Data souce UUIDs

This table lists the Cribl catalog for the the specific collectors supported. If a dedicated collector does not exist, use the generic UUID collector.

Any data source can be ingested using the generic UUID collector with the correct vendor and product fields. Yet, while parsing and modeling rules can be applied to any source, out-of-the-box (OOTB) analytics are only available for data sources using dedicated UUIDs.

Indicate specific vendor name as not listed below (Generic)

Product UUID Datasets Collection Method
Indicate specific product name as not listed below (Generic) <p>af01292940d7426594d3d3e55ae17ee0</p><p>Do not use this generic UUID when your data source is listed in this table.</p> <Vendor>_<Product>_raw  

Amazon

Product UUID Datasets Collection Method
AWS audit logs c19f87b6262f48259b3d5d2a2c691802 amazon_aws_raw These AWS logs are collected via Amazon S3. To ensure compatibility, see Ingest audit logs from AWS Cloud Trail.
AWS EKS fb8a9d4922cb4095b76d71e921d2d999 amazon_eks_raw These AWS logs are collected via Amazon CloudWatch. To ensure collector compatibility, see Ingest logs from Amazon CloudWatch.
AWS flow logs 667083aa68544eee8b67cdd2d4cc327b amazon_aws_raw These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest network flow logs from Amazon S3.
AWS generic logs 0498f8a24de04b3e85102e742f6783f8 amazon_aws_raw These logs are collected via Amazon S3. To ensure collector compatibility, see Ingest generic logs from Amazon S3.
AWS prompt logs a53edad7ef0c46ffb5037fb2e21520cb amazon_aws_raw For setup details, see Prompt log collection in AWS.
AWS Route 53 logs <ul><li>d57ae82c1e2a4d138fc34084d159b09e (old)</li><li>0a7544038b444998a20e698669817e3d (new)</li></ul> <ul><li>amazon_route53_raw (via old UUID)</li><li>amazon_route53_raw (via new UUID)</li></ul> These logs are collected via Amazon S3. Using the old UUID routes data to the generic AWS dataset. For native routing to the Route 53 dataset, use the new dedicated UUID. To ensure collector compatibility, see Ingest network Route 53 logs from Amazon S3.

Box

Product UUID Datasets Collection Method
Box 3ef05d14ae9349f8bbd48c8a4797334a <ul><li>Events (admin_logs): box_admin_logs_raw</li><li>Box Shield Alerts: box_shield_alerts_raw</li><li>Users: box_users_raw</li><li>Groups: box_groups_raw</li></ul> <p>The BOX_DIRECTORIES connector queries the following Box API endpoints:</p><ul><li><p>Users</p><ul><li>Endpoint: https://api.box.com/2.0/users</li><li>Purpose: To fetch the list of users in Box enterprise.</li></ul></li><li><p>Groups</p><ul><li>Endpoint: https://api.box.com/2.0/groups</li><li>Purpose: To fetch the list of groups in Box enterprise.</li></ul></li></ul><p>For setup details, see Ingest logs and data from Box.</p>

CrowdStrike

Product UUID Datasets Collection Method
Falcon incident 230b2b0233bf4327806af72e6e5769f3 crowdstrike_falcon_incident_raw <p>Currently not supported by Cribl</p><p>CrowdStrike Streaming API</p><p>Base URL: https://api.crowdstrike.com (or api.us-2.crowdstrike.com, api.eu-1.crowdstrike.com, etc.)</p><p>GET /sensors/entities/datafeed/v2</p><p>For setup details, see Ingest alerts and metadata from CrowdStrike APIs.</p>
Hosts 8b673ac8e2f34b4a8dc14c22f0e6063b crowdstrike_hosts_raw <p>CrowdStrike Devices API</p><p>GET /devices/queries/devices-scroll/v1</p><p>POST /devices/entities/devices/v2</p><p>For setup details, see Ingest alerts and metadata from CrowdStrike APIs.</p>

Dropbox

Product UUID Datasets Collection Method
Directory e8d2c52bc9594621924fab0507264586 <ul><li>dropbox_members_devices_raw</li><li>dropbox_users_raw</li><li>dropbox_groups_raw</li></ul> <p>Base URL: https://api.dropboxapi.com</p><ul><li><p>Users (dropbox_users_raw)</p><ul><li>Endpoint: /2/team/members/list_v2</li></ul></li><li><p>Groups (dropbox_groups_raw)</p><ul><li>Endpoint: /2/team/groups/list</li></ul></li><li><p>Devices (dropbox_member_devices_raw)</p><ul><li>Endpoint: /2/team/devices/list_members_devices</li></ul></li></ul><p>For setup details, see Ingest logs and data from Dropbox.</p>
Events a6322b2fd9e545e0a4223ba754c48fb9 dropbox_events_raw <p>Base URL: https://api.dropboxapi.com</p><p>Endpoint: /2/team_log/get_events</p><p>For setup details, see Ingest logs and data from Dropbox.</p>

