Data souce UUIDs ↗
This table lists the Cribl catalog for the the specific collectors supported. If a dedicated collector does not exist, use the generic UUID collector.
Any data source can be ingested using the generic UUID collector with the correct vendor and product fields. Yet, while parsing and modeling rules can be applied to any source, out-of-the-box (OOTB) analytics are only available for data sources using dedicated UUIDs.
Indicate specific vendor name as not listed below (Generic)
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Indicate specific product name as not listed below (Generic) | <p>af01292940d7426594d3d3e55ae17ee0</p><p>Do not use this generic UUID when your data source is listed in this table.</p> | <Vendor>_<Product>_raw |
Amazon
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| AWS audit logs | c19f87b6262f48259b3d5d2a2c691802 | amazon_aws_raw |
These AWS logs are collected via Amazon S3. To ensure compatibility, see Ingest audit logs from AWS Cloud Trail. |
| AWS EKS | fb8a9d4922cb4095b76d71e921d2d999 | amazon_eks_raw |
These AWS logs are collected via Amazon CloudWatch. To ensure collector compatibility, see Ingest logs from Amazon CloudWatch. |
| AWS flow logs | 667083aa68544eee8b67cdd2d4cc327b | amazon_aws_raw |
These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest network flow logs from Amazon S3. |
| AWS generic logs | 0498f8a24de04b3e85102e742f6783f8 | amazon_aws_raw |
These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest generic logs from Amazon S3. |
| AWS prompt logs | a53edad7ef0c46ffb5037fb2e21520cb | amazon_aws_raw |
For setup details, see Prompt log collection in AWS. |
| AWS Route 53 logs | <ul><li>d57ae82c1e2a4d138fc34084d159b09e (old)</li><li>0a7544038b444998a20e698669817e3d (new)</li></ul> | <ul><li>amazon_route53_raw (via old UUID)</li><li>amazon_route53_raw (via new UUID)</li></ul> |
These logs are collected via Amazon S3. Using the old UUID routes data to the generic AWS dataset. For native routing to the Route 53 dataset, use the new dedicated UUID. To ensure collector compatibility, see Ingest network Route 53 logs from Amazon S3. |
Box
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Box | 3ef05d14ae9349f8bbd48c8a4797334a | <ul><li>Events (admin_logs): box_admin_logs_raw</li><li>Box Shield Alerts: box_shield_alerts_raw</li><li>Users: box_users_raw</li><li>Groups: box_groups_raw</li></ul> |
<p>The BOX_DIRECTORIES connector queries the following Box API endpoints:</p><ul><li><p>Users</p><ul><li>Endpoint: https://api.box.com/2.0/users</li><li>Purpose: To fetch the list of users in Box enterprise.</li></ul></li><li><p>Groups</p><ul><li>Endpoint: https://api.box.com/2.0/groups</li><li>Purpose: To fetch the list of groups in Box enterprise.</li></ul></li></ul><p>For setup details, see Ingest logs and data from Box.</p> |
CrowdStrike
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Falcon incident | 230b2b0233bf4327806af72e6e5769f3 | crowdstrike_falcon_incident_raw |
<p>Currently not supported by Cribl</p><p>CrowdStrike Streaming API</p><p>Base URL: https://api.crowdstrike.com (or api.us-2.crowdstrike.com, api.eu-1.crowdstrike.com, etc.)</p><p>GET /sensors/entities/datafeed/v2</p><p>For setup details, see Ingest alerts and metadata from CrowdStrike APIs.</p> |
| Hosts | 8b673ac8e2f34b4a8dc14c22f0e6063b | crowdstrike_hosts_raw |
<p>CrowdStrike Devices API</p><p>GET /devices/queries/devices-scroll/v1</p><p>POST /devices/entities/devices/v2</p><p>For setup details, see Ingest alerts and metadata from CrowdStrike APIs.</p> |
Dropbox
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Directory | e8d2c52bc9594621924fab0507264586 | <ul><li>dropbox_members_devices_raw</li><li>dropbox_users_raw</li><li>dropbox_groups_raw</li></ul> |
<p>Base URL: https://api.dropboxapi.com</p><ul><li><p>Users (dropbox_users_raw)</p><ul><li>Endpoint: /2/team/members/list_v2</li></ul></li><li><p>Groups (dropbox_groups_raw)</p><ul><li>Endpoint: /2/team/groups/list</li></ul></li><li><p>Devices (dropbox_member_devices_raw)</p><ul><li>Endpoint: /2/team/devices/list_members_devices</li></ul></li></ul><p>For setup details, see Ingest logs and data from Dropbox.</p> |
