xenXDRby FluenceSecurity
Book a demo

Data sources overview

How events get into XenXDR, what happens to them on the way, and what you can rely on afterwards.

Ways in

InputUse it for
Beats over TLSYour own winlogbeat and filebeat fleet.
Syslog (RFC 3164 and 5424, CEF, LEEF)Firewalls, appliances, Linux hosts. TLS for anything crossing an untrusted network; plain UDP or TCP only on trusted segments.
HTTP JSONScripts, other SIEMs, anything that can POST an object or an array.
Splunk HECProducts that already speak the HTTP Event Collector protocol.
Pull connectorsCloud sources XenXDR polls on your behalf: Okta, Microsoft Entra ID and Microsoft 365, Fluence Account. More are listed as coming soon in the catalog.

What happens to an event

  • Receive. The listener accepts the event and stamps its provenance: which input, which sender, which organization.
  • Normalise. XenXDR maps the event to the canonical schema: one name per field, typed, ECS-shaped. The original document is kept in the raw field next to the parsed fields.
  • Enrich at ingest. IPs, users, hosts, hashes and domains are extracted as entities for cross-source pivots, and indicators are matched against loaded threat intelligence lists.
  • Store. The event is written to the store under its organization. Nothing about it is ever rewritten.
  • Or park. If the event cannot be parsed, it is written to the unparsed queue with the parse error, kept for 14 days by default, and visible on the Logs page under Unparsed. Every event is accounted for.

Guarantees you can plan around

  • The raw event is preserved. An investigation or an audit can always see what actually arrived.
  • Tenancy is stamped server-side. A sender using a shared key lands in the deployment's default organization; a sender using a per-organization ingest key lands in that organization and cannot pick another.
  • Ingest rides out interruptions. Events are buffered durably and delivered once the store is available again.
  • Parse failures are visible. The unparsed queue and the data-source health panel on the Overview page tell you when a source has changed format.

Choosing between inputs

Use the agent where you want response as well as collection. Use syslog for devices that speak nothing else. Use HTTP JSON with a per-organization key for anything you script, and for third parties that send on a customer's behalf. Use HEC when a product already has a HEC output; it saves a rewrite.