Ongoing project: Due to its scope, this project is still being updated. Content on this page may change as work continues.
Planned Content
About 14 data connectors in total. Confirmed so far (the full list is pending):
Entra sign-in logs
Domain controller and critical server security logs (Azure Arc + AMA + DCRs)
Switch and firewall syslog, forwarded by a hardened Linux server
Mimecast
DNS
1Password
Cortex alerts via CEF/Syslog over TLS
SOAR built from automation rules and Logic Apps that, depending on the rule, handle incident assignment, ticket creation, email alerts, partial remediation, and enrichment
Analytic rules that alert on log-ingestion issues, which are often caused by patching