Google

Product UUID Datasets Collection Method
Cloud Logging (audit logs/flow logs) 00a8322c85e14beabfa7ad5f3d62db73 google_cloud_logging_raw For setup details, see Ingest logs and data from a GCP Pub/Sub.
Gmail 8607490288d1407ba82b5c5ad9dc64a0 google_gmail_raw <p>GET https://gmail.googleapis.com/gmail/v1/users/{userId}/messages</p><p>For setup details, see Ingest logs and data from Google Workspace.</p>
Workspace alerts 4f263650cd29475c81f2ff953cf19827 google_workspace_alerts_raw <p>Description: Ingests security and system alerts from the Google Workspace Alert Center.</p><ul><li><p>API Details</p><ul><li>API Name: Google Alert Center API</li><li>Version: v1beta1</li><li>Base URL: https://alertcenter.googleapis.com</li><li>Endpoint: /v1beta1/alerts</li><li>Method: GET (List)</li><li>OAuth Scope: https://www.googleapis.com/auth/apps.alerts</li></ul></li><li><p>Request Parameters</p><ul><li>filter: Used for incremental ingestion based on createTime.</li><li>Format: createTime >= "[TIMESTAMP_START]" AND createTime &#x3C; "[TIMESTAMP_END]"</li><li>orderBy: createTime asc</li><li>pageToken: Used for pagination.</li></ul></li><li><p>Data Mapping</p><ul><li>Source: The full JSON response object from the alerts list.</li><li>Destination: Each alert object is ingested as a single record.</li></ul></li></ul><p>For setup details, see Ingest logs and data from Google Workspace.</p>
Workspace ChromeOS devices e82ae276e6b9442fa80920a03d2a38d6 google_workspace_chrome_raw <p>GET https://admin.googleapis.com/admin/directory/v1/customer/{customer}/devices/chromeos</p><p>For setup details, see Ingest logs and data from Google Workspace.</p>
Workspace groups 689ae8ef14e848e3855b81e91d8af9bc google_workspace_enterprise_groups_raw <p>GET https://admin.googleapis.com/admin/directory/v1/groups</p><p>For setup details, see Ingest logs and data from Google Workspace.</p>
Workspace rules 2621aaf3334a4147ae727afe84db31a9 google_workspace_rules_raw <p>GET https://gmail.googleapis.com/gmail/v1/users/{userId}/settings/filters</p><p>For setup details, see Ingest logs and data from Google Workspace.</p>
Workspace users 359ecd845fa54caab6ddb4b7c7a2764d google_workspace_user_acounts_raw <p>GET https://admin.googleapis.com/admin/directory/v1/users/{userKey}</p><p>For setup details, see Ingest logs and data from Google Workspace.</p>

