> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/01_list-of-supported-logsources.md).

# 01\_List of Supported LogSources

<table data-header-hidden><thead><tr><th width="79.46484375"></th><th width="220.8515625"></th><th></th><th></th></tr></thead><tbody><tr><td><strong>S.NO</strong></td><td><strong>Log Source</strong></td><td><strong>Log Category</strong></td><td><strong>Log Format</strong></td></tr><tr><td>1</td><td>Apache WebServer</td><td>webserver</td><td>clf</td></tr><tr><td>2</td><td>Apache Tomcat</td><td>webserver</td><td>clf</td></tr><tr><td>3</td><td>AWS Cloudtrail</td><td>aws</td><td>json</td></tr><tr><td>4</td><td>AWS Cloudwatch</td><td>aws</td><td>json</td></tr><tr><td>5</td><td>AWS ELB</td><td>aws</td><td>json</td></tr><tr><td>6</td><td>AWS Guardduty</td><td>aws</td><td>json</td></tr><tr><td>7</td><td>AWS Security Hub</td><td>aws</td><td>json</td></tr><tr><td>8</td><td>AWS VPCflow</td><td>aws</td><td>json</td></tr><tr><td>9</td><td>AWS WAF</td><td>aws</td><td>json</td></tr><tr><td>10</td><td>AZURE AD logs</td><td>azure</td><td>json</td></tr><tr><td>11</td><td>Azure Application Gateway</td><td>azure</td><td>json</td></tr><tr><td>12</td><td>Azure Firewall</td><td>azure</td><td>json</td></tr><tr><td>13</td><td>Azure Graph Activity</td><td>azure</td><td>json</td></tr><tr><td>14</td><td>Azure Identity Protection</td><td>azure</td><td>json</td></tr><tr><td>15</td><td>Barracuda Web Application Firewall</td><td>proxy-web</td><td>syslog</td></tr><tr><td>16</td><td>Brocade Switch</td><td>network</td><td>syslog</td></tr><tr><td>17</td><td>Check Point Harmony Endpoint</td><td>epp</td><td>syslog-kv</td></tr><tr><td>18</td><td>Check Point NGAV</td><td>epp</td><td>cef</td></tr><tr><td>19</td><td>Checkpoint Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>20</td><td>Cisco ASA Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>21</td><td>Cisco DNAC</td><td>wireless</td><td>syslog-json</td></tr><tr><td>22</td><td>Cisco Duo</td><td>auth</td><td>json</td></tr><tr><td>23</td><td>Cisco Fabric Controller (NX-OS)</td><td>network</td><td>syslog</td></tr><tr><td>24</td><td>Cisco Firepower Threat Defense</td><td>ngfw</td><td>syslog</td></tr><tr><td>25</td><td>Cisco Firewall Management Center</td><td>ngfw</td><td>syslog</td></tr><tr><td>26</td><td>Cisco Identity Services Engine</td><td>nac</td><td>syslog-kv</td></tr><tr><td>27</td><td>Cisco IOS Devices (Router, Switch)</td><td>network</td><td>syslog</td></tr><tr><td>28</td><td>Cisco Meraki Firewall</td><td>ngfw</td><td>syslog -kv</td></tr><tr><td>29</td><td>Cisco Meraki Switch</td><td>network</td><td>syslog</td></tr><tr><td>30</td><td>Cisco Remote Management Service (RMS)</td><td>linux</td><td>syslog</td></tr><tr><td>31</td><td>Cisco Secure Endpoint (AMP)</td><td>epp</td><td>json</td></tr><tr><td>32</td><td>Cisco Umbrella</td><td>dns</td><td>csv</td></tr><tr><td>33</td><td>Cisco Wireless Access Point</td><td>wireless</td><td>syslog-kv</td></tr><tr><td>34</td><td>Cloudflare Events</td><td>proxy-web</td><td>json</td></tr><tr><td>35</td><td>Crowdstrike Falcon</td><td>epp</td><td>json</td></tr><tr><td>36</td><td>Cyber20-IT</td><td>epp</td><td>json</td></tr><tr><td>37</td><td>CyberArk Pas</td><td>auth</td><td>syslog-json/cef</td></tr><tr><td>38</td><td>Dell CloudIQ</td><td>nas</td><td>syslog-kv</td></tr><tr><td>39</td><td>Dell