| Events | a6322b2fd9e545e0a4223ba754c48fb9 | dropbox_events_raw |
<p>Base URL: https://api.dropboxapi.com</p><p>Endpoint: /2/team_log/get_events</p><p>For setup details, see Ingest logs and data from Dropbox.</p> |
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Cloud Logging (audit logs/flow logs) | 00a8322c85e14beabfa7ad5f3d62db73 | google_cloud_logging_raw |
For setup details, see Ingest logs and data from a GCP Pub/Sub. |
| Gmail | 8607490288d1407ba82b5c5ad9dc64a0 | google_gmail_raw |
<p>GET https://gmail.googleapis.com/gmail/v1/users/{userId}/messages</p><p>For setup details, see Ingest logs and data from Google Workspace.</p> |
| Workspace alerts | 4f263650cd29475c81f2ff953cf19827 | google_workspace_alerts_raw |
<p>Description: Ingests security and system alerts from the Google Workspace Alert Center.</p><ul><li><p>API Details</p><ul><li>API Name: Google Alert Center API</li><li>Version: v1beta1</li><li>Base URL: https://alertcenter.googleapis.com</li><li>Endpoint: /v1beta1/alerts</li><li>Method: GET (List)</li><li>OAuth Scope: https://www.googleapis.com/auth/apps.alerts</li></ul></li><li><p>Request Parameters</p><ul><li>filter: Used for incremental ingestion based on createTime.</li><li>Format: createTime >= "[TIMESTAMP_START]" AND createTime < "[TIMESTAMP_END]"</li><li>orderBy: createTime asc</li><li>pageToken: Used for pagination.</li></ul></li><li><p>Data Mapping</p><ul><li>Source: The full JSON response object from the alerts list.</li><li>Destination: Each alert object is ingested as a single record.</li></ul></li></ul><p>For setup details, see Ingest logs and data from Google Workspace.</p> |
| Workspace ChromeOS devices | e82ae276e6b9442fa80920a03d2a38d6 | google_workspace_chrome_raw |
<p>GET https://admin.googleapis.com/admin/directory/v1/customer/{customer}/devices/chromeos</p><p>For setup details, see Ingest logs and data from Google Workspace.</p> |
| Workspace groups | 689ae8ef14e848e3855b81e91d8af9bc | google_workspace_enterprise_groups_raw |
<p>GET https://admin.googleapis.com/admin/directory/v1/groups</p><p>For setup details, see Ingest logs and data from Google Workspace.</p> |
| Workspace rules | 2621aaf3334a4147ae727afe84db31a9 | google_workspace_rules_raw |
<p>GET https://gmail.googleapis.com/gmail/v1/users/{userId}/settings/filters</p><p>For setup details, see Ingest logs and data from Google Workspace.</p> |
| Workspace users | 359ecd845fa54caab6ddb4b7c7a2764d | google_workspace_user_acounts_raw |
<p>GET https://admin.googleapis.com/admin/directory/v1/users/{userKey}</p><p>For setup details, see Ingest logs and data from Google Workspace.</p> |
Microsoft
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Azure | fce13a1d51294f84bae4a37851503060 | msft_azure_raw |
Azure Event Hubs SDK (AMQP): For setup details, see Ingest logs from Microsoft Azure Event Hub. |
| Azure AD | c00d6d52e5b141a8baa8db9d9345423d | msft_azure_ad_raw |
For set up details, see Ingest logs from Microsoft Office 365. |
| Azure AD audit | 0e076d5abe864bf78e8145ea9e0d749e | msft_azure_ad_audit_raw |
<p>Microsoft Graph API: GET /v1.0/auditLogs/directoryaudits</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Azure AD sign-ins | f56dcfdf6bca43e793a4b6e9290e7b12 | msft_azure_ad_raw |
<p>Microsoft Graph API: GET /v1.0/auditLogs/signIns</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Defender | ce9e8cf36e0742c38aa89787a256855f | msft_defender_raw |
<p>Azure Event Hubs SDK (AMQP): For setup details, see Ingest raw EDR events from Microsoft Defender for Endpoint.</p><p>To enable analytics, contact Customer Support.</p> |
| DHCP | b55819e8959c49728d5d98a6d87eafb6 | msft_dhcp_raw |
<p>File Collection: C:\Windows\System32\dhcp\DhcpSrvLog-*.log</p><p>For set up details, see Ingest logs from Windows DHCP using Elasticsearch Filebeat.</p> |
| Graph security alerts | 5619f2f691fc46c4b202587fdaa031c3 | msft_graph_security_alerts_raw |
<p>Microsoft Graph API: /v1.0/security/alerts_v2</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Office 365 Azure AD | e1f109f886ea42fbb96be6ec0cc597a9 | msft_o365_azure_ad_raw |
