Skip to main content

Log StreamLog Stream Guide

Table of ContentsTable of Contents

Supported Vendors and Products

Exabeam supports data sources from the following vendors and products for log ingestion.

Note

This list is updated monthly, so there is a possibility that a newly supported product hasn't been added yet. Contact your account team to request new product additions.

Category	Vendor	Products
Access Management	1password	1password
	Akamai	Cloud Akamai
	Amazon	AWS Bastion
	AppSense	AppSense Application Manager
	Auth0	Auth0
	Cisco	Duo Access
	Citrix	Citrix Secure Private Access
	Entrust	Entrust Identity Enterprise
	F5	F5 Access Policy Manager
	Fortinet	FortiAuthenticator
	IBM	Security Access Manager
	Int64 Software	OVERLAPS
	Jumpcloud	Jumpcloud
	Microsoft	Active Directory Federation Services Microsoft Entra Microsoft Intune Windows Device registration service
	Okta	Okta Adaptive MFA Okta Workforce Identity Cloud
	OneLogin	OneLogin
	OneWelcome	OneWelcome Cloud Identity Platform
	Ping Identity	ForgeRock Ping Identity PingFederate PingOne
	RSA	SecurID
	SecureAuth	SecureAuth IDP SecureAuth Login
	Shibboleth	Shibboleth
	SiteMinder	Symantec SiteMinder
	Symantec	Symantec VIP
Application Security Testing	Checkmarx	Checkmarx
Asset Management	LanScope	LanScope Cat
	Qualys	Qualys AssetView
	Trend Micro	Apex One
Backup & Recovery	CDS	CDS
	Dell	PowerProtect PowerProtect Data Manager
	Rubrik	Rubrik Cloud Data Management
	Veeam	Veeam
Cloud App Security Broker (Casb)	Amazon	AWS GuardDuty
	Bitglass	Bitglass CASB
	Netskope	Netskope CASB Netskope Security Cloud Netskope Webtx
	Obsidian Security	SaaS Security
	Palo Alto Networks	Palo Alto Aperture
	Skyhigh Security	Skyhigh CASB
	Symantec	Symantec CloudSOC
Cloud Auditing	Amazon	AWS CloudTrail AWS Security Hub AWS Simple Email Service Amazon S3
	Atlassian	Atlassian Guard
	Cisco	Cisco Cloud Security
	Cloudflare	Cloudflare Audit
	Google	GCP CloudAudit Google Cloud Platform Google Workspace Security Command Center
	Microsoft	Azure AD Activity Logs Azure AD Sign-In Logs Azure Container Registry Azure Kubernetes Service Azure Monitor Azure Network Watcher M365 Audit Logs Microsoft 365
	Monday.com	Monday.com
	Oracle	Oracle Public Cloud
	Saviynt	Saviynt
	Zero Networks	Zero Networks
Cloud-Native Application Protection Platform (Cnapp)	Microsoft	Microsoft Defender for Cloud
	Palo Alto Networks	Prisma Access Prisma Cloud
	Tanium	Tanium Cloud Platform
	Wiz	Wiz
Code Management	Atlassian	Atlassian Atlassian BitBucket
	GitHub	GitHub
	GitLab	GitLab
	Perforce	Perforce
Communication Platform	Cisco	Cisco Collaboration
	Slack	Slack
	Zoom	Zoom
Content Delivery Network (Cdn)	Adobe	Adobe Experience Manager
Credential Management	Keeper Security	Keeper
	LastPass	LastPass
	ManageEngine	ADSSP
	Password Manager Pro	Password Manager Pro
Crm (Customer Relationship Management)	Salesforce	Salesforce
