We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

MCP Tools Reference: chronicle.googleapis.com

Tool: `get_ioc_match`

Get Indicators of Compromise (IoCs) matches from Chronicle SIEM.

Retrieves IoCs (e.g., malicious IPs, domains, hashes) from configured threat intelligence feeds that have been observed matching events in Chronicle logs within the specified time window.

Agent Responsibilities:

Time Range Calculation: The agent should provide the start_time and end_time arguments as ISO 8601 formatted strings (e.g., YYYY-MM-DDTHH:MM:SSZ) to define the search window.
Response Parsing: The agent should parse the raw JSON response to extract details from the 'matches' list. Each item in the list represents an IoCDiscoveryInfo object.
Data Extraction: From each match, extract relevant fields like 'artifactIndicator', 'sources', 'firstSeenTimestamp', 'lastSeenTimestamp'.
Output Formatting: Format the extracted details into a human-readable summary.

Workflow Integration:

Use this to proactively identify potential threats based on IoC matches within SIEM data, potentially before specific detection rules trigger or cases are created in other systems.
Can provide early warning signs or context during investigations initiated from alerts or intelligence originating from any connected security tool (SIEM, EDR, TI platforms, etc.).
Complements rule-based alerts by showing matches against known bad indicators from threat intelligence feeds integrated with the SIEM.

Use Cases:

Monitor for recent sightings of known malicious indicators within SIEM logs.
Identify assets that may have interacted with known bad infrastructure or files, based on log evidence.
Supplement investigations by checking if involved entities match known IoCs curated by threat intelligence sources.

Next Steps (using MCP-enabled tools):

Investigate the assets or events associated with the matched IoCs using udm_search.
Use entity lookup tools to get broader context on the matched IoC value (IP, domain, hash).
Use SIEM event search tools to find the specific events in logs that triggered the IoC match.
Check if related cases exist in your case management/SOAR system or create one if the match indicates a significant threat.
Correlate IoC match details with findings from other security tools (EDR, Network, Cloud) via their MCP tools.

The following sample demonstrate how to use curl to invoke the get_ioc_match MCP tool.

Curl Request
curl --location 'https://chronicle.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "get_ioc_match", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }'

Curl Request

                  
curl --location 'https://chronicle.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "get_ioc_match",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for GetIocMatch.

GetIocMatchRequest

JSON representation
{ "projectId": string, "customerId": string, "region": string, "startTime": string, "endTime": string, "maxMatches": integer }

Fields
`projectId`	`string` Google Cloud project ID.
`customerId`	`string` Chronicle customer ID.
`region`	`string` Chronicle region (e.g., "us", "europe").
`startTime`	`string` The start of the time range in ISO 8601 format (e.g., YYYY-MM-DDTHH:MM:SSZ) to define the search window.
`endTime`	`string` The end of the time range in ISO 8601 format (e.g., YYYY-MM-DDTHH:MM:SSZ) to define the search window.
`maxMatches`	`integer` Maximum number of IoC matches to return. Defaults to 20.

Output Schema

Response containing matched IoCs

LegacySearchEnterpriseWideIoCsResponse

JSON representation
{ "matches": [ { object (`IoCDiscoveryInfo`) } ], "moreDataAvailable": boolean }

Fields

Fields
`matches[]`	`object (IoCDiscoveryInfo)` IoC Matches returned for the query.
`moreDataAvailable`	`boolean` Indicates that more data was available but not sent due to more hits than max_matches_to_return.

matches[]

object (IoCDiscoveryInfo)

IoC Matches returned for the query.

moreDataAvailable

boolean

Indicates that more data was available but not sent due to more hits than max_matches_to_return.

IoCDiscoveryInfo

JSON representation

JSON representation
{ "artifactIndicator": { object (`ArtifactIndicator`) }, "id": string, "fieldAndValue": { object (`FieldAndValue`) }, "sources": [ string ], "categories": [ string ], "confidenceScore": integer, "confidenceBucket": string, "assetIndicators": [ { object (`AssetIndicator`) } ], "emptyAssetListReasonCode": enum (`EmptyAssetListReasonCode`), "iocIngestTimestamp": string, "firstSeenTimestamp": string, "lastSeenTimestamp": string, "filterProperties": { object (`FilterProperties`) }, "rawSeverity": string, "iocState": enum (`IocState`), "priority": enum (`Priority`), "associationIdentifier": [ { object (`AssociationIdentity`) } ], "campaigns": [ string ], "globalSourceId": string, "logType": enum (`LogType`), "globalCustomerId": string, "confidenceScoreBucket": { object (`IntRange`) }, "ipAndPorts": { object (`IpAndPorts`) }, "categorization": string, "domainAndPorts": { object (`DomainAndPorts`) }, "activeTimerange": { object (`Interval`) }, "link": { object (`Link`) }, "feedName": string, "description": string, "threatCollectionItems": [ { object (`ThreatCollectionItem`) } ] }

{
  "artifactIndicator": {
    object (ArtifactIndicator)
  },
  "id": string,
  "fieldAndValue": {
    object (FieldAndValue)
  },
  "sources": [
    string
  ],
  "categories": [
    string
  ],
  "confidenceScore": integer,
  "confidenceBucket": string,
  "assetIndicators": [
    {
      object (AssetIndicator)
    }
  ],
  "emptyAssetListReasonCode": enum (EmptyAssetListReasonCode),
  "iocIngestTimestamp": string,
  "firstSeenTimestamp": string,
  "lastSeenTimestamp": string,
  "filterProperties": {
    object (FilterProperties)
  },
  "rawSeverity": string,
  "iocState": enum (IocState),
  "priority": enum (Priority),
  "associationIdentifier": [
    {
      object (AssociationIdentity)
    }
  ],
  "campaigns": [
    string
  ],
  "globalSourceId": string,
  "logType": enum (LogType),
  "globalCustomerId": string,
  "confidenceScoreBucket": {
    object (IntRange)
  },
  "ipAndPorts": {
    object (IpAndPorts)
  },
  "categorization": string,
  "domainAndPorts": {
    object (DomainAndPorts)
  },
  "activeTimerange": {
    object (Interval)
  },
  "link": {
    object (Link)
  },
  "feedName": string,
  "description": string,
  "threatCollectionItems": [
    {
      object (ThreatCollectionItem)
    }
  ]
}

Fields
`artifactIndicator`	`object (ArtifactIndicator)` Artifact that was found in the customer environment.
`id`	`string` Entity ID as a string for pivoting
`fieldAndValue`	`object (FieldAndValue)` Field path or type with value to identify entity.
`sources[]`	`string` IoC feed sources.
`categories[]`	`string` IoC threat categories.
`confidenceScore`	`integer` IoC confidence score. It is not a repeated field because it is used for V2 feeds, where sources and categories are restricted to a cardnality of 1 as well.
`confidenceBucket`	`string` IoC confidence score, bucketed into e.g. low/medium/high.
`assetIndicators[]`	`object (AssetIndicator)` We will limit the number of assets to the first N (e.g., N=20) found.
`emptyAssetListReasonCode`	`enum (EmptyAssetListReasonCode)` When asset_indicators is empty, this field should be set.
`iocIngestTimestamp`	`string (Timestamp format)` Timestamp when the IoC was first received from ANY feed. This is the earliest timestamp of receipt by Malachite, given that the artifact might have been sent in multiple feeds at different times. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`firstSeenTimestamp`	`string (Timestamp format)` Timestamp when the IoC was first seen in the enterprise. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`lastSeenTimestamp`	`string (Timestamp format)` Timestamp when the IoC was last seen in the enterprise. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`filterProperties`	`object (FilterProperties)` Properties of this match, used for filtering in the client.
`rawSeverity`	`string` The indicator's raw severity.
`iocState`	`enum (IocState)` The current state of IoC. default state is MATCHED.
`priority`	`enum (Priority)` The priority of the ioc match.
`associationIdentifier[]`	`object (AssociationIdentity)` Associated actors and malware.
`campaigns[]`	`string` List of campaigns this IoC was observed.
`globalSourceId`	`string` Global source ID this IoC is part of. This would only be populated if the indicator is coming from a global source.
`logType`	`enum (LogType)` The log type of the IoC source.
`globalCustomerId`	`string (bytes format)` Global source ID this IoC is part of. This would only be populated if the indicator is coming from a global source. A base64-encoded string.
`confidenceScoreBucket`	`object (IntRange)` Confidence score bucket
`ipAndPorts`	`object (IpAndPorts)` IP address indicator.
`categorization`	`string` The category/type of this indicator. Ex: "Spyware", "Bitcoin_Related", etc.
`domainAndPorts`	`object (DomainAndPorts)` Domain indicator.
`activeTimerange`	`object (Interval)` The time range in which this indicator has been "active". The start or end time (or both) may be empty, indicating an open-ended time interval.
`link`	`object (Link)` optional. This will usually be a link to the Feed's definition.
`feedName`	`string` Original feed this indicator originated from.
`description`	`string` Raw description of the IoC.
`threatCollectionItems[]`	`object (ThreatCollectionItem)` Reference to the threat collection items linked to this IOC match.

ArtifactIndicator

JSON representation

JSON representation
{ // Union field `artifact` can be only one of the following: "domain": string, "destinationIpAddress": string, "hashMd5": string, "hashSha1": string, "hashSha256": string // End of list of possible types for union field `artifact`. }

{

  // Union field artifact can be only one of the following:
  "domain": string,
  "destinationIpAddress": string,
  "hashMd5": string,
  "hashSha1": string,
  "hashSha256": string
  // End of list of possible types for union field artifact.
}

Fields
Union field `artifact`. An artifact. `artifact` can be only one of the following:
`domain`	`string` A domain name.
`destinationIpAddress`	`string` A destination ip address.
`hashMd5`	`string` A MD5 file hash.
`hashSha1`	`string` A SHA1 file hash.
`hashSha256`	`string` A SHA256 file hash.

FieldAndValue

JSON representation

JSON representation
{ "value": string, "entityNamespace": string, // Union field `type` can be only one of the following: "fieldPath": string, "valueType": enum (`ValueType`) // End of list of possible types for union field `type`. }

{
  "value": string,
  "entityNamespace": string,

  // Union field type can be only one of the following:
  "fieldPath": string,
  "valueType": enum (ValueType)
  // End of list of possible types for union field type.
}

Fields
`value`	`string` Required. Indicator value that is used to identify or find the entity.
`entityNamespace`	`string` Optional. Entity namespace. Namespace is only applicable to asset entities.
Union field `type`. The type of the indicator used to identify or find the entity. `type` can be only one of the following:
`fieldPath`	`string` A UDM field path which identifies the type of the indicator to be used to find the entity. This path is not used exclusively to "search" for the entity, but rather to identify the type of indicator, which can be inferred from the path.
`valueType`	`enum (ValueType)` An explicit type of the indicator to be used to find the entity.

AssetIndicator

JSON representation

JSON representation
{ "namespace": string, "isAnyNamespace": boolean, "filterNamespace": boolean, // Union field `indicator` can be only one of the following: "hostname": string, "assetIpAddress": string, "mac": string, "productId": string // End of list of possible types for union field `indicator`. }

{
  "namespace": string,
  "isAnyNamespace": boolean,
  "filterNamespace": boolean,

  // Union field indicator can be only one of the following:
  "hostname": string,
  "assetIpAddress": string,
  "mac": string,
  "productId": string
  // End of list of possible types for union field indicator.
}

Fields
`namespace`	`string` The namespace of this asset indicator belongs to. If 'is_any_namespace' is set to true, this field will be ignored.
`isAnyNamespace`	`boolean` False when 'namespace' refers to a valid namespace name related to the asset (both empty and non empty strings are valid namespace name values). True when the asset refers to one or more assets with the given 'indicator' across all namespaces.
`filterNamespace`	`boolean` This field provides clients the option to enable namespace search or not. By default, this field is false and namespace will be ignored.
Union field `indicator`. An identifier representing an asset. `indicator` can be only one of the following:
`hostname`	`string` Hostname of a device or machine.
`assetIpAddress`	`string` IP address of a device or machine.
`mac`	`string` Mac address of a device or machine.
`productId`	`string` The 'product_id' field includes a a product ID type and product ID value, e.g. "CS:1234-5678".

Timestamp

JSON representation
{ "seconds": string, "nanos": integer }

Fields

Fields
`seconds`	`string (int64 format)` Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
`nanos`	`integer` Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).

nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

FilterProperties

JSON representation
{ "stringProperties": { string: { object (`StringValues`) }, ... }, "hidden": boolean }

Fields

Fields
`stringProperties`	`map (key: string, value: object (StringValues))` An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
`hidden`	`boolean`

stringProperties

map (key: string, value: object (StringValues))

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

hidden

boolean

StringPropertiesEntry

JSON representation
{ "key": string, "value": { object (`StringValues`) } }

Fields
`key`	`string`
`value`	`object (StringValues)`

StringValues

JSON representation
{ "values": [ { object (`StringValue`) } ] }

Fields
`values[]`	`object (StringValue)`

StringValue

JSON representation
{ "rawValue": string, "displayValue": string }

Fields
`rawValue`	`string`
`displayValue`	`string`

AssociationIdentity

JSON representation
{ "name": string, "regionCode": { object (`Location`) }, "associationType": enum (`AssociationType`), "associationId": string }

Fields
`name`	`string`
`regionCode`	`object (Location)`
`associationType`	`enum (AssociationType)`
`associationId`	`string`

Location

JSON representation

JSON representation
{ "city": string, "state": string, "countryOrRegion": string, "name": string, "deskName": string, "floorName": string, "regionLatitude": number, "regionLongitude": number, "regionCoordinates": { object (`LatLng`) } }

{
  "city": string,
  "state": string,
  "countryOrRegion": string,
  "name": string,
  "deskName": string,
  "floorName": string,
  "regionLatitude": number,
  "regionLongitude": number,
  "regionCoordinates": {
    object (LatLng)
  }
}

Fields
`city`	`string` The city.
`state`	`string` The state.
`countryOrRegion`	`string` The country or region.
`name`	`string` Custom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
`deskName`	`string` Desk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
`floorName`	`string` Floor name, number or a combination of the two for a building. (e.g. "1-A").
`regionLatitude (deprecated)`	`number` This item is deprecated! Deprecated: use region_coordinates.
`regionLongitude (deprecated)`	`number` This item is deprecated! Deprecated: use region_coordinates.
`regionCoordinates`	`object (LatLng)` Coordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.

LatLng

JSON representation
{ "latitude": number, "longitude": number }

Fields

Fields
`latitude`	`number` The latitude in degrees. It must be in the range [-90.0, +90.0].
`longitude`	`number` The longitude in degrees. It must be in the range [-180.0, +180.0].

latitude

number

The latitude in degrees. It must be in the range [-90.0, +90.0].

longitude

number

The longitude in degrees. It must be in the range [-180.0, +180.0].

IntRange

JSON representation
{ "rangeStart": integer, "rangeEnd": integer }

Fields
`rangeStart`	`integer`
`rangeEnd`	`integer`

IpAndPorts

JSON representation
{ "ipAddress": string, "ports": [ integer ] }

Fields

Fields
`ipAddress`	`string (bytes format)` A base64-encoded string.
`ports[]`	`integer (uint32 format)`

ipAddress

string (bytes format)

A base64-encoded string.

ports[]

integer (uint32 format)

DomainAndPorts

JSON representation
{ "domain": string, "ports": [ integer ] }

Fields
`domain`	`string`
`ports[]`	`integer (uint32 format)`

Interval

JSON representation
{ "startTime": string, "endTime": string }

Fields

Fields
`startTime`	`string (Timestamp format)` Optional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
`endTime`	`string (Timestamp format)` Optional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.

startTime

string (Timestamp format)

Optional. Inclusive start of the interval.

If specified, a Timestamp matching this interval will have to be the same or after the start.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

endTime

string (Timestamp format)

Optional. Exclusive end of the interval.

If specified, a Timestamp matching this interval will have to be before the end.