Remote Management Service (RMS)</td><td>linux</td><td>syslog</td></tr><tr><td>40</td><td>Dellemc Switch</td><td>network</td><td>syslog</td></tr><tr><td>41</td><td>ERP SAP</td><td>erp</td><td>json</td></tr><tr><td>42</td><td>Escan Antivirus</td><td>epp</td><td>syslog</td></tr><tr><td>43</td><td>Forcepoint Web Security</td><td>proxy-web</td><td>json or cef</td></tr><tr><td>44</td><td>Fortinet FortiAnalyzer</td><td>ngfw</td><td>syslog</td></tr><tr><td>45</td><td>Fortinet FortiClient EMS</td><td>epp</td><td>syslog-kv</td></tr><tr><td>46</td><td>Fortinet FortiGate Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>47</td><td>Fortinet FortiManager</td><td>ngfw</td><td>syslog</td></tr><tr><td>48</td><td>Fortinet Fortinac</td><td>nac</td><td>cef</td></tr><tr><td>49</td><td>FreeIPA</td><td>auth</td><td>syslog-kv</td></tr><tr><td>50</td><td>Gajshield Firewall</td><td>ngfw</td><td>syslog-kv</td></tr><tr><td>51</td><td>GCP CloudSQL MySQL</td><td>gcp</td><td>json</td></tr><tr><td>52</td><td>GCP Firewall</td><td>gcp</td><td>json</td></tr><tr><td>53</td><td>GCP Loadbalancer</td><td>gcp</td><td>json</td></tr><tr><td>54</td><td>HPE Aruba Switch</td><td>network</td><td>syslog</td></tr><tr><td>55</td><td>HPE Aruba Wireless</td><td>wireless</td><td>syslog</td></tr><tr><td>56</td><td>HPE Remote Management Service (RMS)</td><td>linux</td><td>syslog</td></tr><tr><td>57</td><td>IBM Remote Management Service (RMS)</td><td>linux</td><td>syslog</td></tr><tr><td>58</td><td>IBM Storwize</td><td>nas</td><td>syslog -kv</td></tr><tr><td>59</td><td>Imperva WAF</td><td>proxy-web</td><td>cef</td></tr><tr><td>60</td><td>JumpCloud Directory Events</td><td>auth</td><td>json</td></tr><tr><td>61</td><td>Juniper Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>62</td><td>Juniper Router</td><td>network</td><td>syslog</td></tr><tr><td>63</td><td>Kaspersky Antivirus</td><td>epp</td><td>cef</td></tr><tr><td>64</td><td>Lenovo NAS</td><td>nas</td><td>syslog-json</td></tr><tr><td>65</td><td>Lenovo Remote Management Service (RMS)</td><td>linux</td><td>syslog</td></tr><tr><td>66</td><td>Lenovo Switch</td><td>network</td><td>syslog</td></tr><tr><td>67</td><td>Liferay CMS</td><td>webserver</td><td>syslog</td></tr><tr><td>68</td><td>Linux</td><td>linux</td><td>syslog</td></tr><tr><td>69</td><td>ManageEngine ADAudit Plus</td><td>auth</td><td>syslog</td></tr><tr><td>70</td><td>ManageEngine Endpoint Central</td><td>epp</td><td>syslog-kv</td></tr><tr><td>71</td><td>ManageEngine OpManager</td><td>webserver</td><td>syslog</td></tr><tr><td>72</td><td>Mcafee Epolicy Orchestrator</td><td>epp</td><td>syslog-xml</td></tr><tr><td>73</td><td>Microsoft DHCP</td><td>microsoft dhcp</td><td>csv</td></tr><tr><td>74</td><td>Microsoft DNS Server</td><td>microsoft dns</td><td>json</td></tr><tr><td>75</td><td>Microsoft IIS</td><td>webserver</td><td>clf</td></tr><tr><td>76</td><td>Microsoft Intune</td><td>mdm</td><td>json</td></tr><tr><td>77</td><td>Microsoft Office-365</td><td>azure</td><td>json</td></tr><tr><td>78</td><td>Microsoft SQL Server</td><td>db</td><td>kv</td></tr><tr><td>79</td><td>Mimecast Email Security</td><td>proxy-mail</td><td>json</td></tr><tr><td>80</td><td>MySQL Enterprise</td><td>db</td><td>json</td></tr><tr><td>81</td><td>Netgate PfSense