Data Warehouse	Amazon	AWS Redshift
	Informatica	Informatica Cloud
Database	Amazon	Amazon RDS
	Apache	Cassandra db
	Confluent	Confluent Cloud
	IBM	DB2
	MariaDB	MariaDB
	Microsoft	MSSQL
	MongoDB	MongoDB
	Mysql	Mysql
	Oracle	Oracle Cloud Infrastructure Oracle Database
	Osquery	Osquery
	PostgreSQL	PostgreSQL
	Snowflake	Snowflake
	Teradata	Teradata RDBMS
Database Security	Imperva	Imperva SecureSphere
	Trellix	Trellix Database Security
Ddos Mitigation Services	Arbor	Arbor Cloud
Directory Service Auditing	OpenDJ	OpenDJ
	OpenLDAP	OpenLDAP
	Semperis	Semperis DSP
	SunOne	SunOne
Dlp (Data Loss Prevention)	Box	Box Shield
	Commvault	Commvault
	Cyberhaven	Cyberhaven DLP
	Cyera	Omni DLP
	Digital Guardian	Digital Guardian Network DLP
	Forcepoint	Forcepoint DLP
	Halcyon	Halcyon
	IBM	Guardium
	Microsoft	Microsoft Purview
	Mimecast	Code42 Incydr
	NextDLP	Reveal
	Nightfall	Nightfall AI
	Symantec	Symantec DLP
	Trellix	Trellix DLP Endpoint
Edr (Endpoint Detection & Response)	Cisco	Cisco Secure Endpoint
	CrowdStrike	Falcon Identity Threat Detection & Response
	Cylance	Cylance OPTICS
	Cynet	Cynet EDR
	Digital Guardian	Digital Guardian Endpoint Protection
	F5	F5 WebSafe
	Jamf	Jamf Protect
	Palo Alto Networks	Cortex XDR
	SentinelOne	Scalyr Singularity Platform
	Symantec	Symantec Advanced Threat Protection
	Tanium	Tanium Core Platform
	Trellix	Trellix Endpoint Security (HX)
	VMware	Carbon Black CES Carbon Black EDR
	Zscaler	Zscaler Breach Predictor
Email	IBM	HCL Notes
	Microsoft	Microsoft Exchange
	Postfix	Postfix
	Unix	Unix Sendmail
Email Security	Abnormal Security	Abnormal Security
	Armorblox	Armorblox
	Barracuda	Barracuda Email Security Gateway
	Check Point	Check Point Avanan Harmony Email & Collaboration
	Cisco	Cisco Email Security
	Exabeam	Phishing Detection
	Forcepoint	Forcepoint Email Security
	Hornet	Hornetsecurity Cloud Email Security Services
	IMSVA	IMSVA
	Ironscales	Ironscales
	KnowBe4	Security Awareness Training
	Libraesva	Libraesva Email Security
	Mimecast	Mimecast Secure Email Gateway Mimecast Targeted Threat Protection - URL
	Proofpoint	Proofpoint Email Protection Proofpoint Enterprise Protection
	Symantec	Symantec Email Security
	Tessian	Tessian Cloud Email Security
	Trellix	Trellix Email Security Trellix Email Security Trellix Email Security - Cloud Edition
	Trend Micro	Trend Micro Email Security Trend Micro ScanMail
	Virtru	Virtru
Endpoint Auditing	Apple	macOS
	Exabeam	ABA Telemetry
	FreeBSD	FreeBSD
	Microsoft	Azure DevOps Azure Monitor - VM Insights Event Viewer - ADFS Event Viewer - ADWS Event Viewer - Application Event Viewer - Applocker Event Viewer - AzureADPasswordProtection-DCAgent Event Viewer - AzureADPasswordProtection-ProxyService Event Viewer - BFE Resorce Flows Event Viewer - BITS-Client Event Viewer - Base-Filtering-Engine-Connections Event Viewer - CAPI2 Event Viewer - CertificateServicesClient Event Viewer - CodeIntegrity