Link

JSON representation
{ "text": string, "url": string }

Fields
`text`	`string`
`url`	`string`

ThreatCollectionItem

JSON representation
{ "id": string, "type": enum (`ThreatCollectionType`), "altNames": [ string ] }

Fields

Fields
`id`	`string` The ID of the threat collection.
`type`	`enum (ThreatCollectionType)` The type of threat collection, for example, "campaign".
`altNames[]`	`string` The name of the threat collection.

id

string

The ID of the threat collection.

type

enum (ThreatCollectionType)

The type of threat collection, for example, "campaign".

altNames[]

string

The name of the threat collection.

ValueType

Value type of the entity.

Enums
`VALUE_TYPE_UNSPECIFIED`	Unspecified.
`ASSET_IP_ADDRESS`	Asset ip address.
`MAC`	Asset mac address.
`HOSTNAME`	Asset hostname.
`PRODUCT_SPECIFIC_ID`	Asset product id. Product specific ID for EDR/HIDS/AV products, etc.
`DOMAIN_NAME`	Domain name.
`RESOLVED_IP_ADDRESS`	Resolved ip address.
`PROCESS_ID`	EDR process id.
`FULL_COMMAND_LINE`	File full command line.
`FILE_NAME`	File name.
`FILE_PATH`	File path.
`HASH_MD5`	Hash md5.
`HASH_SHA256`	Hash sha256.
`HASH_SHA1`	Hash sha1.
`RAW_PID`	Operating system process id.
`PARENT_PROCESS_ID`	Process id for the parent that spawned a process.
`EMAIL`	User email.
`USERNAME`	User username.
`WINDOWS_SID`	User windows sid.
`EMPLOYEE_ID`	User employee id.
`PRODUCT_OBJECT_ID`	User product object id. Product specific object ID for LDAP-like systems.
`CLOUD_RESOURCE_NAME`	Cloud resource name.
`RESOURCE_PRODUCT_OBJECT_ID`	Resource product object id.

EmptyAssetListReasonCode

Enums
`UNSPECIFIED_CODE`
`CONTAIN_HIGH_VOLUME_ASSETS_ONLY`
`CALCULATION_TIME_OUT`

IocState

Enums
`IOC_STATE_UNSPECIFIED`
`STATUS_MATCHED`
`STATUS_REVIEWED`
`STATUS_MUTED`

Priority

Enums
`PRIORITY_UNSPECIFIED`
`LOW`
`MEDIUM`
`HIGH`
`ACTIVE_BREACH`

AssociationType

Represents different possible Association types. Can be threat or malware. Used to represent Mandiant threat intelligence.

Enums
`ASSOCIATION_TYPE_UNSPECIFIED`	The default Association Type.
`THREAT_ACTOR`	Association type Threat actor.
`MALWARE`	Association type Malware.
`SOFTWARE_TOOLKIT`	Association type Software toolkit.