<p>The Base URLs for the APIs are (depending on the environment):</p><p>Worldwide: https://manage.office.com</p><p>GCC: https://manage-gcc.office.com</p><p>GCC High: https://manage.office365.us</p><p>DoD: https://manage.protection.apps.mil</p><p>Endpoints:</p><p>Start Subscription: /api/v1.0/{tenantID}/activity/feed/subscriptions/start?contentType={type}</p><p>List Available Content: /api/v1.0/{tenantID}/activity/feed/subscriptions/content?contentType={type}</p><p>Fetch Content Blob: Dynamic URI returned from the “List Available Content” call.</p><p>Content Types: audit.exchange, audit.sharepoint, audit.general, audit.azureactivedirectory, dlp.all.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Office 365 DLP | 8f052782739d4b8389644cca23b994ac | msft_o365_dlp_raw |
<p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Office 365 domains | cae29fd87b554bd9a5694afb225e8dc9 | msft_o365_domains_raw |
Microsoft Graph API: GET /v1.0/domains |
| Office 365 Exchange Online | dee8e85ce7db4573a8bc21b807e1d73a | msft_o365_exchange_online_raw |
<p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Office 365 General | c7655e83805b4a058e66043a6715156c | msft_o365_general_raw |
<p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Office 365 Sharepoint Online | 3a37f519e9094a3f8c4185fa572cd111 | msft_o365_sharepoint_online_raw |
<p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p> |
| Office 365 contacts (email) | de1b694a6c8341958bc08c4b7c140874 | msft_o365_contacts_raw |
<p>Microsoft Graph API: GET /v1.0/users/{id}/mailFolders/inbox/messageRules</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p> |
| Office 365 devices (email) | de229685f708413fad46289657ea09de | msft_o365_devices_raw |
<p>Microsoft Graph API: GET /v1.0/users/{id}/registeredDevices</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p> |
| Office 365 groups (email) | 0b0499ac0d984145b201c6d674771dbf | msft_o365_groups_raw |
<p>Microsoft Graph API: GET /v1.0/groups</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p> |
| Office 365 mailboxes (email) | 9855a03559ce4263b568671e695d1fa8 | msft_o365_mailboxes_raw |
<p>The Base URLs for the APIs are (depending on the environment): https://graph.microsoft.com</code> (or <code>https://graph.microsoft.us` for FedRAMP)</p><p>Incoming Messages: GET /v1.0/users/{id}/messages</p><p>Outgoing Messages: GET /v1.0/users/{id}/mailFolders/sentitems/messages/delta</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p> |
| Office 365 rules (email) | 6b925df8923d4038bf78998d1ffde77c | msft_o365_rules_raw |
<p>Microsoft Graph API: /users/{id}/mailFolders/inbox/messageRules</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p> |
| Office 365 users (email) | dcfb7a412e654efd868de0b8cf81766a | msft_o365_users_raw |
<p>Microsoft Graph API: GET /v1.0/users</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p> |
| Windows Event Logs | 63b0fbeb501e4650896e7064d3412e14 | microsoft_windows_raw |
For more information, see Collect Windows Event Logs for Cortex XSIAM via Cribl. |
Okta
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| SSO | 5faf4c1fdb8443d9920d6a54815432c1 | okta_sso_raw |
<p>Okta System Log API</p><p>Base URL: https://{your-okta-domain}.okta.com</p><p>GET /api/v1/logs</p><p>For set up details, see Ingest logs and data from Okta.</p> |
OneLogin
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| Events | 22b23a3f9f1e49998645b683d5dc3a6f | onelogin_events_raw |
<p>Base URL: https://<subdomain>.onelogin.com</p><p>Endpoint: /api/1/events`</p><p>For set up details, see Ingest logs and data from OneLogin.</p> |
| OneLogin | 88cfbd3e7b974d999b10edac83995b8a | <ul><li>onelogin_users_raw</li><li>onelogin_groups_raw</li><li>onelogin_apps_raw</li></ul> |
<p>Base URL: https://<subdomain>.onelogin.com</p><p>Endpoints: /api/1/users/api/1/groups/api/2/apps</p><p>For set up details, see Ingest logs and data from OneLogin.</p> |
PingID
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| PingONE | 924951a8394b4605b1725f943292ab4f | pingid_pingone_raw |