Event Viewer - DFS-Replication Event Viewer - DNSClient Event Viewer - DNSServer Event Viewer - Directory-Service Event Viewer - File Replication Service Event Viewer - FileShareShadowCopyProvider Event Viewer - IPhlpSVC Event Viewer - Kerberos-Key-Distribution-Center Event Viewer - Kernel-IO Event Viewer - Kernel-PnP Event Viewer - KnownFolders Event Viewer - LSA Event Viewer - Licensing-Platform Event Viewer - LiveId Event Viewer - NPS Event Viewer - NTLM Event Viewer - NetworkProfile Event Viewer - OpenSSH Event Viewer - PowerShell Event Viewer - PrintService Event Viewer - RemoteDesktopServices Event Viewer - SMB Event Viewer - Security Event Viewer - Setup Event Viewer - System Event Viewer - TaskScheduler Event Viewer - TerminalServices Event Viewer - TerminalServices-Gateway Event Viewer - TerminalServices-LocalSessionManager Event Viewer - TerminalServices-RemoteConnectionManager Event Viewer - WinNat Event Viewer - WinRM Event Viewer - Windows Firewall NetLogon Sysmon
	Oracle	Solaris
	SentinelOne	Event Viewer - Sentinelone
	Unix	Auditbeat Unix Unix Auditd Unix Named Unix dhcpd
Epp (Endpoint Protection)	Absolute	Absolute DDS
	Airlock	Airlock Allowlisting
	Arctic Wolf	Cylance Protect
	AssetView	AssetView
	Bitdefender	GravityZone
	BlackBerry	BlackBerry Protect
	Check Point	Check Point Anti-Malware Check Point Endpoint Security
	Cybereason	Cybereason
	Cylance	Cylance PROTECT
	ESET	ESET Endpoint Security
	Kaspersky	Kaspersky Endpoint Security for Business
	Malwarebytes	Malwarebytes Endpoint Protection
	Microsoft	Azure ATP Microsoft Defender Microsoft Defender for Endpoint
	Sophos	Sophos Endpoint Protection
	Symantec	Symantec Endpoint Protection
	TXOne Networks	StellarOne StellarProtect
	Trellix	Trellix Endpoint Security
	Trend Micro	Deep Security OfficeScan
	VBCorp	VBCorp
	Venafi	TLS Protect
Erp (Enterprise Resource Planning)	SAP	SAP
	Workday	Workday
Event Management & Forwarding	Cribl	Cribl
	Delinea	Centrify Audit and Monitoring Service
	Exabeam	Search
	ManageEngine	ADAuditPlus ADManager Plus
	MicroFocus ArcSight	MicroFocus ArcSight
	Microsoft	Azure Event Hub
	Quest Software	Quest Change Auditor for Active Directory Quest Change Auditor for SQL Server
	Skyformation	Skyformation
	Unix	rsyslog
File Integrity Monitoring	Cimcor	CimTrak
	NNT	NNT ChangeTracker
	Tanium	Tanium Integrity Monitor
File Sharing	Accellion	Kiteworks
	Box	Box Cloud Content Management
	Cohesity	Cohesity DataPlatform
	Dell	EMC Isilon
	Dropbox	Dropbox
	Egnyte	Egnyte
	HP	HPE 3PAR StoreServ
	Nasuni	Nasuni
	NetApp	NetApp
	Progress	Progress ShareFile
	Synology NAS	Synology NAS
File Systems And Object Storage	Dell	PowerMax PowerStore
	NetApp	NetApp Ontap
File Transfer	CrushFTP	CrushFTP
	FTP	FTP
	GoAnywhere	GoAnywhere MFT
	Ipswitch	MoveIt Transfer
	LiquidFiles	LiquidFiles
Firewall	Amazon	AWS Network Firewall
	Barracuda	Barracuda Cloudgen Firewall