LogType

Enums
`UNSPECIFIED_LOG_TYPE`
`ALL_TYPES`
`CATCH_ALL`
`DUMMY_LOGTYPE`
`UNLABELED_DHCP`
`AKAMAI_DHCP`
`ASSET_STATIC_IP`
`BRO_DHCP`
`CISCO_DHCP`
`EXTRAHOP_DHCP`
`FORTINET_DHCP`
`INFINICO_NETWYVERN`
`INFOBLOX_DHCP`
`ISC_DHCP`
`KEA_DHCP`
`LINUX_DHCP`
`PCAP_DHCP`
`SOPHOS_DHCP`
`WINDOWS_DHCP`
`MTSBS_WINDOWS_DHCP_MMC`
`MTSBS_WINDOWS_DHCP_ATC`
`MTSBS_WINDOWS_DHCP_MMTH`
`MTSBS_WINDOWS_DHCP_MMPC`
`MTSBS_WINDOWS_DHCP_MMKI`
`UNLABELED_DNS`
`AKAMAI_DNS`
`AWS_ROUTE_53`
`AZURE_DNS`
`BIND_DNS`
`BLOXONE`
`BLOXONE_DHCP`
`BLUECAT_AM`
`BLUECAT_EDGE`
`IBM_NS1`
`IBM_PA`
`IBM_COGNOS`
`ZOOMINFO`
`IRONCLAD`
`SCALEFUSION`
`BRO_DNS`
`CLOUDFLARE_DNS_FIREWALL_LOGS`
`CISCO_DNS`
`CUSTOM_DNS`
`CLOUDFLARE_DNS_LOGS`
`DNS_SINKHOLE`
`EXTRAHOP_DNS`
`F5_DNS`
`GODADDY_DNS`
`INFOBLOX_DNS`
`INFOBLOX_RPZ`
`MENANDMICE_DNS`
`MTSBS_WINDOWS_DNS_MMC`
`MTSBS_WINDOWS_DNS_ATC`
`MTSBS_WINDOWS_DNS_MMTH`
`MTSBS_WINDOWS_DNS_MMPC`
`MTSBS_WINDOWS_DNS_MMKI`
`PAN_DNS_SECURITY`
`PASSIVE_DNS`
`PCAP_DNS`
`POWER_DNS`
`SPLUNK_DNS`
`TCPWAVE_DDI`
`TECHNITIUM_DNS`
`ULTRADNS`
`UMBRELLA_DNS`
`UNBOUND_DNS`
`WFR_IBM_NS1`
`WINDOWS_DNS`
`WINDOWS_DNS_XML`
`ZSCALER_DNS`
`BLUECAT_DDI`
`EFFICIENTIP_DDI`
`AKAMAI_ETP`
`ANZENNA`
`UNLABELED_WEBPROXY`
`BLUECOAT_WEBPROXY`
`CLOUDFLARE_GATEWAY_NETWORK`
`CITRIX_NETSCALER_WEB_LOGS`
`CITRIX_WEB_GATEWAY`
`DIGITALARTS_IFILTER`
`DOPE_SWG`
`EZPROXY`
`E2_GUARDIAN`
`FORCEPOINT_WEBPROXY`
`FORCEPOINT_SWG`
`FORTINET_WEBPROXY`
`GCP_SWP`
`GCP_SECURITYCENTER_SENSITIVE_DATA_RISK`
`GRAVITEE`
`OCI_FIREWALL`
`OCI_APIGATEWAY`
`OCI_WAF`
`SANGFOR_NDR`
`IBOSS_WEBPROXY`
`INTERNAL_WEBPROXY`
`MCAFEE_WEBPROXY`
`MENLO_SECURITY`
`MIMECAST_WEBPROXY`
`NETSKOPE_WEBPROXY`
`NETSKOPE_SDWAN`
`MINSAIT_SIGEFI`
`OPS_GENIE`
`PINGDOM`
`POMERIUM`
`SQUID_WEBPROXY`
`SYMANTEC_WSS`
`TRENDMICRO_WEBPROXY`
`TRENDMICRO_WEBPROXY_DSM`
`TRENDMICRO_CLOUD_EMAIL_GATEWAY_PROTECTION`
`SHIPT_MERRY_MAKER`
`CONTRAST_SECURITY`
`ITENTIAL_PRONGHORN`
`CHOPIN_PPS`
`FRONT`
`DBDEV_ZOOM_ACTIVITY_LOGS`
`UMBRELLA_WEBPROXY`
`VUHL_SO_IDH`
`AWS_LAMBDA_FUNCTION`
`MASMOVIL_GENERIC_CSV_1`
`MASMOVIL_GENERIC_JSON_1`
`MASMOVIL_GENERIC_SYSLOG_1`
`MASMOVIL_GENERIC_KV_1`
`MASMOVIL_GENERIC_XML_1`
`MASMOVIL_GENERIC_SYSLOGKV_1`
`MASMOVIL_GENERIC_SYSLOGJSON_1`
`MASMOVIL_GENERIC_SYSLOGXML_1`
`MASMOVIL_GENERIC_LEEF_1`
`MASMOVIL_GENERIC_CEF_1`
`WEBMARSHAL`
`ZSCALER_WEBPROXY`
`SECUI_BLUEMAX_NGF`
`ZAFRAN`
`SYMANTEC_ATP`
`MACMON`
`AZURE_CONTAINER_REGISTRY`
`APPSENTINELS`
`UNLABELED_ALERT`
`PALANTIR`
`AI_HUNTER`
`AIDE`
`ASOC_ALERT`
`CIS_ALBERT_ALERT`
`CISCO_XDR`
`CMMRZ_ARCSIGHT_ESM_EVENTS`
`CS_ALERTS`
`CS_DETECTS`
`CT_GAUS_SEGUROS`
`CYDERES_INSIDER`
`CYJAX_THREAT_INTELLIGENCE`
`DATAMINR_ALERT`
`DOPPEL`
`DOCUSIGN`
`DTEX_AUDIT`
`FAIL2BAN`
`FORCEPOINT_FIT`
`GOOGLE_ADS`
`LV_GRAPHQL`
`MANAGE_ENGINE_LOG360`
`META_MARKETING`
`MODSECURITY`
`MEND_IO`
`NETSCOUT_OCI`
`OX_SECURITY`
`OPENTEXT_EXSTREAM`
`OPENTEXT_SSPR`
`PAGELY`
`PAN_TELEMETRY`
`PUSH_SECURITY`
`QUEST_CA_AUDIT`
`QUEST_CHANGE_AUDITOR_EMC`
`QUEST_FILE_AUDIT`
`SAP_ERP`
`SAP_HANA_AUDIT`
`SAP_GATEWAY`
`SAP_CHANGE_DOCUMENT`
`SAP_SECURITY_AUDIT`
`SERPICO`
`SEM_F5_BIGIP_LAN`
`SMARTSHEET`
`SMARTSHEET_USER_CONTEXT`
`SNAPATTACK`
`TRENDMICRO_APEX_ONE`
`TRENDMICRO_APEX_CENTRAL`
`TRENDMICRO_CLOUDONE`
`TRENDMICRO_SERVER_PROTECT`
`TRENDMICRO_VISION_ONE_RISK_EVENT`
`VRLNS_VORLON`
`ZSCALER_NSS_FEEDS`
`CS_STREAM`
`AZURE_ORG_CONTEXT`
`CUSTOMER_ALERT`
`SENTINELONE_ALERT`
`CYDERES_TEST_EVENT`
`CYLANCE_PROTECT`
`FIREEYE_ALERT`
`IBM_ZSECURE_ALERT`
`INTERNAL_ALERT`
`MICROSOFT_GRAPH_ALERT`
`ELO`
`DATEV`
`MICROSOFT_SECURITY_ALERTS`
`MICROSOFT_SECURITY_CENTER_ALERT`
`MICROSOFT_ENTRA_ID_PROTECTION`
`NETSKOPE_ALERT`
`NETSKOPE_ALERT_V2`
`OPSWAT_KIOSK`
`OPSWAT_METADEFENDER`
`PAN_ALERT`
`PAN_PRISMA_CA`
`PHISHEYE_ALERT`
`RULE_GENERATED_ALERT`
`STREAMALERT`
`TERAMIND`
`UNLABELED_EDR`
`CB_APP_CONTROL`
`CB_EDR`
`CHECKPOINT_EDR`
`CS_EDR`
`CS_CEF_EDR`
`CUSTOM_HOST_FORENSICS`
`CYBEREASON_EDR`
`DIGITALGUARDIAN_EDR`
`DEEP_INSTINCT_EDR`
`ECAR`
`ECAR_BRO`
`EIQ_EDR`
`ELASTIC_EDR`
`ENDGAME_EDR`
`ESET_EDR`
`FIDELIS_ENDPOINT`
`FORTINET_FORTIEDR`
`HARFANGLAB_EDR`
`ORACLE_CPQ`
`LIN_OTP`
`NETSCOUT_TMS`
`JAMF_PROTECT`
`JAMF_PROTECT_V2`
`LIMACHARLIE_EDR`
`LINUX_SYSMON`
`MALWAREBYTES_EDR`
`MANAGEENGINE_ENDPOINT`
`MICROSOFT_DEFENDER_ENDPOINT`
`MICROSOFT_DEFENDER_XDR`
`OSQUERY_EDR`
`MCAFEE_EDR`
`PAN_EDR`
`PAN_CORTEX_XDR_EVENTS`
`PAN_CORTEX_XDR_IIS`
`PASCO_CUSTOM_CR_PE`
`OOMNITZA`
`PASCO_CUSTOM_CR_PR`
`PASCO_CUSTOM_CR_ST`
`PASCO_CUSTOM_CR_SV`
`RAPID7_INSIGHT`
`REDCANARY_EDR`
`SENTINEL_DV`
`SENTINEL_EDR`
`SENTINELONE_CF`
`SENTINELONE_APPLICATION`
`SOPHOS_CAPSULE8`
`SOPHOS_EDR`
`SYMANTEC_DCS`
`SYMANTEC_EDR`
`SYSDIG`
`TEAMT5_THREATSONAR_EDR`
`TRENDMICRO_EDR`
`TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES`
`TEHTRIS_EDR`
`PLUMFINTECH_PLUM_BACKOFFICE`
`GCLDW_CLODWAVE_HIDS`
`UPTYCS_EDR`
`UPSTREAM_VSOC_ALERTS`
`WATCHGUARD_EDR`
`WHITECLOUD_EDR`
`WINDOWS_SYSMON`
`WINEVTLOG`
`WITHSECURE_CLOUD`
`WITHSECURE_ELEMENTS`
`VMRAY_FLOG_XML`
`ZSCALER_DIGITAL_EXPERIENCE`
`ARISTA_NDR`
`AWAKE_NDR`
`UNLABELED_NDR`
`ARBOR_EDGE_DEFENSE`
`ARBOR_SIGHTLINE`
`BRICATA_NDR`
`CATO_NETWORKS`
`CORELIGHT`
`CORTEX_XDR`
`CORTEX_XPANSE`
`CYNERIO_NDR_H`
`DARKTRACE`
`EXTRAHOP`
`WM_EXTRAHOP_ALERTS`
`FIDELIS_NETWORK`
`FIREEYE_NX`
`FIREEYE_NX_AUDIT`
`FORCEPOINT_MAIL_RELAY`
`GIGAMON`
`LINKSHADOW_NDR`
`MICROSOFT_RISK_DETECTIONS`
`NETSURION_PROTECTWISE`
`NTOPNG`
`PLIXER_SCRUTINIZER`
`VECTRA_DETECT`
`VECTRA_STREAM`
`VERIZON_NDR`
`GATEWATCHER_NDR`
`EXEON_NDR`
`XDRNET_DIGITALTWIN`
`UNLABELED_VPN`
`ACCOPS_HYSECURE_VPN`
`ARRAYNETWORKS_VPN`
`AWS_VPN`
`AZURE_VPN`
`CISCO_VPN`
`F5_VPN`
`FORTINET_FORTICLIENT`
`H3C_ROUTER`
`JUNIPER_VPN`
`MICROSOFT_SSTP`
`NORD_LAYER`
`NETMOTION`
`N8N_SECURITY_AUDIT_LOGS`
`JUMPSERVER_PAM`
`ALIBABA_SECURITY_CENTER`
`IBM_STORWIZE`
`VERSA_DIRECTOR`
`ORACLE_KEY_VAULT_AUDIT_LOGS`
`ACTION1`
`OPEN_VPN`
`PAN_GLOBAL_PROTECT`
`PAN_GPSVC`
`PERIMETER_81`
`PROOFPOINT_META`
`PULSE_SECURE_VPN`
`SAIWALL_VPN`
`STRONGSWAN_VPN`
`TWINGATE`
`WIREGUARD_VPN`
`ZSCALER_VPN`
`UNLABELED_FIREWALL`
`AMD_DSS_FIREWALL`
`AZION`
`AZURE_FIREWALL`
`BARRACUDA_FIREWALL`
`BARRACUDA_CLOUDGEN_FIREWALL`
`CLAVISTER_FIREWALL`
`CHECKPOINT_FIREWALL`
`CHECKPOINT_SMARTDEFENSE`
`CHECKPOINT_AUDIT`
`CISCO_ASA_FIREWALL`
`CISCO_FWSM`
`CISCO_FIREPOWER_FIREWALL`
`CLOUDFLARE_FIREWALL_EVENTS`
`SIGNIFY_CISCO_SECURE_FIREWALL_THREAT_DEFENSE`
`CISCO_PIX_FIREWALL`
`DRAYTEK`
`EMERSON_FIREWALL`
`EVIDOS_FIREWALL`
`FIREMON_FIREWALL`
`FORTINET_FIREWALL`
`FORCEPOINT_FIREWALL`
`F5_AFM`
`GONG`
`JUNIPER_FIREWALL`
`KERIOCONTROL`
`NETFILTER_IPTABLES`
`NETGATE_FIREWALL`
`OPNSENSE`
`OPSRAMP`
`PAN_FIREWALL`
`PEPLINK_FW`
`PEOPLE_STRONG`
`PAN_FIREWALL_CEF`
`RADWARE_FIREWALL`
`SANGFOR_NGAF`
`SKYBOX_FIREWALL_ASSURANCE`
`SILVERPEAK_FIREWALL`
`SONIC_FIREWALL`
`SPRINKLEDATA_DWH`
`SOPHOS_FIREWALL`
`SOPHOS_UTM`
`SOPHOS_URL`
`STORMSHIELD_FIREWALL`
`TUFIN`
`UBIQUITI_FIREWALL`
`ULTRA_CYBERFENCE`
`UMBRELLA_FIREWALL`
`UMBRELLA_IP`
`VERCEL_WAF`
`VELO_FIREWALL`
`VERSA_FIREWALL`
`WINDOWS_FIREWALL`
`WPENGINE`
`WINDOWS_WFP`
`XIRRUS`
`ZSCALER_FIREWALL`
`AKAMAI_DDOS`
`ALICLOUD_ANTI_DDOS`
`ALICLOUD_APSARADB`
`ALICLOUD_FIREWALL`
`PAN_PRISMA_ACCESS`
`MS_ENTRA_RECOMMENDATIONS`
`LUMEN_DDOS_HYPER`
`MCAFEE_NSP`
`NEUSTAR_SITEPROTECT`
`RADWARE_DDOS`
`UPX_ANTIDDOS`
`VERCARA`
`AKAMAI_WAF`
`ALICLOUD_WAF`
`ARRAY_NETWORKS_WAF`
`AWS_WAF`
`AZURE_WAF`
`BARRACUDA_WAF`
`BARRACUDA_WEBFILTER`
`CITRIX_WAF`
`CLOUDFLARE_ACCESS`
`CLOUDFLARE_WAF`
`CONDUCTOR_ONE`
`FORTINET_FORTIAPPSEC`
`CUSTOM_APPLICATION_ACCESS`
`CORVILNET_ENGINE`
`REN_ISAC`
`CISCO_SECURE_ACCESS_FLOW`
`EDGIO_CDN`
`EDGIO_RL`
`EDGIO_WAF`
`EXTREME_MANAGEMENT`
`F5_ASM`
`F5_BIGIP_APM`
`FASTLY_CDN`
`FASTLY_WAF`
`FORTINET_AP`
`FORTINET_FORTIWEB`
`GRAFANA`
`IBM_SAM`
`IBM_SIM`
`IMPERVA_ATTACK_ANALYTICS`
`IMPERVA_CEF`
`IMPERVA_FLEXPROTECT`
`IMPERVA_SECURESPHERE`
`IMPERVA_WAF`
`IMPERVA_CLOUD_WAF`
`IMPERVA_NETWORK_SECURITY`
`IMPERVA_DNS`
`IMPERVA_CSP`
`IMPERVA_ATO`
`IBM_VDP`
`FLARE_DARKWEB_ALERTS`
`PRS722_SUCURI_LOG`
`SIGNAL_SCIENCES_WAF`
`THREATX_WAF`
`UBIKA_WAAP`
`UBIKA_WAF`
`VMWARE_AVINETWORKS_IWAF`
`ASTRIX`
`ATLASSIAN_BEACON`
`ATTACK_IQ`
`ARXAN_THREAT_ANALYTICS`
`ARMIS_VULNERABILITIES`
`BITWARDEN_EVENTS`
`BITSIGHT`
`BROADCOM_CEM`
`BROADCOM_EDGE_SWG`
`BROADCOM_SUPPORT_PORTAL`
`BROADCOM_DX_NETOPS_SPECTRUM`
`BRITIVE_AUDIT_API`
`BURPSUITE`
`CISCO_SECURE_MALWARE_ANALYTICS`
`CLOUDPASSAGE_SVM`
`CROWDSTRIKE_SPOTLIGHT`
`ARISTA_CORVILNET`
`CYBERCNS`
`DELINEA_PBA`
`DIVVY_CLOUD`
`DLB_NETWRIX`
`DOMAINTOOLS_THREATINTEL`
`DSP_AUDIT`
`EGNYTE`
`ERMES`
`FARSIGHT_DNSDB`
`FEATURESPACE_ARIC`
`FORTINET_FORTIDECEPTOR`
`LUMETA`
`MICROSOFT_EASM`
`FINGERPRINT_JS`
`FIREEYE_HELIX`
`FRONTLINE_VM`
`GOANYWHERE_MFT`
`HASHICORP_NOMAD`