Firewall</td><td>ngfw</td><td>syslog-kv</td></tr><tr><td>82</td><td>Netgear Switch</td><td>network</td><td>syslog</td></tr><tr><td>83</td><td>Netskope Security</td><td>proxy-web</td><td>json or syslog-cef</td></tr><tr><td>84</td><td>NetXGate Firewall</td><td>ngfw</td><td>syslog-kv</td></tr><tr><td>85</td><td>Nginx WebServer</td><td>webserver</td><td>clf</td></tr><tr><td>86</td><td>Nutanix HCI</td><td>virtual</td><td>syslog-kv</td></tr><tr><td>87</td><td>Okta</td><td>auth</td><td>json</td></tr><tr><td>88</td><td>OneLogin</td><td>auth</td><td>json</td></tr><tr><td>89</td><td>OpenVPN</td><td>ra</td><td>json</td></tr><tr><td>90</td><td>Oracle Database</td><td>db</td><td>json</td></tr><tr><td>91</td><td>PaloAlto Firewall</td><td>ngfw</td><td>csv</td></tr><tr><td>92</td><td>Perception Point Email Security</td><td>proxy-mail</td><td>json</td></tr><tr><td>93</td><td>PostgreSQL Database</td><td>db</td><td>json</td></tr><tr><td>94</td><td>Proofpoint On Demand Email Security</td><td>proxy-mail</td><td>json</td></tr><tr><td>95</td><td>Proofpoint Target Attack Protection</td><td>proxy-mail</td><td>json</td></tr><tr><td>96</td><td>Pulse Secure Connect</td><td>ra</td><td>syslog</td></tr><tr><td>97</td><td>Quality Network Appliance Provider (QNAP)</td><td>nas</td><td>syslog</td></tr><tr><td>98</td><td>Ruckus Switch</td><td>network</td><td>syslog</td></tr><tr><td>99</td><td>Ruckus Wireless Controller</td><td>wireless</td><td>syslog</td></tr><tr><td>100</td><td>Sectona PAM</td><td>auth</td><td>csv</td></tr><tr><td>101</td><td>SentinelOne Endpoint Protection</td><td>epp</td><td>json</td></tr><tr><td>102</td><td>Seqrite Antivirus</td><td>epp</td><td>syslog-cef-kv</td></tr><tr><td>103</td><td>SonicWall Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>104</td><td>Sophos Central</td><td>epp</td><td>json</td></tr><tr><td>105</td><td>Sophos InterceptX</td><td>epp</td><td>json</td></tr><tr><td>106</td><td>Sophos XG Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>107</td><td>Symantec Endpoint Protection</td><td>epp</td><td>syslog-kv</td></tr><tr><td>108</td><td>Tacitine EN6200</td><td>ngfw</td><td>syslog-kv</td></tr><tr><td>109</td><td>Trend Micro Apex Central</td><td>epp</td><td>syslog-cef</td></tr><tr><td>110</td><td>Trend Micro Deep Security</td><td>epp</td><td>syslog-cef</td></tr><tr><td>111</td><td>TrendMicro Vision one XDR</td><td>epp</td><td>json</td></tr><tr><td>112</td><td>Vcenter</td><td>virtual</td><td>syslog</td></tr><tr><td>113</td><td>Veeam Backup &#x26; Replication</td><td>nas</td><td>syslog-kv</td></tr><tr><td>114</td><td>Vicarius Vulnerability Management</td><td>vuln</td><td>json</td></tr><tr><td>115</td><td>Vmware ESXI</td><td>virtual</td><td>syslog</td></tr><tr><td>116</td><td>Vmware HCI</td><td>virtual</td><td>syslog</td></tr><tr><td>117</td><td>WatchGuard Firebox Firewall</td><td>ngfw</td><td>syslog</td></tr><tr><td>118</td><td>Windows</td><td>windows</td><td>json</td></tr><tr><td>119</td><td>Zoho Analytics</td><td>erp</td><td>json</td></tr><tr><td>120</td><td>Zoho Vault</td><td>erp</td><td>json</td></tr><tr><td>121</td><td>Zscaler Audit Events</td><td>proxy-web</td><td>json</td></tr><tr><td>122</td><td>Zscaler Deception</td><td>deception</td><td>syslog-json</td></tr><tr><td>123</td><td>Zscaler Web Events</td><td>proxy-web</td><td>syslog-cef-kv</td></tr></tbody></table>