	Check Point	Check Point NGFW
	Cisco	Cisco Adaptive Security Appliance Cisco Network Security
	Dell	Sonicwall
	F5	F5 Advanced Firewall Manager
	Fastly	Next-Gen Web Application Firewall
	Forcepoint	Forcepoint Next-Gen Firewall
	Fortinet	FortiGate FortiXDR Fortinet Enterprise Firewall Fortinet UTM
	Huawei	Huawei Enterprise Network Firewall Huawei Unified Security Gateway
	IPTables	IPTables FW
	Juniper Networks	Juniper SRX Series
	Microsoft	Azure Firewall
	Palo Alto Networks	Palo Alto NGFW
	Sangfor	Sangfor NGAF
	Sophos	Sophos UTM Sophos XG Firewall Sophos XGS Firewall
	ThreatBlockr	ThreatBlockr
	Watchguard	Watchguard
	Zscaler	FW Zscaler Cloud
	Zyxel Networks	Zyxel USG FLEX
	pfSense	pfSense
Generative Ai Apps	AIM Security	AI Security
	Amazon	Amazon Q
	Google	Gemini Enterprise
	Microsoft	Copilot
	OpenAI	ChatGPT OpenAI
Honeypot	Attivo	BOTsink
	Zscaler	Zscaler Deception
Ics Security	Nozomi Networks	Nozomi Networks Guardian
Identity Administration	Check Point	Check Point Identity Awareness
	Cisco	Cisco Identity Intelligence Cisco Identity and Access Management
	Delinea	Delinea Platform
	Imprivata	Imprivata
	Sailpoint	IdentityNow Sailpoint IIQ SecurityIQ
	SecureLink	SecureLink
	VMware	VMware Identity Manager
Ids (Intrusion Detection System)	Corelight	Corelight IDS
Infrastructure Monitoring?	Sysdig	Sysdig Monitor
Insider Risk Management	Citrix	Citrix Security Analytics
	Dtex Systems	DTEX InTERCEPT
	Microsoft	Microsoft Advanced Threat Analytics
	Proofpoint	ObserveIT Proofpoint Insider Threat Management
Iot Security	Armis	Armis Platform
	Claroty	Claroty
	Ordr	Ordr AI Protect Ordr SCE
Ip Address Management (Ipam)	BlueCat Networks	BlueCat Networks
	Infoblox	BloxOne DDI Infoblox NIOS
	N3K	N3K
Ips (Intrusion Prevention System)	IXIA	IXIA ThreatArmor
	OSSEC	OSSEC
	Snort	Snort
	Suricata	Suricata
	Trellix	Trellix Network Security Platform Trellix Web MPS
	Trend Micro	TippingPoint NGIPS
	Zimperium	Zimperium MTD
Load Balancer	Amazon	AWS Elastic Load Balancer Amazon Route 53
	F5	BIG-IP F5 LBR
	Kemp	Kemp LoadMaster
	Radware	Alteon
Managed Detection And Response (Mdr)	SentinelOne	Vigilance
Mobile Management	Lookout	Lookout
	VMware	VMware AirWatch
Ndr (Network Detection And Response)	Cisco	Cisco Secure Network Analytics
	Extrahop	Extrahop Reveal(x)
	Trend Micro	Vision One
Network	Cisco	Cisco Cyber Vision
	Dnsmasq	Dnsmasq
	Trellix	Trellix Network Security (NX)
Network Access Control (Nac)	Cisco	Cisco ISE Cisco Wireless Networking
	Extreme Networks	Universal ZTNA
	Forescout	Forescout CounterACT
	Fortinet	FortiClient FortiNAC
	HP	Aruba ClearPass Policy Manager
	Microsoft	Microsoft Network Policy Server
	PacketFence	PacketFence
	Portnox	Portnox Cloud
	Sophos	Sophos ZTNA
	Ubiquiti	Unifi Access Point
Network Analyzer	Amazon	VPC Flow Logs
	Cisco	Cisco Network Monitoring and Analytics
	Cloudflare	Cloudflare Insights
	LogRhythm	NetMon