`H2_BAS`
`INTEL471_MALWARE_INTEL`
`INTRUDER_IO`
`MICROSOFT_GRAPH_RISKY_USERS`
`MICROSOFT_SECURITY_ACTIONS`
`NESSUS`
`NIST_NVD`
`NEOSEC`
`OPENVAS`
`PENTERA`
`PENTERA_ASV`
`PENTERA_LEEF`
`PHISHLABS`
`PROOFPOINT_IDENTITY_THREAT_PLATFORM`
`QUALYS_ACTIVITY`
`QUALYS_ASSET_CONTEXT`
`QUALYS_CONTINUOUS_MONITORING`
`QUALYS_FIM`
`QUALYS_SCAN`
`QUALYS_VM`
`RAPID7_NEXPOSE`
`RELIAQUEST`
`REDHAT_SATELLITE`
`REDHAT_STACKROX`
`RISKIQ_DIGITAL_FOOTPRINT`
`RISK_RESECURITY`
`INFISICAL`
`GTI_IOC`
`SOLARWINDS_NPM`
`STACKHAWK`
`SNYK_ISSUES`
`SAP_SM20`
`SECURITY_BRIDGE`
`SECURITYBRIDGE_DEV`
`SNYK_SDLC`
`SONARQUBE`
`SONRAI`
`SPLUNK_ATTACK_ANALYZER`
`SPIRION`
`SCHWAB_DBSECOPS`
`SKYSEA`
`SPAMHAUS`
`STELLAR_CYBER`
`SUBLIMESECURITY`
`SYXSENSE`
`SYMANTEC_SA`
`TENABLE_OT`
`TENABLE_IO`
`TENABLE_SC`
`TENABLE_WAS`
`TENABLE_VMGNT`
`TRUEFORT`
`UPGUARD`
`URLSCAN_IO`
`VECTOR_DEV`
`VECTRA_PROTECT`
`VIRUSTOTAL_THREAT_HUNTER`
`VIRSEC_EVENT`
`VIRSEC_THREAT`
`VICARIUS_VRX_EVENTS`
`WIZ_AUDIT`
`WIZ_IO`
`XM_CYBER`
`ZSCALER_NSS_VM`
`CYBLE_ASM`
`CYBLE_BIP`
`AXIS_ATMOS`
`CHRONICLE_FEED`
`SANGFOR_IAG`
`ZSCALER_TUNNEL`
`ZSCALER_ZPA`
`ZSCALER_INTERNET_ACCESS`
`ZSCALER_ZPA_AUDIT`
`CLOUDFLARE_CASB_FINDINGS`
`CISCO_CLOUDLOCK_CASB`
`CENSORNET_CASB`
`DUO_CASB`
`FORCEPOINT_CASB`
`MCAFEE_MVISION_CASB`
`MCAFEE_SKYHIGH_CASB`
`MICROSOFT_CASB`
`MICROSOFT_CASB_CONTEXT`
`MICROSOFT_DEFENDER_CLOUD_APPS`
`NETSKOPE_CASB`
`NETSKOPE_CLIENT`
`NETSKOPE_LOG_STREAMING`
`PAN_CASB`
`PAN_PRISMA_CLOUD`
`PROOFPOINT_CASB`
`SYMANTEC_CASB`
`ZSCALER_CASB`
`ATTIVO`
`CANARY_AUDIT_TRAIL`
`CCFOUNDATION_RESPOTTER`
`GUARDICORE_CENTRA`
`HONEYD`
`THINKST_CANARY`
`APEREO_CAS`
`UNLABELED_SSO`
`CA_SSO_WEB`
`CENTRIFY_SSO`
`CITRIX_WORKSPACE`
`CYBERARK_SSO`
`CYBERARK_IDENTITY_AUDIT`
`STERLING_OMS_DATA`
`BLINKOPS`
`UNIFI_SYSTEM`
`PLEASANT_PASSWORD_SERVER`
`ZENDESK_ADPP`
`MICROSOFT_DOTNET`
`ONELOGIN_SSO`
`ONELOGIN_USER_CONTEXT`
`ORACLE_SSO_AUDIT`
`SECUREAUTH_SSO`
`SITEMINDER_SSO`
`SYMANTEC_VIP_AUTHHUB`
`AGARI_PHISHING_DEFENSE`
`ABNORMAL_SECURITY`
`AMAVIS`
`APACHE_SPAMASSASSIN`
`AREA1`
`ARMORBLOX_ESC`
`AVANAN_EMAIL`
`BARRACUDA_EMAIL`
`BARRACUDA_IMPERSONATION`
`RANCHER_API_AUDIT_LOG`
`CANVAS_LMS`
`CISCO_STAR_OS`
`PERPLEXITY`
`CYCOGNITO_ASM`
`PROMPT_SECURITY`
`CHECKPOINT_EMAIL`
`CISCO_EMAIL_SECURITY`
`CISCO_SECURE_EMAIL_THREAT_DEFENSE`
`CISCO_IRONPORT`
`COFENSE_TRIAGE`
`COFENSE_VISION`
`CLOUDFLARE_EMAIL_SECURITY_ALERTS`
`EXCHANGE_MAIL`
`FIREEYE_EMPS`
`FIREEYE_ETP`
`FORTINET_FORTIMAIL`
`FORCEPOINT_EMAILSECURITY`
`GMAIL_LOGS`
`GREATHORN`
`IRONSCALES`
`HORNET_SECURITY`
`INKY`
`KNOWBE4`
`KNOWBE4_PHISHER`
`LIBRAESVA_EMAIL`
`PROOFPOINT_ADAPTIVE_EMAIL_SECURITY`
`MAILMARSHAL`
`MAILSCANNER`
`MATERIAL_SECURITY`
`MICROSOFT_DEFENDER_MAIL`
`MIMECAST_ATTACHMENT_LOGS`
`MIMECAST_AUDIT_LOGS`
`LEAPXPERT_AUDIT`
`MIMECAST_IMPERSONATION_LOGS`
`MIMECAST_MAIL`
`MIMECAST_URL_LOGS`
`MIMECAST_MAIL_V2`
`POSTFIX_MAIL`
`PROOFPOINT_MAIL_FILTER`
`PROOFPOINT_ON_DEMAND`
`PROOFPOINT_MAIL`
`PSCSH_PROOFPOINT_SYSLOG_REMOTE`
`PROOFPOINT_SECURE_SHARE`
`PROOFPOINT_SECURITY_AWARENESS_TRAINING`
`PROOFPOINT_SENDMAIL_SENTRION`
`PROOFPOINT_SER`
`PROOFPOINT_EMAIL_PROTECTION`
`PROOFPOINT_TAP`
`PROOFPOINT_TRAP`
`PROOFPOINT_WEB_BROWSER_ISOLATION`
`SENDGRID`
`SENDMAIL`
`SEPPMAIL`
`SOPHOS_EMAIL`
`SYMANTEC_MAIL`
`SYMANTEC_VIP`
`TESSIAN_PLATFORM`
`TRENDMICRO_CLOUDAPPSECURITY`
`TRENDMICRO_EMAIL_SECURITY`
`VALIMAIL`
`VIRTRU_EMAIL_ENCRYPTION`
`VOLTAGE`
`WALLARM_NOTIFICATIONS`
`ZIX_EMAIL_ENCRYPTION`
`ZSCALER_EMAIL_DLP_INSIGHTS`
`APIIRO`
`ARUBA_IPS`
`CDNETWORKS_CLOUD_SECURITY`
`CISCO_WIPS`
`CLOUDPASSAGE_LIDS`
`CYBER_2_IDS`
`PINGSAFE`
`DEEPFENCE`
`FALCO_IDS`
`GUARDDUTY`
`JUNIPER_IPS`
`JUNIPER_EDGE`
`LACEWORK`
`LOOKINGGLASS_IPS`
`MCAFEE_IPS`
`MICROSOFT_ATA`
`ORCA`
`OSSEC`
`RAPID7_SECURITY_ONION`
`RADIFLOW_IDS`
`SNORT_IDS`
`SOURCEFIRE_IDS`
`SURICATA_IDS`
`SURICATA_EVE`
`TIPPING_POINT`
`TRENDMICRO_EDGEIPS`
`NSFOCUS_NGIPS`
`AKAMAI_CLOUD_MONITOR`
`ALLOT_NETENFORCER`
`AZURE_GATEWAY`
`A10_LOAD_BALANCER`
`BROCADE_SANNAV`
`BROCADE_SERVERIRON`
`CISCO_ACE`
`CITRIX_NETSCALER`
`FORTINET_ADC`
`F5_BIGIP_LTM`
`F5_IP_INTELLIGENCE`
`HAPROXY_LOADBALANCER`
`INFOBLOX_LOADBALANCER`
`KEMP_LOADBALANCER`
`LB_ADC`
`PEPLINK_LOADBALANCER`
`OCI_LOADBALANCER`
`PULSE_SECURE_VTM`
`RADWARE_ALTEON`
`TAILSCALE`
`VMWARE_AVI_VANTAGE`
`VMWARE_SDDC`
`AIRWATCH`
`ARUBA_AIRWAVE`
`CISCO_AIRONET`
`ARUBA_WIRELESS`
`AVAYA_WIRELESS`
`CISCO_WIRELESS`
`HUAWEI_WIRELESS`
`AIRDEFENSE`
`HUAWEI_SWITCH`
`RUCKUS_WIRELESS`
`SIERRA_WIRELESS`
`AZURE_VNET_FLOW`
`CISCO_STEALTHWATCH`
`CISCO_NETFLOW`
`NETFLOW`
`VIRTUAL_NETWORK_FLOW_LOGS`
`ADTRAN_NETVANTA`
`ADVA_FSP`
`ALCATEL_SWITCH`
`ARISTA_SWITCH`
`ARUBA_EDGECONNECT_SDWAN`
`ARUBA_SWT`
`AVAYA_VSP`
`BIGSWITCH_BCF`
`BROCADE_SWITCH`
`BELDEN_SWITCH`
`CATO_SDWAN`
`CAMBIUM_NETWORKS`
`CISCO_ROUTER`
`CISCO_SWITCH`
`CISCO_SDWAN`
`CISCO_SNMP`
`CITRIX_SDWAN`
`CLOUDGENIX_SDWAN`
`CRADLEPOINT`
`DELL_SWITCH`
`DELL_EMC_NETWORKING`
`DELL_WAF`
`DIGI_MODEMS`
`DLINK_SWITCH`
`EXTREME_SWITCH`
`F5_SYSTEM_LOGS`
`FORTINET_SWITCH`
`HIRSCHMANN_SWITCH`
`HP_PROCURVE`
`H3C_SWITCH`
`HUAWEI_CAMPUS_SWITCH`
`HUAWEI_VRP`
`IBM_SWITCH`
`IBM_3COM`
`IBM_KNS`
`HP_ROUTER`
`JUNIPER_MX`
`KEEPALIVED`
`MIKROTIK_ROUTER`
`NETGEAR_SWITCH`
`NOKIA_ROUTER`
`NORTEL_SWITCH`
`NORTEL_SR`
`PEPLINK_ROUTER`
`PEPLINK_SWITCH`
`RAD_ETX`
`UBIQUITI_SWITCH`
`UCOPIA_ROUTER`
`UNIFI_AP`
`UNIFI_SWITCH`
`DELL_EMC_UNITY_VSA`
`VELOCLOUD_SDWAN`
`YAMAHA_ROUTER`
`YSOFT_SAFEQ`
`MELLANOX_SWITCH`
`ARISTA_AGNI`
`CYBERGATEKEEPER_NAC`
`FORESCOUT_NAC`
`FORTINET_FORTINAC`
`HUAWEI_NAC`
`SAFECONNECT_NAC`
`AIRLOCK_DIGITAL`
`APOLLO`
`ABSOLUTE_SECURE_ENDPOINT`
`AUTOMOX_EPM`
`AVAST_HUB`
`AZURE_ATP`
`BITDEFENDER`
`BITDEFENDER_ANALYTICS`
`CS_IDP`
`CYNET_360_AUTOXDR`
`DRUVA`
`F9_WINDOWS_FIM`
`HALCYON`
`KOLIDE`
`LOOKOUT_MOBILE_ENDPOINT_SECURITY`
`MACOS_ENDPOINT_SECURITY`
`N_ABLE_N_CENTRAL_RMM`
`PAN_XDR_MGMT_AUDIT`
`IVANTI_DEVICE_CONTROL`
`IVANTI_ENDPOINT_MANAGER_MOBILE`
`TRENDMICRO_VISION_ONE`
`TRENDMICRO_VISION_ONE_ACTIVITY`
`TRENDMICRO_VISION_ONE_DETECTIONS`
`TRENDMICRO_VISION_ONE_CONTAINER_VULNERABILITIES`
`UBERAGENT`
`CB_DEFENSE`
`CISCO_AMP`
`CISCO_SECURE_WORKLOAD`
`CLAM_AV`
`COMODO_AV`
`DELL_OPENMANAGE`
`ESET_AV`
`FIREEYE_HX`
`FIREEYE_HX_AUDIT`
`FIREEYE_PX`
`FORTINET_SANDBOX`
`HP_WOLF`
`IVANTI_APP_CONTROL`
`JAMF_COMPLIANCE_REPORTER`
`KASPERSKY_AV`
`MACOS`
`MCAFEE_APP_CONTROL`
`MCAFEE_ATD`
`MCAFEE_SOLID_CORE`
`MICROSOFT_SCEP`
`MINERVA_AV`
`SEQRITE_ENDPOINT`
`SEP`
`SOPHOS_AV`
`SPE`
`SUPERNA_EYEGLASS`
`THREATLOCKER`
`TRENDMICRO_AV`
`TRENDMICRO_DEEP_SECURITY`
`TRENDMICRO_STELLAR`
`TRELLIX_HX_ALERTS`
`TRELLIX_NDR`
`CROWDSTRIKE_CSPM`
`TRELLIX_HX_ES`
`TRELLIX_HX_HOSTS`
`TRELLIX_HX_AUDIT`
`TRELLIX_HELIX_TAP_ALERTS`
`WINDOWS_DEFENDER_AV`
`WINDOWS_DEFENDER_ATP`
`ACCELLION`
`CODE42_INCYDR`
`COMFORTE_SECURDPS`
`CTERA_DRIVE`
`CYBERHAVEN_DDR`
`CYBERHAVEN_EVENTS`
`DATTO_FILE_PROTECTION`
`DIGITALGUARDIAN_DLP`
`EGRESS_DEFEND`
`EGRESS_PREVENT`
`ENDPOINT_PROTECTOR_DLP`
`F5_SHAPE`
`FORCEPOINT_DLP`
`GTB_DLP`
`GUARDIUM`
`INDEFEND_DLP`
`MCAFEE_DLP`
`MICROSOFT_PURVIEW`
`MIMECAST_DLP_LOGS`
`NNT_FIM`
`OBSERVEIT`
`PREVEIL_ENTERPRISE`
`PROOFPOINT_DLP`
`PROTEGRITY_DEFIANCE`
`SENTRA_DLP`
`SYMANTEC_DLP`
`TRIPWIRE_FIM`
`TRIPWIRE_SCM`
`ZSCALER_DLP`
`AIR_TABLE`
`ALLIANZ_GSSS`
`AZURE_COSMOS_DB`
`AWS_ELASTI_CACHE`
`AZURE_ARCDATA`
`AZURE_DATAFACTORY`
`AZURE_DOCUMENTDB`
`AZURE_POSTGRESQL`
`AZURE_SQL`
`AWS_RDS`
`CMMRZ_EASYMATCH_CEF`
`COCKROACH_DB`
`DATASUNRISE_DAM`
`DB2_DB`
`DB2_DELEN`
`DELINEA_PAM`
`FIREBASE`
`HITACHI_CLOUD_PLATFORM`
`INFORMIX`
`INTERSYSTEMS_CACHE`
`IVANTI_XTRACTION`
`JDE`
`MAMORI_DAM`
`MARIA_DB`
`MICROSOFT_SQL`
`MICROSOFT_SQL_MANAGED_INSTANCES`
`MONGO_ATLAS_AUDIT`
`MONGO_DB`
`MYSQL`
`ORACLE_DB`
`PPLVN_VERTICA_QUERY`
`POSTGRESQL`
`PASCO_CUSTOM_OCI_EXADB`
`PASCO_CUSTOM_OCI_FW_TRAFFIC`
`PASCO_CUSTOM_OCI_FW_THREAT`
`PASCO_CUSTOM_OCI_CLOUD_GUARD`
`PASCO_CUSTOM_OSSEC_ALERT`
`RAVEN_DB`
`SAP_ASE`
`SAP_NETWEAVER`
`SAP_HANA`
`SAP_INSURANCE`
`SNOWFLAKE`
`SNOWFLAKE_ACCESS`
`SINGLE_STORE`
`TENABLE_CSPM`
`TERADATA_ASTER`
`TERADATA_ACCESS`
`TERADATA_DB`
`TTPORTAL_DB38`
`WELLS_CMDB`
`VERY_GOOD_SECURITY`
`YUGABYTE_DATABASE`
`ADAUDIT_PLUS`
`ADFS`
`ADMANAGER_PLUS`
`ADSELFSERVICE_PLUS`
`AZURE_AD`
`AZURE_AD_AUDIT`
`AZURE_AD_CONTEXT`
`AZURE_LOG_ANALYTICS_WORKSPACE`
`AZURE_LOGIC_APPS`
`AZURE_RISKY_USERS`
`AZURE_RISK_EVENTS`
`AZURE_SERVICE_PRINCIPAL_LOGINS`
`MICROSOFT_GRAPH_ACTIVITY_LOGS`
`POWERSHELL`
`POWERSHELL_TRANSCRIPT`
`SCCM`
`WINDOWS_AD`
`AIX_SYSTEM`
`CMD`
`JUMPTO`
`NIX_SYSTEM`
`SNOOPY_LOGGER`
`SOLARIS_SYSTEM`
`VSFTPD`
`ALERT_GUARDIAN`
`BRIVO`
`CIPHERTRUST_MANAGER`
`DATAWATCH`
`DELEN_BADGEREADER`
`DMP_ENTRE`
`FEENICS_ACCESS_CONTROL`
`HILLSTONE_NDR`
`IMPERVA_DATA_ANALYTICS`
`HALO_SENSOR`