Microsoft

Product UUID Datasets Collection Method
Azure fce13a1d51294f84bae4a37851503060 msft_azure_raw Azure Event Hubs SDK (AMQP): For setup details, see Ingest logs from Microsoft Azure Event Hub.
Azure AD c00d6d52e5b141a8baa8db9d9345423d msft_azure_ad_raw For set up details, see Ingest logs from Microsoft Office 365.
Azure AD audit 0e076d5abe864bf78e8145ea9e0d749e msft_azure_ad_audit_raw <p>Microsoft Graph API: GET /v1.0/auditLogs/directoryaudits</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Azure AD sign-ins f56dcfdf6bca43e793a4b6e9290e7b12 msft_azure_ad_raw <p>Microsoft Graph API: GET /v1.0/auditLogs/signIns</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Defender ce9e8cf36e0742c38aa89787a256855f msft_defender_raw <p>Azure Event Hubs SDK (AMQP): For setup details, see Ingest raw EDR events from Microsoft Defender for Endpoint.</p><p>To enable analytics, contact Customer Support.</p>
DHCP b55819e8959c49728d5d98a6d87eafb6 msft_dhcp_raw <p>File Collection: C:\Windows\System32\dhcp\DhcpSrvLog-*.log</p><p>For set up details, see Ingest logs from Windows DHCP using Elasticsearch Filebeat.</p>
Graph security alerts 5619f2f691fc46c4b202587fdaa031c3 msft_graph_security_alerts_raw <p>Microsoft Graph API: /v1.0/security/alerts_v2</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Office 365 Azure AD e1f109f886ea42fbb96be6ec0cc597a9 msft_o365_azure_ad_raw <p>The Base URLs for the APIs are (depending on the environment):</p><p>Worldwide: https://manage.office.com</p><p>GCC: https://manage-gcc.office.com</p><p>GCC High: https://manage.office365.us</p><p>DoD: https://manage.protection.apps.mil</p><p>Endpoints:</p><p>Start Subscription: /api/v1.0/{tenantID}/activity/feed/subscriptions/start?contentType={type}</p><p>List Available Content: /api/v1.0/{tenantID}/activity/feed/subscriptions/content?contentType={type}</p><p>Fetch Content Blob: Dynamic URI returned from the “List Available Content” call.</p><p>Content Types: audit.exchange, audit.sharepoint, audit.general, audit.azureactivedirectory, dlp.all.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Office 365 DLP 8f052782739d4b8389644cca23b994ac msft_o365_dlp_raw <p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Office 365 domains cae29fd87b554bd9a5694afb225e8dc9 msft_o365_domains_raw Microsoft Graph API: GET /v1.0/domains
Office 365 Exchange Online dee8e85ce7db4573a8bc21b807e1d73a msft_o365_exchange_online_raw <p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Office 365 General c7655e83805b4a058e66043a6715156c msft_o365_general_raw <p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Office 365 Sharepoint Online 3a37f519e9094a3f8c4185fa572cd111 msft_o365_sharepoint_online_raw <p>See Office 365 Azure AD.</p><p>For set up details, see Ingest logs from Microsoft Office 365.</p>
Office 365 contacts (email) de1b694a6c8341958bc08c4b7c140874 msft_o365_contacts_raw <p>Microsoft Graph API: GET /v1.0/users/{id}/mailFolders/inbox/messageRules</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p>
Office 365 devices (email) de229685f708413fad46289657ea09de msft_o365_devices_raw <p>Microsoft Graph API: GET /v1.0/users/{id}/registeredDevices</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p>
Office 365 groups (email) 0b0499ac0d984145b201c6d674771dbf msft_o365_groups_raw <p>Microsoft Graph API: GET /v1.0/groups</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p>
Office 365 mailboxes (email) 9855a03559ce4263b568671e695d1fa8 msft_o365_mailboxes_raw <p>The Base URLs for the APIs are (depending on the environment): https://graph.microsoft.com</code> (or <code>https://graph.microsoft.us` for FedRAMP)</p><p>Incoming Messages: GET /v1.0/users/{id}/messages</p><p>Outgoing Messages: GET /v1.0/users/{id}/mailFolders/sentitems/messages/delta</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p>
Office 365 rules (email) 6b925df8923d4038bf78998d1ffde77c msft_o365_rules_raw <p>Microsoft Graph API: /users/{id}/mailFolders/inbox/messageRules</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p>
Office 365 users (email) dcfb7a412e654efd868de0b8cf81766a msft_o365_users_raw <p>Microsoft Graph API: GET /v1.0/users</p><p>For set up details, see Ingest logs and data from Microsoft 365.</p>
Windows Event Logs 63b0fbeb501e4650896e7064d3412e14 microsoft_windows_raw For more information, see Collect Windows Event Logs for Cortex XSIAM via Cribl.

Okta

Product UUID Datasets Collection Method
SSO 5faf4c1fdb8443d9920d6a54815432c1 okta_sso_raw <p>Okta System Log API</p><p>Base URL: https://{your-okta-domain}.okta.com</p><p>GET /api/v1/logs</p><p>For set up details, see Ingest logs and data from Okta.</p>

OneLogin

Product UUID Datasets Collection Method
Events 22b23a3f9f1e49998645b683d5dc3a6f onelogin_events_raw <p>Base URL: https://<subdomain>.onelogin.com</p><p>Endpoint: /api/1/events`</p><p>For set up details, see Ingest logs and data from OneLogin.</p>
OneLogin 88cfbd3e7b974d999b10edac83995b8a <ul><li>onelogin_users_raw</li><li>onelogin_groups_raw</li><li>onelogin_apps_raw</li></ul> <p>Base URL: https://<subdomain>.onelogin.com</p><p>Endpoints: /api/1/users/api/1/groups/api/2/apps</p><p>For set up details, see Ingest logs and data from OneLogin.</p>

