Elastic integrations

Integrations quick reference
1Password
Abnormal Security
ActiveMQ
Active Directory Entity Analytics
Admin By Request EPM integration
Airflow
Akamai
Apache
API (custom)
Arista NG Firewall
Atlassian
Auditd
- Auditd Logs
- Auditd Manager
Auth0
authentik
AWS
Azure
Barracuda
- Barracuda WAF
- CloudGen Firewall logs
BeyondInsight and Password Safe Integration
BitDefender
Bitwarden
blacklens.io
BBOT (Bighuge BLS OSINT Tool)
Box Events
Bravura Monitor
Broadcom ProxySG
Canva
Cassandra
CEL Custom API
Ceph
Check Point
- Check Point Email
- Check Point Harmony Endpoint
Cilium Tetragon
CISA Known Exploited Vulnerabilities
Cisco
- Aironet
- ASA
- Duo
- FTD
- IOS
- ISE
- Meraki
- Nexus
- Secure Email Gateway
- Secure Endpoint
- Umbrella
Cisco Meraki Metrics
Citrix
- ADC
- Web App Firewall
Claroty CTD
Cloudflare
- Cloudflare
- Cloudflare Logpush
Cloud Asset Inventory
CockroachDB Metrics
Common Event Format (CEF)
Containerd
CoreDNS
Corelight
Couchbase
CouchDB
Cribl
CrowdStrike
- CrowdStrike
- CrowdStrike Falcon Intelligence
Cyberark
Cybereason
CylanceProtect Logs
Custom Websocket logs
Darktrace
Data Exfiltration Detection
DGA
Digital Guardian
Docker
DomainTools Real Time Unified Feeds
Elastic APM
Elastic Fleet Server
Elastic Security
Elastic Stack monitoring
Elasticsearch Service Billing
Envoy Proxy
ESET PROTECT
ESET Threat Intelligence
etcd
Falco
F5
- BIG-IP
File Integrity Monitoring
FireEye Network Security
First EPSS
Forcepoint Web Security
ForgeRock
Fortinet
Gigamon
GitHub
GitLab
Golang
Google
Google Cloud
GoFlow2 logs
Hadoop
HAProxy
Hashicorp Vault
Host Traffic Anomalies
HTTP Endpoint logs (custom)
IBM MQ
IIS
Imperva
- Imperva Cloud WAF
- Imperva SecureSphere Logs
InfluxDb
Infoblox
- BloxOne DDI
- NIOS
Iptables
Istio
Jamf Compliance Reporter
Jamf Pro
Jamf Protect
Jolokia Input
Journald logs (custom)
JumpCloud
Kafka
- Kafka
- Kafka Logs (custom)
Keycloak
Kubernetes
LastPass
Lateral Movement Detection
Linux Metrics
Living off the Land Attack Detection
Logs (custom)
Lumos
Lyve Cloud
macOS Unified Logs (custom)
Mattermost
Memcached
Menlo Security
Microsoft
Mimecast
ModSecurity Audit
MongoDB
MongoDB Atlas
MySQL
- MySQL
- MySQL Enterprise
Nagios XI
NATS
NetFlow Records
Netskope
Network Beaconing Identification
Network Packet Capture
Nginx
Okta
- Okta
- Okta Entity Analytics
Oracle
- Oracle
- Oracle WebLogic
OpenAI
OpenCanary
Osquery
- Osquery Logs
- Osquery Manager
Palo Alto
pfSense
PHP-FPM
PingOne
PingFederate
Pleasant Password Server
PostgreSQL
Privileged Access Detection
Prometheus
- Prometheus
- Promethues Input
Proofpoint TAP
Proofpoint On Demand
Pulse Connect Secure
Qualys VMDR
QNAP NAS
RabbitMQ Logs
Rapid7
- Rapid7 InsightVM
- Rapid7 Threat Command
Redis
- Redis
- Redis Enterprise
Rubrik RSC Metrics Integration
Sailpoint Identity Security Cloud
Salesforce
SentinelOne
- SentinelOne
- SentinelOne Cloud Funnel
ServiceNow
Slack Logs
Snort
Snyk
SonicWall Firewall
Sophos
- Sophos
- Sophos Central
Spring Boot
SpyCloud Enterprise Protection
SQL Input
Squid Logs
SRX
STAN
Statsd Input
Sublime Security
Suricata
StormShield SNS
Symantec
- Endpoint Protection
Symantec Endpoint Security
Sysmon for Linux
Sysdig
Syslog Router Integration
System
System Audit
Tanium
TCP Logs (custom)
Teleport
Tenable
- Tenable.io
- Tenable.sc
Threat intelligence
ThreatConnect
Threat Map
Thycotic Secret Server
Tines
Traefik
Trellix
- Trellix EDR Cloud
- Trellix ePO Cloud
Trend Micro
- Trend Micro
- Vision One
TYCHON Agentless
UDP Logs (custom)
Universal Profiling
Vectra Detect
VMware
WatchGuard Firebox
WebSphere Application Server
Windows
Wiz
Zeek
ZeroFox
Zero Networks
ZooKeeper Metrics
Zoom
Zscaler
- Zscaler Internet Access
- Zscaler Private Access
Supported Serverless project types
Level of support

Edit this page

Loading

Docs
/

Symantec

Collect, analyze, and view logs from Symantec products.

Endpoint Protection