`AXIS_LPR`
`AXIS_CAMERA`
`KISI`
`LSI_BMS`
`LENEL_ONGUARD`
`MATRIX_FRONTIER`
`OPENPATH`
`D_OPENPATH_CONTEXT`
`PAXTON_ACS`
`DATABAHN`
`SIEMENS_DESIGO`
`HIKVISION_NVR`
`NAKIVO_BACKUP`
`PROWATCH`
`PACOM_SYSTEMS`
`SIEMENS_S7_PLC_SYSLOG`
`SIEMENS_S7_PLC_SNMP`
`SIEMENS_SIPASS`
`SOLAR_SYSTEM`
`SOFTWARE_HOUSE_ACS`
`THALES_DIS`
`TSA_GAP`
`VERKADA`
`ANALYST1_IOC`
`ANOMALI_IOC`
`ALIENVAULT_OTX`
`CENTRIPETAL_IOC`
`CIP_FASTWEB_IOC`
`CROWDSTRIKE_IOC`
`CSV_CUSTOM_IOC`
`CYFIRMA_DECYFIR`
`CTIX`
`CUSTOM_CSV_LOG`
`CYBERINT`
`DHS_IOC`
`DIGITAL_SHADOWS_IOC`
`DIGITAL_SHADOWS_SEARCHLIGHT`
`ELLIO_THREAT_INTEL`
`ESET_IOC`
`ET_PRO_IOC`
`FLASHPOINT_IOC`
`FS_ISAC_IOC`
`GREYNOISE`
`GROUP_IB`
`LOOKING_GLASS_IOC`
`MICROSOFT_THREAT_INDICATORS`
`MISP_IOC`
`OSINT_IOC`
`PROOFPOINT_TAP_CAMPAIGN`
`PROOFPOINT_TAP_FORENSICS`
`PROOFPOINT_TAP_PEOPLE`
`PROOFPOINT_TAP_THREATS`
`PROOFPOINT_TIS_IOC`
`RAPID7_INSIGHTS_THREAT_COMMAND`
`RECORDEDFUTURE_ALERTS`
`RECORDED_FUTURE_IOC`
`COVID_CTC_IOC`
`SAFEBROWSING_IOC`
`SEKOIA_IOC`
`SPLUNK_TRUSTAR`
`THREATCONNECT_IOC`
`THREATQ_IOC`
`TEAM_CYMRU_SCOUT_THREATINTEL`
`MANDIANT_CUSTOM_IOC`
`MANDIANT_IOC`
`MANDIANT_ACTIVE_BREACH_IOC`
`MANDIANT_ACTIVE_BREACH_IOC_EVENT`
`MANDIANT_ACTIVE_BREACH_IOC_ENTITY`
`MANDIANT_FUSION_IOC`
`OPEN_SOURCE_INTEL_IOC`
`OSTTRA_MARKITWIRE`
`PAN_IOC`
`RH_ISAC_IOC`
`WHOISXMLAPI_SIMPLE_WHOIS`
`FOX_IT_STIX`
`STIX`
`ASSETNOTE`
`AXONIUS`
`ALTIRIS_LOGS`
`ARUBA_AP`
`CHECKMARX_ONE`
`BETTERCLOUD`
`BROADCOM_SSL_VA`
`HCL_BIGFIX`
`CENSYS`
`CISCO_DNAC`
`CISCO_PRIME`
`CISCO_NDO`
`CRADLEPOINT_NETCLOUD`
`CRYPTOSPIKE`
`DTEX_INTERCEPT`
`ENTRUST_NTP_SERVER`
`EXTREME_WIRELESS`
`FLEET_DM`
`FORTINET_FORTIMANAGER`
`INFOBLOX_NETMRI`
`JUNIPER_MIST`
`KASEYA`
`KEYSIGHT`
`LANSWEEPER`
`MICROFOCUS_IMANAGER`
`MICROSEMI_NTP`
`NETBRAIN`
`NETDISCO`
`OPENTELEMETRY`
`OUTPOST24`
`PACKET_VIPER`
`PAN_PANORAMA`
`PRTG_NETWORKMONITOR`
`RUMBLE_NETWORK_DISCOVERY`
`SOLIDSERVER`
`STEELHEAD`
`TUFIN_SECURE_TRACK`
`WTI_CONSOLE_SERVERS`
`ONEKOSMOS`
`ACTIVE_IDENTITY_HID`
`AKEYLESS_VAULT`
`APPGATE_SDP`
`APPVIEWX`
`AUTHX`
`AUTHX_USER_CONTEXT`
`AUTH_ZERO`
`AZURE_AUTHORIZATION`
`BARRACUDA_CLOUDGEN_ACCESS`
`BEYOND_IDENTITY`
`CA_LDAP`
`CLOUDFLARE_ZERO_TRUST_NETWORK_SESSION`
`CISCO_ACS`
`CISCO_TACACS`
`CYOLO_ZTNA`
`DAVE_ACCOUNT`
`DAVE_DASHBOARD`
`DUO_AUTH`
`DUO_NETWORK_GATEWAY`
`FORTINET_FORTIAUTHENTICATOR`
`FREERADIUS`
`HCNET_ACCOUNT_ADAPTER`
`HID_DIGITALPERSONA`
`HOOPDEV`
`HYPR_MFA`
`IBM_SECURITY_VERIFY_SAAS`
`INWEBO_MFA`
`IBM_SECURITY_VERIFY`
`LOGONBOX`
`LUCID`
`MERCADONA_MICROSOFT_SCOM`
`MICROSOFT_POWERBI_ACTIVITY_LOG`
`MICROSOFT_IAS`
`MICROSOFT_IDENTITY_PROTECTION`
`MICROSOFT_NETLOGON`
`MICROSOFT_DYNAMICS_365`
`MICROSOFT_LAPS`
`MULTIPAY`
`NETIQ_ACCESS_MANAGER`
`NETIQ_EDIRECTORY`
`HLX_FASTWEB_LOG`
`CMB_FASTWEB_LOG`
`DLS_FASTWEB_LOG`
`ASM_FASTWEB_LOG`
`RPA_FASTWEB_LOG`
`SLR_FASTWEB_LOG`
`OFC_FASTWEB_LOG`
`SRG_FASTWEB_LOG`
`LIP_FASTWEB_LOG`
`MSR_FASTWEB_LOG`
`MSV_FASTWEB_LOG`
`MFP_FASTWEB_LOG`
`OML_FASTWEB_LOG`
`PEG_FASTWEB_LOG`
`RNW_FASTWEB_LOG`
`RMY_FASTWEB_LOG`
`SHE_FASTWEB_LOG`
`SNW_FASTWEB_LOG`
`CRM_FASTWEB_LOG`
`SRS_FASTWEB_LOG`
`UCC_FASTWEB_LOG`
`TSP_FASTWEB_LOG`
`TMT_FASTWEB_LOG`
`WFA_FASTWEB_LOG`
`ONFIDO`
`OPENTRUST`
`OPA`
`PING_ACCESS`
`PING_ONE`
`PING_SDK`
`PINGONE_AIC`
`PINGONE_PROTECT`
`QUEST_AD`
`RADIUS`
`RSA_SECURID`
`RSA_CLOUD`
`SAP_IDM`
`SECURE_NOW`
`SHRUBBERY_TACACS`
`SONIC_SWITCH`
`SONICWALL_SMA`
`TACACS_PLUS`
`TENABLE_ADS`
`TRST_IDENTITY_TOOL_KIT`
`TWILIO_AUTHY`
`THALES_MFA`
`TRENDMICRO_VISION_ONE_AUDIT`
`VMWARE_UNIFIED_ACCESS_GATEWAY`
`YUBICO_OTP`
`BRO_HTTP`
`PAN_SSLVPN_ACCESS`
`SAP_WEBDISP`
`SLB_INTERNAL_HTTP_LB_RULE`
`VARNISH_CACHE`
`PCAP_SSL_CLIENT_HELLO`
`BRO_JSON`
`BRO_TSV`
`BT_IPCONTROL`
`CISCO_MERAKI`
`CISCO_MERAKI_CAMERA`
`CISCO_MULTICLOUD_DEFENSE_FIREWALL`
`CISCO_WSA`
`CYLANCE`
`INFOBLOX`
`REPH_K8S`
`KUBERNETES_AUTH_PROXY`
`KUBERNETES_AUDIT`
`KUBERNETES_NODE`
`KUBERNETES_AUDIT_AZURE`
`MCAFEE_EPO`
`NTHRP_ANT_HUNCH`
`NTHRP_ANT_NEPHOMANCER`
`PFSENSE`
`SAFEBREACH`
`NCNG806_TLE`
`REDHAT_OPENSHIFT`
`UPWIND`
`VITALQIP`
`WATCHGUARD`
`WINEVTLOG_XML`
`ADAPTIVE_SHIELD`
`ATLAN`
`NOTION`
`NETENRICH_ENTITY_CONTEXT`
`ARUBA_ORCHESTRATOR`
`ARUBA_CENTRAL`
`ASCERTIA`
`ASIMILY`
`AUDIOCODES`
`AZURE_AD_PASSWORD_PROTECTION`
`BOOMI`
`BITWARDEN_USER_CONTEXT`
`GENEA_ACCESS_CONTROL`
`GC_COMLPD`
`GC_CONFIRMATION_PROCESS_API`
`GC_CLMFSS`
`GC_SAPI`
`GC_EDAPCO`
`GC_GFVHSAPI`
`GC_EDUIEX`
`GC_GTRACL`
`GC_POUICO`
`GC_ASPORT`
`GC_VSTSPD`
`GC_GESAPI`
`TIDE_BOT_PROD`
`BIZTALK`
`BLACKBERRY_WORKSPACES`
`CUBIST_AUDIT`
`CIMCOR`
`CISCO_CYBER_VISION`
`CISCO_SECURE_ENDPOINT`
`CISCO_VIPTELA`
`CLEAFY`
`CLOUDFLARE_WARP`
`CONTROL_UP`
`HUAWEI_CLOUDENGINE`
`COALITION`
`SOFTWARE_HOUSE_CCURE9000`
`CULTURE_AI`
`CLEARSWIFT`
`CYMULATE`
`CYRAL`
`C_ZENTRIX`
`CYBERSIXGILL`
`DATALOCKER_SAFECONSOLE`
`DATADOG`
`DATADOG_ASM`
`DEFECTDOJO`
`DELL_CRM`
`DELL_CYBERSENSE`
`DELL_EMC_DATA_DOMAIN`
`DUO_TRUST_MONITOR`
`EMSISOFT_ANTIVIRUS`
`FM_SYSTEMS`
`FORM3_CERTSTREAM`
`FORTANIX_DSM`
`GENETEC_AUDIT`
`GCSOC2STG_GOVTECH_CATCHALL`
`HEROKU`
`HH_BAS`
`HP_ONEVIEW`
`HYPER_INFINITY`
`IBM_OPENPAGES`
`IBM_CLOUD_SYSTEM`
`IBM_CLOUD_ACTIVITY_TRACKER`
`IDECSI`
`IDENTITY_SECURITY_CLOUD`
`IMIPLC_IMI_AIMI`
`IMPERVA_DRA`
`INGRIAN_NETWORKS_DATASECURE_APPLIANCE`
`INTEZER`
`INTEL471_WATCHER_ALERTS`
`ISECURITY`
`IVANTI_CONNECT_SECURE`
`FORCEPOINT_ONE`
`FRCPT_FORCEPOINT_MAILCONTROL`
`FOXPASS_AUDIT_LOGS`
`DRAYTEK_ROUTER`
`CHROMEOS_XDR`
`VECTRA_XDR`
`METABASE`
`HUAWEI_FUSIONSPHERE`
`HUAWEI_FIREWALL`
`FORGEROCK_IDENTITY_CLOUD`
`FORGEROCK_OPENIDM`
`IMAGENOW`
`IMPERVA_DB`
`JUPITER_ONE`
`JBOSS_WEB`
`LENELS2_ELEMENTS_SECURE`
`LEPIDE`
`ALLIANZ_MICROSOFT_SYNAPSE`
`LOGICGATE`
`MANDIANT_DTM_ALERTS`
`MALTIVERSE_IOC`
`MELISSA`
`MICROSOFT_DEFENDER_ENDPOINT_IOS`
`MICROSOFT_GRAPH_INCIDENT`
`MIRO_CLOUD`
`MS_PERFMON`
`NEO4J`
`NETWRIX`
`NONAME_API_SECURITY`
`NESSUS_NETWORK_MONITOR`
`NUBANK_AXUR_CTI`
`NUBANK_NIGHTFALL_DLP`
`NUBANK_NUTRAIL`
`NU_GRIFO`
`OKERA_DAP`
`OPENCANARY`
`BANCE_PERMISSION_BOT_LOG`
`PHISHALARM`
`PFZ_IMS_USER`
`PROOFPOINT_ENDPOINT_DLP`
`QUALYS_KNOWLEDGEBASE`
`BANCE_SAFUGPT_RESPONSE_LOG`
`RUBRIK_POLARIS`
`RUBRIK_SECURITY_CLOUD`
`RANSOMCARE`
`RQXPUNNM_REV_BITS`
`REDSIFT_BRANDTRUST`
`SAPORO`
`SENDSAFELY`
`SENTRIGO`
`SERVERTECH_PDUS`
`SCHWAB_ADGROUPS`
`SCYLLA`
`SENTRY`
`STARLING_PHISHING`
`SPECTERX`
`STEALTHBITS_DLP`
`SYNCPLIFY_SFTP`
`TEQTIVITY_ASSETS`
`TINES`
`TINTRI`
`TRANSMIT_BINDID`
`TT_D365`
`VARONIS`
`VANGUARD`
`VERTIV_UPS`
`VIACONTROL`
`VORMETRIC`
`WATERFALL_DSM`
`WINDCHILL`
`WS_FTP`
`YSOFT_DSM`
`MONDAY`
`TALON`
`ZSCALER_SANDBOX`
`CLOUDFLARE_BOT_MANAGEMENT`
`F5_BOT`
`IMPERVA_ABP`
`PERIMETERX_BOT_PROTECTION`
`CEQUENCE_BOT_DEFENSE`
`RADWARE_BOT`
`ADMIN_BY_REQUEST`
`AKAMAI_EAA`
`AKAMAI_GUARDICORE`
`ALLIANZ_ACDC_SYSMON_CONFIGURATION_MANAGEMENT`
`ALLIANZ_IDENTITY_PROVIDER`
`ALLIANZ_IDP`
`ALLIANZ_OAUTH`
`ATLASSIAN_AUDIT`
`AVATIER`
`AWS_CONTROL_TOWER`
`AWS_IAM`
`AZURE_AD_PROVISIONING`
`AZURE_AD_SIGNIN`
`AZURE_APPCONFIGURATION`
`BETTERSTACK_UPTIME`
`CISCO_ISE`
`CLEARPASS`
`CLICK_STUDIOS_PASSWORDSTATE`
`CLOUD_IDENTITY_CONTEXT`
`CLOUDM`
`DELINEA_SERVER_SUITE`
`DUO_ACTIVITY`
`DUO_ADMIN`
`DUO_TELEPHONY`
`STRATA_MAVERICKS`
`DUO_CONTEXT`
`DUO_USER_CONTEXT`
`ERGON_INFORMATIK_AIRLOCK_IAM`
`ENTR_DATACTRL_AUDIT`
`FORM3_JAMF_ADMIN`
`FREEIPA`
`GIGYA_CIAM`
`RCF_CIAM_AUDIT_LOG`
`GOLDILOCK`
`HIBP`
`IBM_DATAPOWER`
`IBM_TIVOLI`
`IMPRIVATA_CONFIRM_ID`
`IMPRIVATA_IDG`
`IMPRIVATA_ONESIGN`
`JUMPCLOUD_IAM`
`KEEPER`
`KEYCLOAK`
`KEYFACTOR`
`LASTPASS`
`LIAISON_NUBRIDGES`
`LOCKSELF_LOCKPASS`
`LOOKER_AUDIT`
`MANAGE_ENGINE_AD360`
`MANAGE_ENGINE_PAM360`
`MANAGE_ENGINE_PASSWORD_MANAGER`
`MICROSOFT_DEFENDER_IDENTITY`
`NAUTHILUS`
`NCR_DIGITAL_INSIGHT_FSG`
`OKTA`
`OKTA_ACCESS_GATEWAY`
`OKTA_RADIUS`
`OKTA_USER_CONTEXT`
`OKTA_SCALEFT`
`OKTA_WORKFLOWS`
`ONE_IDENTITY_IDENTITY_MANAGER`
`ONEPASSWORD`
`ONEPASSWORD_AUDIT_EVENTS`
`OORT`
`OPENAM`
`ORACLE_OUD`
`ORACLE_AM`
`ORACLE_EXADATA`
`PING`
`PING_DIRECTORY`
`PASSWORDSTATE`
`PING_FEDERATE`
`PREEMPT`
`PREEMPT_AUTH`
`PROOFID`
`REDHAT_IM`
`REDHAT_KEYCLOAK`
`RSA_AUTH_MANAGER`
`SETI_S4`
`SECTIGO_SCM`
`SAILPOINT_IDENTITYNOW`
`SAILPOINT_IAM`
`SAILPOINT_IIQ`
`MY_SAILPOINT_LIFECYCLE`
`SAVIYNT_EIP`
`SAVVY_SECURITY`
`SENHASEGURA_PAM`
`ADAXES`
`SCH_APP_IAM_AWS`
`SCH_APP_IAM_GCP`
`SILVERFORT`
`SHIBBOLETH_IDP`
`STEALTHBITS_PAM`
`THYCOTIC`
`THYCOTIC_DEVOPS_SECRETVAULT`
`VENAFI`
`VERIDIUM_ID`
`WIDEFIELD_SECURITY`
`TRANSMIT_MOSAIC_CIAM`
`TRANSMIT_MOSAIC_IDENTITY_VERIFICATION`
`TRANSMIT_MOSAIC_FRAUD_PREVENTION`
`TRANSMIT_MOSAIC_MANAGEMENT`
`ZOOM_ACTIVITY`
`WSO2_IS_AM`
`APPIAN_CLOUD`
`BOX`
`ASANA`
`ATLASSIAN_CONFLUENCE`
`ATLASSIAN_CONFLUENCE_JSON`
`CALLTOWER_AUDIO`
`DESIGN_PROFIT_CENTRAL_SERVER`
`DROPBOX`