PingID

Product UUID Datasets Collection Method
PingONE 924951a8394b4605b1725f943292ab4f pingid_pingone_raw <p>PingOne API:</p><p>Base URL: https://admin-api.pingone.com</p><p>Endpoint: /v3/reports/{account_id}/poll-subscriptions/{subscription_id}/events</p><p>For set up details, see Ingest authentication logs and data from PingOne.</p>

Proofpoint

Product UUID Datasets Collection Method
TAP 3eefce0f791e4391a3643b8cf860a361 proofpoint_tap_raw <p>API Base URL: https://tap-api-v2.proofpoint.com</p><p>Resource Path: /v2/siem/all</p><p>For set up details, see Ingest logs from Proofpoint Targeted Attack Protection.</p>

Salesforce: Salesforce logs

UUID Datasets Collection Method
ab109687acd24978aabcb7ad8b5742e3 <ul><li>salesforce_login_raw</li><li>salesforce_audit_raw</li><li>salesforce_eventlogfile_raw</li></ul> <p>The data schema for salesforce_eventlogfile_raw is dynamic and not hardcoded in the data collector's source code.</p><p>Here's how it works:</p><p>Dynamic Field Discovery: The collector calls the Salesforce describe endpoint (/services/data/v56.0/sobjects/EventLogFile/describe) to retrieve the list of all available fields for the EventLogFile object.</p><p>Query Construction: It constructs a SOQL query selecting all these discovered fields, such as SELECT Id, LogFile, LogDate,.... FROM EventLogFile).</p><p>CSV to JSON: The downloaded log files are in CSV format. The collector converts each CSV row into a JSON object where the keys are the CSV headers (which correspond to the fields discovered in the Dynamic Field Discovery explained above).</p><p>For set up details, see Ingest logs and data from Salesforce.</p>

Salesforce: Salesforce snapshots

UUID    
addbf31a6372491e88d45934dff5b5b0 <p>The data fetched by this data collector is written to datasets based on the Salesforce object being retrieved. The data collector dynamically sets the Product field in the response to the name of the Salesforce object. Assuming the standard naming convention <vendor>_<product>_raw (where Vendor is salesforce); the data will be written to the following datasets (corresponding to the objects defined in consts.go):</p><ul><li>salesforce_ConnectedApplication_raw</li><li>salesforce_PermissionSet_raw</li><li>salesforce_Profile_raw</li><li>salesforce_GroupMember_raw</li><li>salesforce_Group_raw</li><li>salesforce_User_raw</li><li>salesforce_UserRole_raw</li><li>salesforce_TenantSecurityLogin_raw</li><li>salesforce_UserAccountTeamMember_raw</li><li>salesforce_TenantSecurityUserPerm_raw</li></ul> <p>Authentication:</p><p>Path: /services/oauth2/token</p><p>Purpose: Used for obtaining and refreshing access tokens.</p><p>Data Query:</p><p>Path: /services/data/v56.0/queryAll</p><p>Purpose: Used to execute SOQL queries to fetch records for the snapshot objects, such as User, Profile, and Group.</p><p>Object Description:</p><p>Path: /services/data/v56.0/sobjects/{object}/describe</p><p>Purpose: Used to dynamically retrieve the list of fields for a specific object before querying it.</p><p>All endpoints are relative to the base URL: https://{domain}.my.salesforce.com.</p><p>For set up details, see Ingest logs and data from Salesforce.</p>

Sentinel One: Deep Visibility

UUID Datasets Collection Method
b9fa55e6fa564c709358425ce0f61517 sentinelone_deep_visibility_raw <p>For set up details, see Ingest raw EDR events from SentinelOne DeepVisibility.</p><p>To enable analytics, contact Customer Support.</p>

Service Now: CDMB

UUID Datasets Collection Method
8b3e767247e44471a95e563378d0b9be <p>servicenow_cmdb_</p><p><table name>_raw</p> <p>ServiceNow Table API</p><p>Base URL: https://{instance}.service-now.com</p><p>GET /api/now/table/{table_name}</p><p>For set up details, see Ingest data from ServiceNow CMDB.</p>

Workday

UUID Datasets Collection Method
00d4e740702d4eb2939a87c2318513dd workday_workday_raw <p>Workday Report-as-a-Service (RaaS)</p><p>Endpoint: Configurable Report URL</p><p>For set up details, see Ingest report data from Workday.</p>