Which Collector to Use?
This guide outlines the data sources you can collect using New-Scale Cloud Collectors and identifies those that still require the existing Cloud Connectors application. To determine which option is appropriate for your needs, refer to the following sections:
Dedicated Collectors – These collectors support the following collection capabilities:
Preferred methods of ingestion that are certified end-to-end by Exabeam
Built-in parsing
Dedicated onboarding workflows
Generic Collectors – Generic collection options you can use if you don't find a specific option. Custom content development may be required using Log Stream.
If you need to set up any Cloud Connectors that aren't yet available as a New-Scale Collector, see Set up a New Cloud Connectors Instance.
Dedicated Collectors
Vendor/Product | Data Source | Recommended Collection Method | New Scale Availability | |
|---|---|---|---|---|
 | Abnormal Security |
| ✓ | |
 | Armis | Alerts logs | ||
 | AWS |
| ||
| AWS CloudTrail | CloudTrail event logs from multiple AWS accounts | ✓ | |
 | AWS CloudWatch | CloudTrail, CloudWatch Logs, and Lambda logs of AWS services | ✓ | |
| AWS S3 | Events from AWS S3 buckets | ✓ | |
| AWS SQS | Events from SQS queue | ✓ | |
 | Azure |
| ||
 | Azure Active Directory |
| ✓ | |
| Azure Active Directory Context | Context data from the Azure Active Directory service | ✓ | |
 | Azure Event Hub | Security events from Azure workspace | ✓ | |
 | Azure Activity Logs | Azure Activity Logs | ✓ | |
 | Azure Log Analytics Cloud Collector | Azure Log Analytics workspace | ✓ | |
 | Azure Storage Analytics | Azure Storage Analytics data that includes metrics data for a storage account, and logs for blobs, queues, and tables | ✓ | |
 | Bitglass | Audit events | ||
 | Box |
| ||
 | Carbon Black | Audit log events | ||
| Carbon Black Cloud Enterprise EDR | Events | ✓ | |
| Carbon Black Cloud Endpoint Standard | Events | ✓ | |
 | Cato | Security, connectivity, routing, detection and response events from Cato Networks | ✓ | |
 | Centrify | Audit logs | ||
 | Cisco AMP | Advanced Malware Protection logs | ||
 | Cisco Duo Cloud Collector | Administrator Logs, Authentication Logs, and Telephony Logs. | ✓ | |
| Cisco Meraki | Security events | ||
| Cisco Umbrella | Security activity | ||
 | Citrix ShareFile |
| ||
 | Cloudflare |
| ||
 | Code42 Incyder | File events | ||
 | Cribl | Events from your Cribl Stream pipeline | ✓ | |
 | CrowdStrike Falcon | Audit events and alerts from the Falcon streaming API | ✓ | |
| CrowdStrike Falcon | Raw threat graph events replicated from S3 storage | ✓ | |
 | Cybereason | Malops | ||
 | CylanceProtect |
| ||
 | Dropbox | Events | ||
 | Duo Security |
| ||
 | Egnyte |
| ||
 | Fidelis | Network activity | ||
 | GitHub | Repository events | ||
 | Google Cloud Platform |
| ||
| Google Workspace | Google application events:
| ||
| GCP Pub/Sub | Events from the GCP Pub/Sub | ✓ | |
 | LastPass Enterprise | Report events | ||
 | Mimecast Email Security | Email data feed logs | ||
 | Microsoft 365 |
| ✓ | |
 | Microsoft Defender for Cloud | Security alerts | ||
 | Microsoft Defender XDR | Microsoft Cloud App Security (MCAS) events | ✓ | |
 | Microsoft Exchange Admin Reports |
| ✓ | |
 | Microsoft Entra ID Context | User context data from your Microsoft Entra ID service. | ✓ | |
| Microsoft Entra ID Logs | Audit Logs, Sign-in Logs, and Identity Protection | ✓ | |
 | Microsoft 365 Management Activity | Active-directory, general, sharepoint, exchange, and dlp | ✓ | |
 | Microsoft Security Alerts | Security logs | ✓ | |
 | Microsoft Sentinel | ✓ | ||
 | Netskope Alerts | Alerts from REST API V2 endpoints | ✓ | |
| Netskope Events | Events from REST API V2 endpoints | ✓ | |
 | Okta | Okta system logs | ✓ | |
| Okta | Okta user data | ✓ | |
 | OneLogin | Events | ||
 | Palo Alto Networks Cortex Data Lake | Security log events | ✓ | |
 | Palo Alto Networks SaaS Security Cloud | Security log events | ||
 | Ping Identity |
| ||
 | Proofpoint |
| ||
 | Proofpoint Targeted Attack Protection |
| ✓ | |
| Proofpoint On-Demand | Proofpoint Endpoints Message, and Maillog | ✓ | |
 | Rapd7 InsightVM | Reports | ||
 | Salesforce |
| ||
 | SentinelOne | Management API | ||
| SentinelOne | Deep Visibility | ✓ | |
| SentinelOne Alerts | Security alerts related logs from resources monitored by SentinelOne | ✓ | |
| SentinelOne Threats | Security threats related logs from resources monitored by SentinelOne | ✓ | |
 | ServiceNow |
| ||
 | Slack | Slack Enterprise Grid apps | ||
| Slack | Slack Classic apps | ||
 | Snowflake |
| ||
 | Sophos Central |
| ||
 | Splunk | Any events in the Splunk cloud | ✓ | |
 | Symantec CloudSOC | Management API | ||
| Symantec Email Security.cloud | Advanced Threat Protection events | ||
| Symantec Endpoint Protection Mobile | Security events | ||
| Symantec Endpoint Detection and Response (EDR) | Security events | ✓ | |
| Symantec Web Security Service | Sync API logs | ||
 | Tenable.io | Tenable scan results | ||
 | Trend Vision One | Observed Attack Techniques events and Workbench Alerts | ✓ | |
 | Workday | Web services events | ||
 | Zoom |
| ||
 | Wiz | Audit logs from Wiz | ✓ | |
| Wiz | Issues from Wiz | ✓ | |
 | Zscaler ZIA | Web, Firewall | ✓ | |
Generic Collectors
If the data source you're looking to onboard does not have a dedicated collector, you may still be able to ingest the data using one of the generic collectors, as long as your data source supports one of the generic event transport methods.
Vendor/Product | Data Source | Collector to Use | New Scale? | |
|---|---|---|---|---|
| AWS SQS | Any events stored in an SQS queue | ✓ | |
| AWS S3 | Any events stored in an AWS S3 bucket | ✓ | |
| Azure EventHub | Event monitoring logs:
| ✓ | |
| Azure Storage | Any events stored in an Azure Storage account | ||
| Google Cloud Platform Pub/Sub | Events from any GCP service that can be forwarded to GCP Pub/Sub | ✓ | |
 | Generic Webhook | Events from any product that supports forwarding to Webhook and fullfills Exabeam requirements | Generic Webhook Cloud Collector Recommended Collector: | ✓ |