`IMANAGE_CLOUD`
`KIBANA`
`LARK_SUITE`
`MANGOAPPS`
`NCNG806_ONBOARDED_ASSETS`
`NEXTCLOUD_HUB`
`PUPPET`
`SHAREFILE_LOGS`
`SHAREPOINT`
`SHAREPOINT_ULS`
`SLACK_AUDIT`
`VERBA_REC`
`ATLASSIAN_JIRA`
`ATLASSIAN_JIRA_JSON`
`KACE_SERVICE_DESK`
`ZENDESK_CRM`
`ARGO_WORKFLOWS`
`CAMEYO_BYO_CLOUD`
`CITRIX_XENCENTER`
`DOCKER`
`FAIRXCHANGE_HORIZON`
`HARBOR`
`PROXMAX`
`QUALYS_VIRTUAL_SCANNER`
`VMWARE_ARIA_LOGS`
`VMWARE_ESX`
`VMWARE_HCX`
`VMWARE_HORIZON`
`VMWARE_NSX`
`VMWARE_NSX_AVI`
`VMWARE_TANZU`
`VMWARE_VCENTER`
`VMWARE_CD`
`VMWARE_VREALIZE`
`VMWARE_VSHIELD`
`VMWARE_WORKSPACE_ONE`
`VMWARE_SDWN_EVENTS`
`WINDOWS_HYPERV`
`BALABIT`
`BOMGAR`
`BEYONDTRUST_BEYONDINSIGHT`
`BEYONDTRUST_CPB`
`BEYONDTRUST_ENDPOINT`
`BEYONDTRUST_MC`
`BEYONDTRUST_PI`
`BOKS`
`BROADCOM_CA_PAM`
`CA_ACCESS_CONTROL`
`CYBERARK`
`CYBERARK_CERTIFICATE_MANAGER_SAAS`
`CYBERARK_EPM`
`CYBERARK_PAM`
`CYBERARK_PRIVILEGE_CLOUD`
`CYBERARK_PTA`
`CYBERARK_SCA`
`DELINEA_PRIVILEGE_MANAGER`
`DELINEA_SECRET_SERVER`
`DEVOLUTIONS_RDM`
`HASHICORP`
`HITACHI_ID_PAM`
`ENTRUST_SECRETS_VAULT`
`ONEIDENTITY_ARS`
`ONEIDENTITY_CHANGE_AUDITOR`
`ONEIDENTITY_TPAM`
`ONEIDENTITY_DEFENDER`
`ONEIDENTITY_SAFEGUARD`
`OSIRIUM_PAM`
`PORTNOX_AUDIT`
`PORTNOX_CEF`
`REMEDIANT_SECUREONE`
`SPYCLOUD`
`SMBD`
`WORDPRESS_SIMPLE_HISTORY`
`WALLIX_BASTION`
`WALLIX_EPM`
`WALLIX_PAM`
`AGILOFT`
`ALVEO_RDM`
`AKAMAI_LDS`
`APPOMNI`
`APTOS_EOM`
`ARCHER_IRM`
`ARMOR_ANYWHERE`
`ARISTA_CVP`
`ATLASSIAN_GUARD_DETECT`
`ASSET_PANDA`
`AXWAY`
`AZURE`
`AZURE_ACTIVITY`
`AZURE_APPPLATFORM`
`AZURE_APP_SERVICE`
`AZURE_CHANGEANALYSIS`
`AZURE_EVENTGRID`
`AZURE_EVENTHUB`
`AZURE_HYBRIDCOMPUTE`
`AZURE_NIX_SYSTEM`
`AZURE_COMPUTE`
`AZURE_NSG_FLOW`
`AZURE_NSG_EVENT`
`KASPERSKY_O365_EVENTS`
`BAMBOO_HR`
`BARAMUNDI`
`BRAVURA`
`SAP_IDENTITY_AND_AUTH_DATA`
`SAP_ICM`
`BARRACUDA_SHIELD`
`BLOCKDAEMON_API`
`BLOODHOUND`
`BMC_CLIENT_MANAGEMENT`
`CARTO_ACTIVITY`
`HALO`
`CLAROTY_XDOME`
`CLICKHOUSE`
`CLOUDFLARE_DEVICE_POSTURE_RESULTS`
`CLOUDFLARE_DLP_FORENSIC_COPIES`
`CLOUDFLARE_GATEWAY_HTTP`
`CLOUDFLARE_MAGIC_IDS_DETECTIONS`
`CLOUDFLARE_NEL_REPORTS`
`CLOUDFLARE_GATEWAY_DNS`
`CLOUDBOLT`
`COLORTOKENS`
`CSG_CUSTOMENGINE`
`COHESITY_HELIOS`
`COHESITY_SMARTFILES`
`COMMVAULT_METALLIC`
`CSG_SINGLEVIEW`
`BLOCKDAEMON_METOMIC`
`BLOCKDAEMON_ZUPLO`
`DEAL_CLOUD`
`EFAX`
`ERLANG_SHELL`
`ERMETIC`
`EXTREME_CONTROL`
`F5_DCS`
`F5_SILVERLINE`
`GITGUARDIAN_ENTERPRISE`
`GITHUB_EVENTS`
`GLEAN`
`GREENHOUSE_HARVEST`
`HUBSPOT_LOGIN`
`HUBSPOT_ACTIVITY`
`HUBSPOT_CRM`
`IBM_TRIRIGA`
`ISLAND_BROWSER`
`JOBLOGIC`
`KASPERSKY_ENDPOINT`
`KION`
`KUSTOMER_CRM`
`LEANIX`
`LUMOS`
`MAMBU`
`MICROSOFT_DATABRICKS_WORKSPACES`
`MICROSOFT_INSIGHTS_COMPONENTS`
`MICROSOFT_COPILOT_INTERACTION`
`MITEL_MCD`
`MIRO`
`MODE_ANALYTICS`
`MOSYLE`
`MINERVA`
`NETENRICH_ENTITY_BEHAVIOR`
`NET_SUITE`
`NETOGRAPHY_FUSION`
`EXPRESS_NODEJS`
`ONAPSIS`
`OPUS`
`ORACLE_EBS`
`ORACLE_HCM`
`OUTLINE_ACTIVITY_LOGS`
`PASSFORT`
`PODIUM_PAUL_BUNYAN`
`QLIK_AUDIT`
`RABBITMQ`
`RADIANTONE`
`REDMINE`
`RELATIVITY`
`RIPPLING_ACTIVITYLOGS`
`SAP_SAST`
`SAP_BTP`
`SALT_SECURITY`
`SAP_BW`
`SAP_HAC`
`SAP_ETD`
`SAP_IAS_CONTEXT`
`SIEBEL`
`SMART_SIMPLE`
`SECURESOFT_SNIPER_IPS`
`SPO_SERVICE_CATALOG`
`STRONGDM`
`SYMPHONYAI`
`UKG`
`VONAGE`
`WEBEX_SAAS`
`WORKATO`
`WORKDAY_USER_ACTIVITY`
`WORKDAY_USER_SIGNIN`
`CLOUDFLARE_WORKERS_TRACE_EVENTS`
`WINDOWS_NTP`
`ZOHO_AUDIT`
`ZOHO_ASSIST`
`ZUORA_APP_LOGS`
`XLR`
`AIKIDO`
`AZURE_KEYVAULT_AUDIT`
`AZURE_RESOURCE_LOGS`
`AZURE_SECURITY_CENTER`
`CHROME_MANAGEMENT`
`CISCO_UMBRELLA_AUDIT`
`CISCO_SECURITY_CLOUD_CONTROL`
`CLOUDFLARE`
`CLOUDFLARE_AUDIT`
`CLOUD_PASSAGE`
`CODE_WORLDWIDE`
`OCI_AUDIT`
`OCI_FLOW`
`OCI_IDENTITY_CLOUD_SERVICE`
`ORACLE_CLOUD_AUDIT`
`ORACLE_FUSION`
`SERVICENOW_AUDIT`
`SERVICENOW_ROLES`
`SERVICENOW_TRANSACTION`
`SERVICENOW_EMAIL`
`SERVICENOW_ANTIVIRUS_ACTIVITY`
`SERVICENOW_ATTACHMENT`
`SYMANTEC_EVENT_EXPORT`
`E2_SOLUTIONS`
`ETQ_RELIANCE`
`EVISION_FIRCOSOFT`
`OPENTEXT_FAX2MAIL`
`OPENTEXT_CORDY`
`GSUITE_ADMIN`
`GSUITE_AUDIT`
`IBM_MAAS360`
`KYRIBA`
`LOGICMONITOR`
`MANAGE_ENGINE_REPORTER_PLUS`
`MCAFEE_UCE`
`MCAFEE_WEB_PROTECTION`
`NCC_SCOUTSUITE`
`OBSIDIAN`
`OFFICE_365`
`OFFICE_365_MESSAGETRACE`
`PEOPLESOFT`
`PIVOTAL`
`SALESFORCE`
`SALESFORCE_CONTEXT`
`SALESFORCE_COMMERCE_CLOUD`
`SALESFORCE_SHIELD`
`SALESFORCE_MARKETING_CLOUD_AUDIT`
`SAP_C4C`
`SAP_SUCCESSFACTORS`
`SECURITYSCORECARD`
`SERVICENOW_SECURITY`
`SNIPE_IT`
`SOPHOS_CENTRAL`
`WORKDAY`
`WORKDAY_AUDIT`
`WP_ENGINE`
`AQUA_SECURITY`
`ATT_NETBOND`
`GLUSTER_FS`
`BMC_AMI_DEFENDER`
`CA_ACF2`
`ENSONO`
`IBM_AS400`
`IBM_ZOS`
`APC_ATS`
`APC_NETBOTZ`
`APC_PDU`
`APC_SMART_UPS`
`APC_STRUXUREWARE`
`ARUBA_SWITCH`
`AVIATRIX`
`AVIGILON_ACCESS_LOGS`
`CLOUDFLARE_NETWORK_ANALYTICS`
`EDGECORE_NETWORKS`
`EATON_UPS`
`GLUWARE_NETWORK_AUTOMATION`
`HAIFAGROUPISR_SFLOW`
`HAIFAGROUPISR_TERAFENCE_IOT_CYBER_SECURITY`
`JUNIPER_SDWAN`
`FIREEYE_CMS`
`FOUNDRY_FASTIRON`
`KACE_SMA`
`TRIDIUM_NIAGARA_FRAMEWORK`
`MULTICOM_SWITCH`
`NETWRIX_STEALTHAUDIT`
`NETWRIX_STEALTH_INTERCEPT`
`NETWRIX_THREAT_MANAGER`
`NXLOG_AGENT`
`PACKETLIGHT_DWDM`
`QUMULO_FS`
`SOCOMEC_UPS`
`TRIPP_LITE`
`UBIQUITI_ACCESSPOINT`
`WEBROOT`
`ZYWALL`
`AKAMAI_EVT_VWR`
`ASUS_IPMI`
`AZURE_API_MANAGEMENT`
`BMC_HELIX_DISCOVERY`
`CITRIX_MONITOR`
`CS_ENDPOINT_SECURITY_API`
`CS_FILEVANTAGE`
`CROWDSTRIKE_DLP`
`DEVICE_42`
`DIGICERT`
`ESET_PROTECT_PLATFORM`
`HACKERONE`
`HPE_ILO`
`IBM_ILO`
`HPE_BLADESYSTEM_C7000`
`LXC_ORCHESTRATOR`
`NUTANIX_FRAME`
`NJCCIC_CATCHALL`
`NUTANIX_PRISM`
`NEXTTHINK_FINDER`
`SITEMINDER_SMX`
`IBM_SAFENET`
`IMPERVA_AUDIT_TRAIL`
`INTEL_IPMI`
`SOLACE_AUDIT`
`SUPERMICRO_IPMI`
`TERRAFORM_ENTERPRISE`
`TITAN_MFT`
`TRACEABLE_PLATFORM`
`TSL_PRO`
`WEBMETHODS_API_GATEWAY`
`WORKSPOT_CONTROL`
`ZABBIX`
`CANON_PRINTERS`
`HP_PRINTER`
`FORD_HP_INC_MFP`
`LEXMARK_PRINTER`
`PAPER_CUT`
`AZURE_STORAGE_AUDIT`
`DATABRICKS`
`DELL_COMPELLENT`
`DELL_ECS`
`DELL_EMC_AVAMAR`
`DELL_EMC_CLOUDLINK`
`DELL_EMC_NAS`
`DELL_EMC_POWERSTORE`
`DELL_EMC_UNITY`
`DELL_RECOVERPOINT`
`DREMIO_DATA_LAKEHOUSE`
`HPE_SAN`
`IBM_CLEVERSAFE`
`IBM_DS8000`
`IBM_SPECTRUM_PROTECT`
`IBM_LTO`
`IBM_MAINFRAME_STORAGE`
`IBM_CSM`
`SCALE_COMPUTING`
`INFINIDAT`
`MAGIC_CS`
`NEXUS_SONATYPE`
`NUBANK_FLEX_TAPE`
`REDIS`
`SCALITY_RING_AUDIT`
`SYNOLOGY`
`TRUENAS`
`QNAP_NAS`
`NETAPP_ONTAP`
`NETAPP_ONTAP_AUDIT`
`NETAPP_RANSOMWARE_RESILIENCE`
`NETAPP_SAN`
`CLOUDIAN_HYPERSTORE`
`PURE_STORAGE`
`ACTIVE_SYNC`
`ABSOLUTE`
`AIRWATCH_CONTEXT`
`AZURE_MDM_INTUNE`
`AZURE_MDM_INTUNE_CONTEXT`
`CORRATA`
`IVERIFY`
`JAMF_PRO`
`JAMF_PRO_MDM`
`JAMF_TELEMETRY`
`JAMF_TELEMETRY_V2`
`JAMF_PRO_CONTEXT`
`JAMF_THREAT_EVENTS`
`KANDJI`
`MOBILEIRON`
`SOTI_MOBICONTROL`
`ZIMPERIUM`
`ALERTLOGIC_NOTIFICATIONS`
`AKAMAI_SIEM_CONNECTOR`
`ARCSIGHT_CEF`
`ARCSIGHT_JSON`
`ATT_USM`
`BRAINLABS_CORTEXIO`
`BINDPLANE_AGENT`
`CISCO_FIRESIGHT`
`CONTROL_PLANE`
`CITRIX_ANALYTICS`
`CLEARSENSE`
`CMMRZ_PAM_CYBERARK_ACCOUNTS`
`CMMRZ_PAM_CYBERARK_UNIX_WHITELIST`
`CONFLUENT_AUDIT`
`CRIBL_APPSCOPE`
`CRIBL_CLOUD`
`CRIBL_EDGE`
`CRIBL_SEARCH`
`CRIBL_STREAM`
`CUSTOM_SECURITY_DATA_ANALYTICS`
`DMARCIAN`
`FIVETRAN`
`FORTRA_POWERTECH_SIEM_AGENT`
`GRAYLOG`
`GURUCUL`
`IMAGE_STREAM`
`JOURNALD`
`KENTIK_ALERTS`
`LUMU`
`RQ2X1VC0_PLEASANT_PASSWORD_SERVER`
`VDC`
`DOMO`
`DYNATRACE`
`ELASTIC_AUDITBEAT`
`ELASTIC_FILEBEAT`
`ELASTIC_METRICBEAT`
`ELASTIC_PACKETBEATS`
`ELASTIC_SEARCH`
`ELASTIC_WINLOGBEAT`
`BOWT_APP`
`EXABEAM_FUSION_XDR`
`FLUENTD`
`FORTINET_FORTINDR`
`FORTINET_FORTIANALYZER`
`IBM_QRADAR`
`IBM_WINCOLLECT`
`JUMPCLOUD_DESKTOP`
`JUMPCLOUD_DIRECTORY_INSIGHTS`
`MCAFEE_ESM`
`MICROSOFT_SENTINEL`
`MMC_CUSTOM_QRADAR_ATC`
`MMC_CUSTOM_QRADAR_MMTH`
`NCR_DIGITAL_INSIGHT_GL`
`NEW_RELIC`
`NXLOG_MANAGER`
`OCSF`
`PAGERDUTY_AUDIT`
`RSA_NETWITNESS`
`SNARE_SOLUTIONS`
`SNARE_WINEVTLOG`
`SOLARWINDS_KSS`
`SPLUNK`
`STAIRWELL_INCEPTION`
`SUREVIEW_SYSTEMS`
`TRADE_APP_LOGS`
`WAZUH`
`ZEROFOX_PLATFORM`
`D3_BANKING`
`GMV_CHECKER`
`GMV_CHECKER_CONTEXT`
`SWIFT_AMH`
`SCHWAB_BANK_AUDIT`
`WOLTERS_KLUWER_TEAMMATE`
`CLEARBANK_PORTAL`
`FORSETI`
`GCP`
`GCP_ABUSE_EVENTS`
`GCP_APIGEE`
`GCP_APIGEE_X`
`GCP_ARTIFACT_REGISTRY`
`GCP_BIGQUERY_CONTEXT`
`GCP_CLOUDIDENTITY_DEVICES`
`GCP_CLOUDIDENTITY_DEVICEUSERS`
`GCP_CLOUDIOT`
`BBVA_GAE_SALA`
`GCP_CLOUD_NAT`
`GCP_CLOUDAUDIT`
`GCP_CLOUDSQL`
`GCP_COMPUTE`
`GCP_COMPUTE_CONTEXT`
`GCP_CONNECTOR`
`GCP_CHRONICLE_AUDIT`
`GCP_CSCC`
`GCP_DLP_CONTEXT`
`GCP_DNS`
`GCP_DNS_ATD`
`GCP_FIREWALL`
`GCP_NGFW_ENTERPRISE`
`GCP_APP_ENGINE`
`GCP_LOADBALANCING`
`GCP_IAM_ANALYSIS`
`GCP_IAM_CONTEXT`
`GCP_KUBERNETES_CONTAINER_SECURITY`
`GCP_KUBERNETES_CONTEXT`
`GCP_MODEL_ARMOR`
`GCP_RESOURCE_MANAGER_CONTEXT`
`GCP_NETWORK_CONNECTIVITY_CONTEXT`
`GCP_SQL_CONTEXT`
`GCP_CLOUD_FUNCTIONS_CONTEXT`
`GCP_IDS`
`GCP_PACKET_MIRRORING`
`GCP_RUN`
`GCP_SECURITYCENTER`