	Microsoft	Microsoft DHCP Log Microsoft DNS Log Network Security Group Flow Logs
	Zeek	Zeek
Network Automation And Orchestration	F5	F5 BIG-IP DNS F5 Distributed Cloud
	PowerDNS	PowerDNS Recursor
	Swimlane	Swimlane Turbine
Network Devices	Avaya	Avaya Ethernet Routing Switch
	Cisco	Cisco IOS
	HP	Aruba Wireless controller ArubaOS HPE Comware
	Juniper Networks	Junos OS
Network Infrastructure & Management	Cisco	Cisco Network Infrastructure and Management Cisco Secure Firewall Management Center
	Extreme Networks	EXOS Platform ONE Zebra WLAN Management
Network Performance Monitoring	Nagios	Nagios
	Splunk	Splunk Stream
Network Security Policy Management (Nspm)	AlgoSec	AlgoSec Firewall Analyzer
	FireMon	FireMon
	Trellix	Trellix ePolicy Orchestrator
Operational Technology Security	Claroty	CTD
	Dragos	Dragos Platform
Physical Access Control	Badge	Badge
	DataWatch Systems	DataWatch
	Gallagher	Gallagher Access Control
	Johnson Controls	Johnson Controls P2000
	Lenel	OnGuard
	RS2 Technologies	RS2 Technologies
	Siemens	Siemens Access Control
	Tyco	CCURE Building Management System
Printer	Canon	imageRUNNER ADVANCE
	HP	HP LaserJet Printer HP Print Server
	XPS	XPS
Privilege Access Management	Admin By Request	Admin By Request
	BeyondTrust	BeyondInsight BeyondTrust BeyondTrust Privileged Identity BeyondTrust Secure Remote Access
	CA Technologies	CA Privileged Access Manager Server Control
	Click Studios	Passwordstate
	CyberArk	CyberArk Privilege Access Manager
	Delinea	Centrify Infrastructure Services Secret Server
	HelpSystems	Powertech Identity and Access Manager
	ManageEngine	PAM360
	Microsoft	Azure Key Vault
	Visma	Megaflex
	Wallix	Wallix Bastion
Proxy	Kong	Kong Gateway
	Menlo Security	Menlo Security
	Ping Identity	Ping Access
	Squid	Squid
Remote Access	Apache	Apache Guacamole
	BeyondTrust	BeyondTrust Remote Support
	Microsoft	Microsoft RRAS
	Secomea	Secomea
Sandboxing	Check Point	Check Point Threat Emulation
	Proofpoint	Targeted Attack Platform
	Symantec	Symantec Content Analysis System
	Trend Micro	Deep Discovery Inspector
Secure Enterprise Browser	Ermes	Ermes Browser Security Platform
	Island	Island Enterprise Browser
Security Configuration Management (Scm)	Amazon	AWS SSM
	Tripwire Enterprise	Tripwire Enterprise
Security Services Edge (Sse)	Cisco	Cisco Web Security
	Digital Arts	Digital Arts i-FILTER for Business
	Forcepoint	Websense Security Gateway
	HUMAN Security	HUMAN Bot Defender
	McAfee	McAfee Web Gateway
	Microsoft	Microsoft CAS
	Proofpoint	Proofpoint CASB
	Skyhigh Security	Secure Web Gateway Skyhigh Security Cloud
	Symantec	Symantec Web Security Service
	Zscaler	Zscaler Internet Access
	iBoss	Iboss Cloud
Siem (Security Information And Event Management)	Akamai	Akamai SIEM
	Darktrace	Darktrace
	Epic	Epic SIEM
	Exabeam	Advanced Analytics Audit Log Correlation Rule NG Analytics
	Fortinet	FortiSIEM
	IBM	QRadar SIEM
	LogRhythm	LogRhythm
