Detections declare which data sources they need. This is the catalog those declarations draw from, with the input each source arrives through.
Endpoint and operating system
| Source | Arrives through | Notes |
|---|---|---|
| Windows process creation | Agent (Sysmon, Security log) | Process-based content-pack rules need Sysmon. |
| Windows Security log | Agent | Logons, account and privilege events. |
| Windows Sysmon | Agent | All Sysmon event types the host's configuration emits. |
| Windows PowerShell script blocks | Agent | Requires script block logging enabled by policy. |
| Microsoft Defender Antivirus | Agent | Detections and protection state. |
| XenXDR agent telemetry | Agent | Heartbeat, containment, tool availability, response actions. |
| Linux auditd | Agent or syslog | Requires the recommended rules for full coverage. |
| Linux syslog and journald | Agent or syslog |
Network
| Source | Arrives through | Notes |
|---|---|---|
| Firewall, FortiGate | Syslog | Native format recognised; response action available. |
| Firewall, other vendors | Syslog (CEF or LEEF) | Header and CEF fields parsed; vendor extensions under fields. |
| DNS queries | Agent (Sysmon) or syslog | |
| Network connections | Agent (Sysmon) | Connection records with process attribution. |
Identity and cloud
| Source | Arrives through | Status |
|---|---|---|
| Okta System Log | Pull connector | Live |
| Microsoft Entra ID sign-ins and audit | Pull connector | Live |
| Microsoft 365 | Pull connector | Live |
| Fluence Account audit log | Push with an ingest key | Live |
| AWS CloudTrail | Pull connector | Coming soon |
| CrowdStrike Falcon | Pull connector | Coming soon |
| Microsoft Defender for Endpoint | Pull connector | Coming soon |
| Google Workspace | Pull connector | Coming soon |
"Coming soon" means the connector can be configured in the console but does not yet collect. It is shown with that label there too.
Everything else
Any JSON, HEC or syslog sender lands in the store with its fields preserved. Detections can be written against them with the event.module value the sender uses. Ask support if you want a source promoted to the catalog with a native mapping.