`GCP_SECURITYCENTER_ERROR`
`GCP_SECURITYCENTER_MISCONFIGURATION`
`GCP_SECURITYCENTER_OBSERVATION`
`GCP_SECURITYCENTER_POSTURE_VIOLATION`
`GCP_SECURITYCENTER_THREAT`
`GCP_SECURITYCENTER_TOXIC_COMBINATION`
`GCP_SECURITYCENTER_UNSPECIFIED`
`GCP_SECURITYCENTER_VULNERABILITY`
`GCP_SECURITYCENTER_CHOKEPOINT`
`GCP_SECURITYCENTER_SECRET`
`GCP_SECURITYCENTER_EXTERNAL_EXPOSURE`
`GCP_STORAGE_CONTEXT`
`GCP_SYSLOG`
`GCP_THREAT_DETECTION`
`GCP_VPC_FLOW`
`GCP_RECAPTCHA_ENTERPRISE`
`GCP_THREATINTEL`
`OCI_CLOUDGUARD`
`TRENDMICRO_VISION_ONE_WORKBENCH`
`TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES`
`VEZA`
`WORKSPACE_ACTIVITY`
`WORKSPACE_ALERTS`
`WORKSPACE_CHROMEOS`
`WORKSPACE_GROUPS`
`WORKSPACE_MOBILE`
`WORKSPACE_PRIVILEGES`
`WORKSPACE_USERS`
`AWS_API_GATEWAY`
`AWS_AURORA`
`AWS_S3_SERVER_ACCESS`
`AWS_CLOUDFRONT`
`AWS_CLOUDTRAIL`
`AWS_CLOUDWATCH`
`AWS_CONFIG`
`AWS_DYNAMO_DB`
`AWS_ELB`
`AWS_EMR`
`AWS_ECS_METRICS`
`AWS_FSX`
`AWS_INSPECTOR`
`AWS_INSPECTOR2`
`AWS_KMS`
`AWS_MACIE`
`AWS_NGINX`
`AWS_NETWORK_FIREWALL`
`AWS_PY_TOOLS`
`AWS_REDSHIFT`
`AWS_SECURITY_HUB`
`AWS_SES`
`AWS_SESSION_MANAGER`
`AWS_SHIELD`
`AWS_VPC_FLOW`
`AWS_VPC_FLOW_CSV`
`AWS_EC2_HOSTS`
`AWS_EC2_INSTANCES`
`AWS_EC2_VPCS`
`AWS_VPC_TRANSIT_GATEWAY`
`ACCENTURE_SYNTHETIC`
`TEMENOS_MANAGER_SYSTEMEVENT`
`UDM`
`TANIUM_AUDIT`
`TANIUM_ASSET`
`TANIUM_COMPLY`
`TANIUM_DEPLOY`
`TANIUM_DISCOVER`
`TANIUM_EDR`
`TANIUM_INSIGHT`
`TANIUM_INTEGRITY_MONITOR`
`TANIUM_PATCH`
`TANIUM_QUESTION`
`TANIUM_REVEAL`
`TANIUM_TH`
`TANIUM_THREAT_RESPONSE`
`APACHE`
`APACHE_KAFKA_AUDIT`
`APACHE_AIRFLOW`
`CASSANDRA`
`CLOUDFLARE_HTTP_REQUESTS`
`CLOUDFLARE_SINKHOLE_HTTP_LOGS`
`DATALUST`
`FORD_EMC_VMWARE`
`FUSION_AUTH`
`HADOOP`
`HAPROXY`
`IBM_WEBSPHERE_APP_SERVER`
`IBM_WEBSEAL`
`FORD_IBM_IMM_ILO`
`FORD_IBM_SENSE`
`IBM_SENSE`
`IIS`
`KONG_GATEWAY`
`MATTERMOST`
`FORD_MAIL_RELAY_MIRAPOINT`
`NGINX`
`ORACLE_WEBLOGIC`
`PROFTPD`
`RARITAN_DOMINION`
`RQOVBLQO_JITTERBIT_AUDIT_LOGS`
`RQIHENBY_AIC_JIT_AUDIT_LOGS`
`RQIHENBY_PING_P1AS`
`RQIHENBY_PINGONE_RISK`
`RQIHENBY_OPS_PORTAL`
`FORD_SOLARIS_OPERATING_SYSTEM_DHCP_LOGS`
`SLACK_API`
`TABLEAU`
`TRAEFIK`
`TYK_IO`
`WEBROOT_IDENTITY_PROTECTION`
`ACN_SIA`
`AKAMAI_KONA_EDGE_GRID`
`AKAMAI_MFA`
`ARCTIC_NODE`
`ARCON_PAM`
`ARIZE_CLOUD`
`ANP_ADMIN`
`APPSMITH_AUDIT`
`LANGSMITH_AUDIT`
`ARCDA_COREWEB`
`AVIGILON_ALTA_CLOUD_SECURITY`
`AKAMAI_API_SECURITY`
`IBM_SVA`
`AWARE_SIGNALS`
`AWARE_AUDIT`
`AUTODESK_VAULT`
`AUTODESK_CAD_CAM`
`AUTHMIND`
`AZURE_FRONT_DOOR`
`AZURE_RECOVERY_SERVICES_VAULTS`
`ALKIRA_IP_FLOW`
`FORM3_SARIF`
`MT_APPLIED_FSS`
`ADDIGY_MDM`
`BYT_AZURE_AITM`
`BYT_DADDI_APP`
`BYT_AWS_COGNITO`
`BBVA_GCE`
`BLUE_VOYANT`
`BBVA_MICROSTRATEGY`
`BARRACUDA_INCIDENTRESPONSE`
`BACKBASE`
`BACKSTAGE`
`BANNER_DD`
`BLV_BACKSTAGE`
`BUILDKITE_AUDIT`
`CAMEYO_ACTIVITY_LOGS`
`CALLER_VERIFY`
`CERTSECURE_LOG`
`AZURE_SOFTWARE_VULNERABILITIES`
`NXL_AMPLIFY`
`IBM_B2B_INTEGRATOR`
`CHATGPT_AUDIT_LOGS`
`CHECKPOINT_FDE`
`CIENA_ROUTER`
`CISCO_SECURE_ACCESS`
`CISCO_UMBRELLA_SWG_DLP`
`CISCO_UMBRELLA_FIREWALL`
`CISCO_UMBRELLA_IPS`
`CISCO_FIREPOWER_THREAT_DEFENSE`
`CISCO_VULNERABILITY_MANAGEMENT`
`CITADEL_IDENTITY360`
`CLAROTY_XDOME_SECURE_ACCESS`
`COREVIEW`
`CMMRZ_FORTI_DECEPTOR`
`CSG_CITRIX_RX`
`CONVERSATIONAL_AGENT`
`CURSOR`
`CYDAERA_AERA_ISPRING`
`CYBERARK_IDENTITY`
`CLOUDERA_RANGER`
`CYTRACOM_CONTROL_ONE`
`CYFIRMA_DECYFIR_LOG`
`DARKWEB_IQ`
`DUO_AUTH_PROXY`
`F5_F5OS_A`
`DELL_VXRAIL`
`GEMINI_CODE_ASSIST`
`GC_UWHVRB`
`GEOSCADA_OT`
`HUMAN_SECURITY`
`HPE_ALLETRA`
`CROWDSTRIKE_FALCON_SHIELD`
`EASY_NAC`
`HUAWEI_SECMASTER`
`NOVIDEA_CLAIM_HISTORY`
`NEUVECTOR`
`N002_DASH26_EINSTEIN`
`N002_TONBELLER`
`OPENPATH_CONTEXT`
`TREND_MICRO_TIPPING_POINT`
`TOSI_HUB`
`VERTICA_AUDIT`
`BARRACUDA_LOAD_BALANCER`
`AVAYA_AURA_SESSION_MANAGER`
`SOCRADAR_INCIDENTS`
`PATHLOCK`
`GENIAN_NAC`
`GENE6_FTP`
`PENTA_WAPPLES`
`PYLON_LOGS`
`GEMINI_ENTERPRISE_AGENT_PLATFORM`
`S2W_QUAXAR`
`GENETEC_SYNERGIS`
`WORKIVA_WDESK`
`EQIX_CONFIGURATION_BUILDER`
`IDME_SHOP`
`STORMBREAKER`
`SAS_INSTITUTE`
`INVICTI`
`SHIELD_IOT`
`GC_CNBWEB`
`GC_SMSMGMT`
`GC_RDSAKS`
`GC_RELSVC`
`GC_DCWCLB`
`GC_BILDCK`
`GC_BSAWRK`
`GC_LR2TSA`
`GC_MOVEAU`
`GC_GTRAPR`
`GC_CLMGNC`
`GC_CVHAPI`
`GC_GEOAPI`
`GC_SSPAPP`
`KASPERSKY_ANTI_TARGETED_ATTACK`
`LOG4J`
`NETCRAFT_TAKEDOWN`
`SNGPS_HP_EL_SWITCH`
`SNGPS_HPE_3COM`
`SNGPS_HP_FLEXNET_SWITCH`
`D_STORMBREAKER_ALERTS`
`D_STORMBREAKER_AUDIT`
`HP_TANDEM`
`TRANSMIT_FLEXID`
`CLOUDAWARE`
`CELONIS`
`CLAUDE_COMPLIANCE_LOGS`
`CODA_IO`
`CRUSHFTP`
`CONTROL_D`
`DATAIKU_DSS_LOGS`
`DBT_CLOUD`
`DELINEA_DISTRIBUTED_ENGINE`
`DOCKER_HUB_ACTIVITY`
`ENTRUST_AMA`
`MOVEWORKS`
`CISCO_RAVPN`
`FA_SOLUTIONS`
`FILES_DOT_COM`
`FIGMA`
`FINCOMUN_ORACLE_SPEI`
`FORTINET_FORTIDDOS`
`FORTINET_FORTIDLP`
`MANAGEENGINE_NCM`
`MMBSF_FACTORIAL`
`FIREBLOCKS`
`FLCV_BO_FRANCETV`
`FRTR001_FORTER_PORTAL`
`FLCV_BO_LIVE`
`GHANGOR_DLP`
`GCSOC2PRD_GOVTECH_WEBMON`
`GCSOC2STG_GOVTECH_WEBMON`
`HONEYWELL_CYBERINSIGHTS`
`HKBK_ASE1_EMS_BMA`
`HKBK_ASE1_MORPHISEC_EDR`
`HKBK_ASE1_DELL_EMC`
`NCNG806_GCC_CPP`
`NETLIFY_LOGDRAINS`
`LAYERX`
`LGLNT_LEGALFORCE_OPS`
`LGLNT_IDOORS`
`GCP_IDENTITYTOOLKIT`
`GCP_MONITORING_ALERTS`
`NAM_FASTWEB_LOG`
`NCNG806_GOOGLE_ANGULAR`
`NETFLOW_OTEL`
`GENESYS_AUDIT`
`GUIDEWIRE_BILLING_CENTER`
`GUIDEWIRE_CLAIM_CENTER`
`GUIDEWIRE_POLICY_CENTER`
`GDLP_ATLAS_USER_ELEVATION`
`HKU_PORTAL`
`HEX`
`HASHCAST`
`HAVI_CONNECT`
`HK_HUAWEI_AIRENGINE`
`HSCR_ACCOUNTS`
`HILLSTONE_NGFW`
`HOXHUNT`
`HUAWEI_CTS_AUDIT`
`ISL_LIGHT`
`IMANAGE_THREAT_MANAGER`
`KEEP_AWARE`
`KRYSG001_GDL_SSO`
`KRGR_GLIDEPATH`
`MC001_ELASTIC_CLICKS`
`N002_CECABANK_AUDIT`
`NCNG806_IBM_ESB`
`NCNG806_IBM_APP_CONNECT`
`NIGHTFALL`
`OUC_FASTWEB_LOG`
`OPENAI_AUDITLOG`
`RQIDJIE5_CAS`
`RUBLON`
`RED_ACCESS`
`SECURENVOY_MFA`
`STRIPE`
`STRIVACITY`
`ADYEN`
`KODEM_SECURITY`
`IBM_INSIGHTS`
`INTEL_EMA`
`IM_EXPRESS`
`INCIDENT_IO`
`IRONSTREAM_ZOS`
`ITOP`
`ITSDIMSS_DELINEA_SECRET_SERVER`
`INDUSFACE_WAF`
`JFROG_ARTIFACTORY`
`JAMF_CONNECT`
`JSCAPE_SFTP`
`KANDJI_CONTEXT`
`MANAGE_ENGINE_ASSET_EXPLR`
`MANAGE_ENGINE_ENDPT_CNTRL`
`MANAGE_ENGINE_OPUTILS`
`MANHATTAN_WMS`
`MAGENTO_CLOUD`
`MCPDEV`
`MCPMODIFY`
`MCPVIEW`
`METASWITCH_PERIMETA`
`METRO_ODOOLOGS`
`MICROSOFT_ADS`
`MLL001_MOL_AGYIEUS`
`MLL001_MOL_SFTPGO`
`MLL001_MOL_PCI_DC_CARDHOLDER`
`MLL001_MOL_PCI_DC_MANDATES`
`MLL001_MOL_PCI_DC_SAD`
`MLL001_MOL_PCI_DB_FIM`
`MLL001_MOL_PCI_GKE_FIM`
`MLL001_MOL_PCI_IIN_LOOKUP`
`MLL001_MOL_PCI_PCI_PROXY`
`MLL001_MOL_PCI_TOKENISER`
`MLL001_MOL_TF_CLOUD`
`MLL001_MOL_CLAMAV`
`MLL001_MOL_MYSQL`
`MLL001_MOL_PA_NGFW`
`MGSTC_MYMELITA`
`MACSTADIUM`
`BLUECAT_MICETRO_IPAM`
`NETWORKBOX_UTM`
`N002_MICROSERVICES_HTTPLOG`
`N002_MICROSERVICES_SERVICELOG`
`N002_MICROSERVICES_AUDITLOG`
`NEXI_GAR2`
`NCNG806_ORACLE_JAVA`
`NCNG806_ORACLE_SPRINGBOOT`
`NCNG806_ORACLE_JAX_RS`
`NYK_ERETAIL_AUDIT`
`NYK_ADMIN_PANEL_AUDIT`
`NYK_A2S_AUDIT`
`OVHCLOUD`
`ORACLE_OEM`
`ORACLE_ZDLRA`
`PHAROS`
`PERCEPTION_POINT_XRAY`
`PINGCAP_TIDB`
`PLUMFINTECH_PLUM_SCA`
`PODIUM_ARTH_0`
`PROXMOX`
`PRISMATIC_IO`
`PTM001_NESS`
`PRIVACY_I`
`PHOSPHORUS`
`RETOOL`
`REDHAT_JBOSS`
`RIVERBED`
`RENAULT_SOSSPAM`
`RAPID7_CLOUDSEC`
`JIRANSECURITY_MAILSCREEN`
`MY_RESOLVER`
`QUALTRICS_AUDIT`
`RACKSPACE`
`RADWARE_ACCESS`
`REVIVESEC`
`REVVITY_SIGNALAPP`
`RQIHENBY_PROD_SEC`
`SEL_PORT_SERVER`
`VALENCE`
`BRDCM_IMS_PAM`
`BBVA_BANKTRADE`
`BBVA_CONSORES`
`RECO_CSPM`
`RQTI0LIH_VERVE`
`RQTI0LIH_ONEHUB`
`RQTI0LIH_EPI_MES`
`TORQ_AUDIT_LOGS`
`TRAX`
`WIZ_RUNTIME_EXECUTION_DATA`
`WIZ_VULNERABILITIES`
`SAP_LEASING`
`AIRBUS_SECURITY_LOG`
`BOEING_ONS`
`BBVA_SIRE`
`BBVA_POWER_CURVE`
`BBVA_SMARTSTREAM`
`BBVA_SOLUCIONES`
`BBVA_TEXSA`
`PAN_PRISMA_DIG_CLOUD_DSPM`
`BBVA_SIIBE`
`BBVA_MBOT`
`BBVA_SINBA`
`BBVA_MSDP`
`BBVA_PLUS`
`BBVA_CAIRO`
`BBVA_SICOR`
`BBVA_FUMER`
`BBVA_MCOR`
`BBVA_MCWN`
`BBVA_ZEIT`
`BBVA_CYGE`
`BBVA_SISP_NET`
`BBVA_CLAIM_CENTER`
`BBVA_SAIT`
`BBVA_SPWEB`
`BBVA_VALIDADOR`
`BBVA_GUIA`
`BBVA_HECO`
`GL_TRADE`
`ORACLE_AVDF`
`REBLAZE_WAF`
`VZ_MAXMIND_GEOIP`
`TT002_EXASOL`
`CORERO_SMARTWALL_ONE`
`AVEPOINT_ENPOWER`
`AVIGILON_AVA_SECURITY_CAMERA`
`GITHUB_DEPENDABOT`
`AWS_EKS`
`THALES_PS10K_HSM`
`F5_DCS_WAF`
`CLOUDWAVE_HONEYPOT`
`PAN_PRISMA_CWP`
`FORTINET_FORTISASE`
`MICROSTRATEGY`
`AWS_DASHA`
`ONETRUST`
`NETWRIX_PRIVILEGE_SECURE`
`SANGFOR_PROXY`
`SENSORFU_BEACON`
`SLSFR001_SLACK_EBPFAUDIT`
`SLSFR001_SLACK_GOAUDIT`
`SLSFR001_CSOC_SIEM_PLATFORM`
`SAS_METADATA_SERVER_LOG`
`SENSATO_HONEYPOT`
`SNF_SDH`
`SURIDATA`
`LEGATOSECINT_SECURDEN`
`SECURDEN`
`SNF_SENTINELONE_FW`
`SITEMINDER_GE`
`SLB_SAP_C4C`
`SONATYPE_LIFECYCLE`
`SOFTETHER_VPN`
`SATURN_CLOUD`
`SERVICENOW_CERTIFICATE`
`SERVICENOW_USER`
`SERVICENOW_USER_LOGIN_HISTORY`
`SERVICENOW_SYSLOG`
`SERVICENOW_OUTBOUNDHTTP`
`SERVICENOW_NODE`
`SNOWPLOW`
`SITEGUARD_SERVER`