	Microsoft	Microsoft Sentinel
	Netwrix	Netwrix Auditor
	RSA	RSA NetWitness Platform
	SkySea	SkySea ClientView
	Splunk	Splunk ES
	Trellix	Trellix Central Management Trellix Helix
	Varonis	Varonis Data Security Platform
Threat Intelligence	Palo Alto Networks	Palo Alto WildFire
	Recorded Future	Recorded Future Threat Intelligence
	ZeroFox	ZeroFox Protection
User Authentication	Delinea	Centrify Authentication Service Centrify Zero Trust Privilege Services
	Microsoft	Azure MFA
	OneSpan	Digipass for Apps
	RSA	RSA Authentication Manager
	SecurEnvoy	SecurEnvoy Multi-Factor Authentication
	Silverfort	Silverfort Authentication Platform
	Swivel	Swivel
Virtualization & Containers	Amazon	Amazon EKS
	Citrix	Citrix Virtual Apps
	Open Shift	OpenShift
	VMware	VMware ESXi VMware Horizon VMware VeloCloud SD-WAN VMware View vCenter
	oVirt	oVirt
Vpn (Virtual Private Network)	CatoNetworks	Cato Cloud
	Check Point	Check Point Security Gateway
	Cisco	Cisco Remote Access Security
	Citrix	Citrix Gateway
	Fortinet	Fortinet VPN
	Ivanti	Ivanti Pulse Secure
	NetMotion Wireless	NetMotion Wireless
	Open VPN	Open VPN
	Palo Alto Networks	GlobalProtect
	SecureNet	SecureNet
	Zscaler	Zscaler Private Access
Vulnerability Assessment	Amazon	Amazon Inspector
	Rapid7	Rapid7 InsightVM
	Tenable	Tenable Cloud Security Tenable Identity Exposure Tenable Vulnerability Management Tenable Web App Scanning
Waf (Web Application Firewall)	Amazon	AWS WAF
	Barracuda	Barracuda WAF
	Citrix	Citrix Web App Firewall
	Cloudflare	Cloudflare WAF
	F5	F5 Advanced Web Application Firewall F5 Application Security Manager F5 Silverline
	Fortinet	Fortiweb Web Application Firewall
	Imperva	Imperva Incapsula
	Radware	Radware WAF
	RedShield	RedShield WAF
	SIGSCI	SIGSCI
Web Server	F5	NGINX
	HP	NonStop
Web Server Auditing	Apache	Apache
	Microsoft	Microsoft IIS Microsoft WMI Log
Workload Protection	Amazon	AWS CloudWatch
	Illumio	Illumio Core
	Microsoft	Windows Defender Application Control
	VMware	Carbon Black App Control
Other	APC	APC
	Adaxes	Adaxes
	Akamai	Akamai Guardicore
	Apache	Apache Subversion Apache Tomcat
	Check Point	Harmony SaaS SmartDefense
	Cisco	Cisco Data Center
	Commvault	Commvault ThreatWise
	F-Secure	F-Secure Client Security F-Secure Policy Manager
	F5	F5 BIG-IP
	Gamma	Gamma
	HP	Aruba Mobility Master HP iLO
	IBM	IBM IBM Datapower IBM Mainframe Sterling B2B Integrator
	IMSS	IMSS
	Imperva	Attack Analytics
	Infoblox	Infoblox NetMRI
	Kasada	Kasada
	Mvision	Mvision
	Onapsis	Onapsis
	PagerDuty	PagerDuty
	Palo Alto Networks	Cortex XSOAR
	Picture Perfect	Picture Perfect
	Portkey	Portkey
	PowerSentry	PowerSentry
	Riverbed Steelhead	Riverbed Steelhead
	ServiceNow	ServiceNow
	SmartSuite	SmartSuite
	StealthBits	StealthIntercept
	Swift	Swift
	Tanium	Tanium Threat Response
	ThoughtSpot	ThoughtSpot
	VMware	VMware NSX
	Vectra	Vectra Cognito Detect
	Vormetric	Vormetric
	Weblogin	Weblogin
	xPLAN	xPLAN