GitHub Repo

Other Data Sources

Name Platform Sourcetype Source Supported TA Date
Cisco AI Defense Alerts Other cisco:ai:defense not_applicable Cisco Security Cloud
Cisco IOS Logs Other cisco:ios cisco:ios Cisco Enterprise Networking Add-on for Splunk
Windchill Log4j Other log4j not_applicable N/A
Cisco SD-WAN Auth Log Other cisco:sdwan:syslog /var/log/auth.log N/A
Bro weird Other bro:weird:json bro:weird:json TA for Zeek
Google Workspace login_failure Other gws:reports:admin gws:reports:admin Splunk Add-on for Google Workspace
Google Workspace Other gws:reports:login google_workspace Splunk Add-on for Google Workspace
Bro x509 Other bro:x509:json bro:x509:json TA for Zeek
Cisco ASA Logs Other cisco:asa not_applicable Cisco Security Cloud
Ivanti VTM Audit Other ivanti_vtm_audit ivanti_vtm N/A
Cisco Isovalent Process Connect Other cisco:isovalent:processConnect not_applicable Cisco Security Cloud
MS Defender ATP Alerts Other ms:defender:atp:alerts ms_defender_atp_alerts Splunk Add-on for Microsoft Security
Ollama Server Other ollama:server server.log TA-ollama
MCP Server Other mcp:jsonrpc mcp.log MCP TA
Bro files Other bro:files:json bro:files:json TA for Zeek
Google Workspace login_success Other gws:reports:admin gws:reports:admin Splunk Add-on for Google Workspace
Cisco SD-WAN NTCE 1000001 Other cisco:sdwan:syslog /var/log/vsyslog N/A
GitHub Organizations Audit Logs Other github:cloud:audit github Splunk Add-on for Github
M365 Exported eDiscovery Prompts Other csv csv N/A
Cisco Duo Activity Other cisco:duo:activity cisco_duo Cisco Security Cloud
Osquery Results Other osquery:results osquery TA-osquery
Bro ocsp Other bro:ocsp:json bro:ocsp:json TA for Zeek
MS365 Defender Incident Alerts Other ms365:defender:incident:alerts ms365_defender_incident_alerts Splunk Add-on for Microsoft Security
CircleCI Other circleci circleci App for CircleCI
PingID Other XmlWinEventLog XmlWinEventLog:Security N/A
Bro loaded_scripts Other bro:loaded_scripts:json bro:loaded_scripts:json TA for Zeek
CrowdStrike ProcessRollup2 Other crowdstrike:events:sensor crowdstrike Splunk Add-on for CrowdStrike FDR
Bro ssl Other bro:ssl:json bro:ssl:json TA for Zeek
Cisco Isovalent Process Exec Other cisco:isovalent:processExec not_applicable Cisco Security Cloud
Cisco Isovalent Process Kprobe Other cisco:isovalent not_applicable Cisco Security Cloud
Cisco Duo Administrator Other cisco:duo:administrator cisco_duo Cisco Security Cloud
CrowdStrike Falcon Stream Alert Other CrowdStrike:Event:Streams:JSON CrowdStrike:Event:Streams Splunk Add-on for CrowdStrike FDR
Bro conn Other bro:conn:json bro:conn:json TA for Zeek
Bro ntp Other bro:ntp:json bro:ntp:json TA for Zeek
VMWare ESXi Syslog Other vmw-syslog vmware:esxlog Add-on for VMware ESXi Logs
CrushFTP Other crushftp:sessionlogs crushftp N/A