlto Firewall
ngfw
csv
92
Perception Point Email Security
proxy-mail
json
93
PostgreSQL Database
db
json
94
Proofpoint On Demand Email Security
proxy-mail
json
95
Proofpoint Target Attack Protection
proxy-mail
json
96
Pulse Secure Connect
ra
syslog
97
Quality Network Appliance Provider (QNAP)
nas
syslog
98
Ruckus Switch
network
syslog
99
Ruckus Wireless Controller
wireless
syslog
100
Sectona PAM
auth
csv
101
SentinelOne Endpoint Protection
epp
json
102
Seqrite Antivirus
epp
syslog-cef-kv
103
SonicWall Firewall
ngfw
syslog
104
Sophos Central
epp
json
105
Sophos InterceptX
epp
json
106
Sophos XG Firewall
ngfw
syslog
107
Symantec Endpoint Protection
epp
syslog-kv
108
Tacitine EN6200
ngfw
syslog-kv
109
Trend Micro Apex Central
epp
syslog-cef
110
Trend Micro Deep Security
epp
syslog-cef
111
TrendMicro Vision one XDR
epp
json
112
Vcenter
virtual
syslog
113
Veeam Backup & Replication
nas
syslog-kv
114
Vicarius Vulnerability Management
vuln
json
115
Vmware ESXI
virtual
syslog
116
Vmware HCI
virtual
syslog
117
WatchGuard Firebox Firewall
ngfw
syslog
118
Windows
windows
json
119
Zoho Analytics
erp
json
120
Zoho Vault
erp
json
121
Zscaler Audit Events
proxy-web
json
122
Zscaler Deception
deception
syslog-json
123
Zscaler Web Events
proxy-web
syslog-cef-kv
Last updated