<p>PingOne API:</p><p>Base URL: https://admin-api.pingone.com</p><p>Endpoint: /v3/reports/{account_id}/poll-subscriptions/{subscription_id}/events</p><p>For set up details, see Ingest authentication logs and data from PingOne.</p> |
Proofpoint
| Product | UUID | Datasets | Collection Method |
|---|---|---|---|
| TAP | 3eefce0f791e4391a3643b8cf860a361 | proofpoint_tap_raw |
<p>API Base URL: https://tap-api-v2.proofpoint.com</p><p>Resource Path: /v2/siem/all</p><p>For set up details, see Ingest logs from Proofpoint Targeted Attack Protection.</p> |
Salesforce: Salesforce logs
| UUID | Datasets | Collection Method |
|---|---|---|
| ab109687acd24978aabcb7ad8b5742e3 | <ul><li>salesforce_login_raw</li><li>salesforce_audit_raw</li><li>salesforce_eventlogfile_raw</li></ul> |
<p>The data schema for salesforce_eventlogfile_raw is dynamic and not hardcoded in the data collector's source code.</p><p>Here's how it works:</p><p>Dynamic Field Discovery: The collector calls the Salesforce describe endpoint (/services/data/v56.0/sobjects/EventLogFile/describe) to retrieve the list of all available fields for the EventLogFile object.</p><p>Query Construction: It constructs a SOQL query selecting all these discovered fields, such as SELECT Id, LogFile, LogDate,.... FROM EventLogFile).</p><p>CSV to JSON: The downloaded log files are in CSV format. The collector converts each CSV row into a JSON object where the keys are the CSV headers (which correspond to the fields discovered in the Dynamic Field Discovery explained above).</p><p>For set up details, see Ingest logs and data from Salesforce.</p> |
Salesforce: Salesforce snapshots
| UUID | ||
|---|---|---|
| addbf31a6372491e88d45934dff5b5b0 | <p>The data fetched by this data collector is written to datasets based on the Salesforce object being retrieved. The data collector dynamically sets the Product field in the response to the name of the Salesforce object. Assuming the standard naming convention <vendor>_<product>_raw (where Vendor is salesforce); the data will be written to the following datasets (corresponding to the objects defined in consts.go):</p><ul><li>salesforce_ConnectedApplication_raw</li><li>salesforce_PermissionSet_raw</li><li>salesforce_Profile_raw</li><li>salesforce_GroupMember_raw</li><li>salesforce_Group_raw</li><li>salesforce_User_raw</li><li>salesforce_UserRole_raw</li><li>salesforce_TenantSecurityLogin_raw</li><li>salesforce_UserAccountTeamMember_raw</li><li>salesforce_TenantSecurityUserPerm_raw</li></ul> |
<p>Authentication:</p><p>Path: /services/oauth2/token</p><p>Purpose: Used for obtaining and refreshing access tokens.</p><p>Data Query:</p><p>Path: /services/data/v56.0/queryAll</p><p>Purpose: Used to execute SOQL queries to fetch records for the snapshot objects, such as User, Profile, and Group.</p><p>Object Description:</p><p>Path: /services/data/v56.0/sobjects/{object}/describe</p><p>Purpose: Used to dynamically retrieve the list of fields for a specific object before querying it.</p><p>All endpoints are relative to the base URL: https://{domain}.my.salesforce.com.</p><p>For set up details, see Ingest logs and data from Salesforce.</p> |
Sentinel One: Deep Visibility
| UUID | Datasets | Collection Method |
|---|---|---|
| b9fa55e6fa564c709358425ce0f61517 | sentinelone_deep_visibility_raw |
<p>For set up details, see Ingest raw EDR events from SentinelOne DeepVisibility.</p><p>To enable analytics, contact Customer Support.</p> |
Service Now: CDMB
| UUID | Datasets | Collection Method |
|---|---|---|
| 8b3e767247e44471a95e563378d0b9be | <p>servicenow_cmdb_</p><p><table name>_raw</p> | <p>ServiceNow Table API</p><p>Base URL: https://{instance}.service-now.com</p><p>GET /api/now/table/{table_name}</p><p>For set up details, see Ingest data from ServiceNow CMDB.</p> |
Workday
| UUID | Datasets | Collection Method |
|---|---|---|
| 00d4e740702d4eb2939a87c2318513dd | workday_workday_raw |
<p>Workday Report-as-a-Service (RaaS)</p><p>Endpoint: Configurable Report URL</p><p>For set up details, see Ingest report data from Workday.</p> |