`TENCENT_CLOUD_AUDIT`
`TRELLIX_AX`
`TRELLIX_EX`
`TRELLIX_EDRF`
`TENABLE_AUDIT`
`THOUSAND_EYES`
`TLFNC003_TE_IDENTITY_ENTITY`
`TIKTOK`
`TOMCAT`
`TENCENT_CLOUD_FIREWALL`
`TENCENT_CLOUD_WAF`
`TENCENT_CLOUD_WORKLOAD_PROTECTION`
`TRVLK001_TERA`
`THREATCONNECT_IOC_V3`
`UPTIVITY`
`UNIFI_ROUTER`
`UNICO_IDPLUS`
`UNICO_IDCLOUD`
`UNICO_IDTRUST`
`VZ_LOL_DRIVERS`
`VENAFI_ZTPKI`
`VALR_ADMIN`
`VALR_APPLICATION`
`VALR_WALLET`
`VANTA_CONTEXT`
`VERIATO_CEREBRAL`
`VIRTUAL_BROWSER`
`VMWARE_VSPHERE`
`VZ_W1DV`
`VZ_SECURITY_MARIMBA_INVENTORY`
`VECTRA_AI`
`UIPATH`
`WINDOWS_BINDPLANE`
`WFR_PARTNERHOME_ACCOUNT`
`WFR_PARTNERHOME_ADMINPAGE`
`WFR_PARTNERHOME_CASTLEGATE`
`WFR_PARTNERHOME_FINANCE`
`WFR_PARTNERHOME_ORDER`
`WING_SECURITY`
`WPASS`
`WSGC_EGIFT_CARDS`
`ULTRA`
`ZERO_NETWORKS`
`SILICONBOX_YEASTAR_IP_PBX`
`JIT`
`PROCORE`
`HP_INC_MFP`
`MERU_CONTENTKEEPER_PROXY`
`KPMG_JAPAN_HR`
`FORD_ADFS_IDP`
`FORD_BLUE_DNS`
`TSA_VMS`
`ALLIANZ_CPAM`
`HKBK_ASE1_DIGITALGUARDIAN_NDLP`
`PANORAYS`
`BBVA_BAEMPRE`
`WINGET_AUTOUPDATE`
`ZIMBRA_MAIL`
`WITNESS_AI_CONTROL`
`ZSCALER_EMAIL_DLP`
`AUDITD`
`AXIS_OS`
`ARISTA_EOS`
`BROCADE_FOS`
`CISCO_IOS`
`CISCO_NX_OS`
`CISCO_SECURE_ACCESS_ENROLLMENT`
`CISCO_SECURE_ACCESS_NETWORK`
`CISCO_UCS`
`EXTREMEWARE_NETWORKS`
`HP_LINUX`
`IBM_I`
`FORD_IBM_AIX_SERVER`
`JUNIPER_JUNOS`
`JUNIPER_SSR_CONDUCTOR`
`INFORMATICA_POWERCENTER`
`LINUX_OS`
`LIRA`
`NETAPP_STORAGEGRID`
`NIMBLE_OS`
`REDCANARY_CLOUD_PROTECTION_RAW`
`TANIUM_TANOS`
`TETRAGON_EBPF_AUDIT_LOGS`
`TGDETECT`
`PLASO`
`VYOS`
`EXTERRO_FTK_CENTRAL`
`CROWDSTRIKE_RECON`
`CLOUDFLARE_PAGESHIELD`
`FORTRA_VM`
`GCP_CLOUD_ASSET_INVENTORY`
`RAPID_IDENTITY`
`SLSFR_VERTEX_IOC`
`ARCDA_VISTA`
`PRMTH_WSO2`
`MC001_CLICKS_ENTERPAT`
`MC001_CLICKS_CLIUSERS`
`MC001_ROSHTOV_CLICKS`
`MC001_INFOSEC_BLOCK_TOOL`
`MC001_MACCABI_PHARMACY`
`SPACELIFT`
`PAVE`
`MC001_MACCABI_NEW_APP`
`MC001_PORTAL_APPLICATION_LOGS`
`MC001_OFEK_EITAN`
`MC001_MACCABI_ONLINE_SUPPORT_LOGS`
`MC001_MACCABI_ONLINE_LOGS`
`MC001_MACCABI_ONLINE_FAMILY`
`CPS_JED_JCD_METRIC`
`H_ISAC`
`IIJ_LANSCOPE`
`ML009_MENLO`
`TITAN_SFTP`
`IBM_CICS`
`MULESOFT`
`MICROSOFT_SERVICEBUS_NAMESPACES`
`AVAYA_AURA`
`AVAYA_IVR`
`CISCO_CALL_MANAGER`
`CISCO_CTS`
`CISCO_UCM`
`CISCO_UNITY_CONNECTION`
`CISCO_VCS`
`CISCO_WSM`
`RECORDIA`
`KAMAILIO`
`RIBBON_ANALYTICS_PLATFORM`
`RIBBON_SBC`
`RING_CENTRAL`
`TWILIO_AUDIT`
`ZOOM_OPERATION_LOGS`
`JUMPCLOUD_DAAS`
`OPENDJ`
`OPENLDAP`
`OPENCTI`
`REDHAT_DIRECTORY_SERVER`
`SEMPERIS_ADFR`
`SEMPERIS_DSP`
`MTSBS_WINDOWS_AD_MMC`
`MTSBS_WINDOWS_AD_ATC`
`MTSBS_WINDOWS_AD_MMTH`
`MTSBS_WINDOWS_AD_MMPC`
`MTSBS_WINDOWS_AD_MMKI`
`ACRONIS`
`BACKBOX`
`CODE42`
`COHESITY`
`COMMVAULT`
`COMMVAULT_COMMCELL`
`DRUVA_BACKUP`
`RUBRIK`
`TT_MSAN_DSLAM`
`TT_TRIO_CHORDIANT`
`VEEAM`
`VERITAS_NETBACKUP`
`ACALVIO`
`ESTAR`
`ZSCALER_DECEPTION`
`CERBERUS_FTP`
`DNSFILTER`
`ESHARE_PLATFORM`
`EXIM_INTERNET_MAILER`
`FILEZILLA_FTP`
`FILEMAGE_SFTP`
`GLOBALSCAPE_SFTP`
`GRAYHATWARFARE`
`HIBOB`
`IBM_MQ_FILE_TRANSFER`
`IPSWITCH_SFTP`
`IPSWITCH_MOVEIT_TRANSFER`
`IPSWITCH_MOVEIT_AUTOMATION`
`PROVISION_ASSET_CONTEXT`
`KITEWORKS`
`NASUNI_FILE_SERVICES`
`ORACLE_NETSUITE`
`FISGLOBAL_QUANTUM`
`SOLARWINDS_SERV_U`
`SWIFT`
`VANDYKE_SFTP`
`VSFTPD_AUDIT`
`WINSCP`
`ALGOSEC`
`CISCO_SMA`
`CLOUDPASSAGE_CSM`
`CLOUDPASSAGE_FIM`
`ILLUMIO_CORE`
`KYVERNO`
`NTHRP_ANT_2PC_AUDIT`
`NTHRP_ANT_MAC_AUDIT`
`SECBERUS`
`XITING_XAMS`
`CSV_CUSTOM_CMDB`
`JAMF`
`LEANIX_CMDB`
`MEDIGATE_CMDB`
`MICROSOFT_NPS`
`PFZ_CMDB_APPLICATION`
`PFZ_CMDB_ASSET`
`SERVICENOW_CMDB`
`VZ_CISD`
`VZ_WORKERID`
`SERVICENOW_CMDB_HARDWARE`
`SERVICENOW_CMDB_SOFTWARE`
`SEVCO_CMDB`
`WINDOWS_NET_POLICY_SERVER`
`ANSIBLE_AWX`
`ARGO_CD`
`ATLASSIAN_BITBUCKET`
`AUTOMATION_ANYWHERE`
`AZURE_DEVOPS`
`BINDPLANE`
`BLUE_PRISM`
`CLOUDBEES`
`BMC_CONTROL_M`
`CIRCLECI`
`CYCODE`
`GITHUB`
`GITLAB`
`HARNESS_IO`
`HELIX_CORE`
`JAMF_SECURITY_CLOUD`
`JENKINS`
`LAUNCH_DARKLY`
`MIASMA_SECRETSCANNER`
`MICROSOFT_DEFENDER_CLOUD_ALERTS`
`NXLOG_FIM`
`PAGERDUTY`
`PEGA`
`UNIT21`
`AZURE_BASTION`
`AZURE_WVD_CONNECTIONS`
`AZURE_WVD_MANAGEMENT`
`BEYONDTRUST_REMOTE_ACCESS`
`BITVISE_SSHD`
`BITVISE_SFTP`
`CLOUDFLARE_SSH_LOGS`
`CONNECTWISE_AUTOMATE`
`CONNECTWISE_CONTROL`
`CHECKPOINT_HARMONY`
`CITRIX_STOREFRONT`
`CITRIX_SESSION_METADATA`
`CITRIX_VDI`
`CYOLO_OT`
`HASHICORP_BOUNDARY`
`HASHICORP_TERRAFORM`
`IDRAC`
`MANAGEENGINE_RAP`
`NINJAONE`
`OPENGEAR`
`OPENSSH`
`SECOMEA_GATEMANAGER`
`SECURELINK`
`SPLASHTOP`
`TEAMVIEWER`
`TEAMVIEWER_TENSOR`
`TELEPORT_ACCESS_PLANE`
`TERADICI_PCOIP`
`ZPE_SYSTEMS_NODEGRID`
`D3_SECURITY`
`IMPERVA_SONAR`
`IBM_SOAR`
`PAN_XSOAR`
`CHRONICLE_SOAR_AUDIT`
`SPLUNK_PHANTOM`
`SWIMLANE`
`WINDOWS_APPLOCKER`
`CLAROTY_CTD`
`CLAROTY_EMC`
`CYBERX`
`CYLERA_IOT`
`DRAGOS`
`MEDIGATE_IOT`
`ORDR_IOT`
`PAN_IOT`
`NOKIA_HDM`
`NYANSA_EVENTS`
`REALITEQ`
`SIGA`
`AVAYA_BORDER`
`ENTRUST_HSM`
`FORCEPOINT_VSERIES`
`FUTUREX_HSM`
`HP_POLY`
`SAFENET_HSM`
`THALES_LUNA_HSM`
`AUTHENTIC8_SILO`
`FILE_SCANNING_FRAMEWORK`
`SYMANTEC_WEB_ISOLATION`
`ARKIME_PCAP`
`SHODAN_IO`
`ARMIS`
`ARMIS_ACTIVITIES`
`ARMIS_ALERTS`
`ARMIS_DEVICES`
`STEALTHBITS_AUDIT`
`STEALTHBITS_DEFEND`
`ACQUIA_CLOUD_PLATFORM`
`ADOBE_COMMERCE`
`ADOBE_EXPERIENCE_MANAGER`
`ADOBE_IO_RUNTIME`
`ADOBE_EXPERIENCE_PLATFORM`
`VECTRA_ALERTS`
`VECTRA_RUX`
`AKAMAI_DATASTREAM_2`
`CLOUDSEK_ALERTS`
`BABELFORCE`
`DESYNOVA_CONTIDO`
`DRUPAL`
`NETDOCUMENTS`
`ONBASE_CMS`
`PAAK_CMS`
`SAP_HYBRIS`
`TELEFONICA_USER_CONTEXT`
`TELEFONICA_DHCP`
`USBAV_KORAMIS`
`WORDPRESS_CMS`
`CISCO_ACI`
`CISCO_APIC`
`NAGIOS`
`AVAZA`
`CILIUM`
`CISCO_ESTREAMER`
`ELASTIC_DEFEND`
`FORESCOUT_EYEINSPECT`
`FORTINET_IPS`
`JAMF_NETWORK_TRAFFIC`
`NETWRIX_ACTIVITY_MONITOR`
`NOZOMI_GUARDIAN`
`SENSEON_ALERTS`
`STATUSGATOR`
`TPLINK_SWITCH`
`ZSCALER_ZCC`
`ZSCALER_ZDX`
`NE_SILENT_LOG`
`NUCLEUS_ASSET`
`NUCLEUS_VULNERABILITY`
`NUCLEUS_VULNERABILITY_DELTA`
`SITE24X7`
`SPUR_FEEDS`
`MANDIANT_ASM_ENTITY`
`MANDIANT_ASM_ISSUE`
`MANDIANT_ASM_TECHNOLOGY`
`MA_SV`
`CISCO_STADIUMVISION`
`CHECKPOINT_CLOUDGUARD`
`CHECKPOINT_GAIA`
`IONIX`
`MPR_SALT_DISCOVERY`
`MPR_SALT_THREAT_PROTECTION`
`MPR_SALT_POSTURE_MANAGEMENT`
`MPR_SALT_INCIDENT_RESPONSE`
`NETAPP_BLUEXP`
`SENTINELONE_ACTIVITY`
`TRENDMICRO_DDI`
`VELOCIRAPTOR`
`EPIC`
`HL7`
`MIRTH_NEXTGEN`
`OSCAR_CLAIMS`
`ACCENTURE_NEWSKIES`
`ACCENTURE_MXDR_MONITORING`
`AET_PRIVATE_ID`
`ANDERSONS_LTAS_ERROR`
`ANDERSONS_LMS_ERROR`
`ANDERSONS_RMS_ERROR`
`ARGYLE_CONSOLE_AUTH`
`ARGYLE_JWT_TOKEN_AUDIT`
`ACNMDREUSHNHP9KKH_E5`
`ACNMDREUSHNHP9KKH_MOBIFY`
`ACNMDREUSHNHP9KKH_RMS`
`ACNMDREUSHNHP9KKH_SHOPIFY`
`ACNMDREUSHNHP9KKH_TALEND`
`ACNMDREUSHNHP9KKH_TERADATA`
`ACNMDREUSHNHP9KKH_TRMS`
`AIS_SURGICAL_SCHEDULER`
`AIS_AT_APPLICATIONS`
`AIS_CARE_ID`
`MISSION_CONTROL_PROD`
`MISSION_CONTROL_NON_PROD`
`ALLIANZ_ACM_ARISTOTE`
`ALLIANZ_ACM_GNP3`
`ALLIANZ_ACM_MARS`
`ALLIANZ_ARKADE_NOVA`
`ALLIANZ_UNITY`
`ALLIANZ_BKV_ONLINE`
`ALLIANZ_FASTNET3`
`ALLIANZ_MEINGELD`
`ALLIANZ_MEWV2`
`ALLIANZ_VOICETRUST_SERVER`
`ALLIANZ_ESET_ERA`
`ALLIANZ_HITACHI_HDS`
`BKLPK_SAST`
`BAND_ASTERISK`
`BAND_BACKOFFICE`
`BAND_EVS_DASHBOARD`
`BAND_IRIS_WEB_PORTAL`
`BAND_ONE_ID`
`BAND_WCS`
`BAND_VCC`
`BBVA_ABACO`
`BBVA_ABACO_CIB`
`BBVA_ALHAMBRA`
`BBVA_ALTAMIRA`
`BBVA_APIMARKET`
`BBVA_ASO_SECURITY_ECS`
`BBVA_API_GW`
`BBVA_ATM_SOC_MX`
`BBVA_AZURE_MONITOR`
`BBVA_BASTIONADO`
`BBVA_BBDD_SIGA`
`BBVA_BIA`
`BBVA_CAD`
`BBVA_CARGAS_MASIVAS`
`BBVA_CALYPSO`
`BBVA_CHECKER_OB`
`BBVA_CHIMERA`
`BBVA_CUSTODIA`
`BBVA_CREDIT_VW`
`BBVA_CREDIT`
`BBVA_CRYPTO`
`BBVA_CSDS`
`BBVA_DATIO_CROSSDATA`
`BBVA_DATIO_DASHA`
`BBVA_DATIO_DATAPROC`
`BBVA_DATIO_ISILON`
`BBVA_DATIO_TP`
`BBVA_DIALOGO`
`BBVA_DIMENSIONS`
`BBVA_DIMENSION_FACTORING`
`BBVA_DOCUMENT_AI`
`BBVA_ESCENARIOS_COMERCIALES`
`BBVA_EJPF`
`BBVA_ENTITY_CONTEXT`
`BBVA_ENZI`
`BBVA_EREX`
`BBVA_ERM`
`BBVA_EOSP`
`BBVA_EXOP`
`BBVA_EYSP`
`BBVA_FRM`
`BBVA_FILECHANNEL`
`BBVA_GAE_LOGS`
`BBVA_GARANCY`
`BBVA_GIAM`
`BBVA_GOCD`
`BBVA_GSI`
`BBVA_GSUITE_AUDIT`
`BBVA_IFRS9`
`BBVA_IVANTI_MX`
`BBVA_INTELLIGENT_EXTRACT`
`BBVA_INFORMATICA`
`BBVA_KEOF_SELFIA`
`BBVA_KEFC`
`BBVA_KETQ`
`BBVA_KPMG_APP`
`BBVA_MAXMISTRAL`
`BBVA_MIDAS`
`BBVA_MUREX3`
`BBVA_NAUTHILUS_IDP`
`BBVA_NEMESIS`
`BBVA_NOTAS_CONTABLES`
`BBVA_NEOCON`
`BBVA_NETBACKUP`
`BBVA_ONE_BANK`
`BBVA_PFD`
`BBVA_RIC`
`BBVA_SAFEGUARD`
`BBVA_SAP_ACOGE`
`BBVA_SAP_GPS`
`BBVA_SBM`
`BBVA_SCAN`
`BBVA_SCCM`
`BBVA_SEBASSHTIAN`
`BBVA_SILEASING`
`BBVA_SIOP`
`BBVA_SLOD`
`BBVA_STAR`
`BBVA_SURF`
`BBVA_SWIFT_CMD_MX`
`BBVA_SWIFT_HO`
`BBVA_UBIX`
`BBVA_UDM`
`BBVA_WALLSTREET`
`BBVA_WINDOWS`
`INFORMATICA`
`ION_SPECTRUM`
`BNT_AUDITLOG_TANDEM`
`BNT_TANDEM`
`BCKMR_ATLANTIS`
`BCKMR_PLATFORM_ACTIVITY_LOGS`
`BLSFY003_ORCHESTRATION_API`
`BEARTRAP`
`BLOCKDAEMON_WEBAPP`
`BLOCKDAEMON_NODEQ`
`BRDCM_VMW_ACCESS_NOW`
`BRDCM_VMW_APP_CATALOG`
`BRDCM_VMW_ARCTIC_VCENTER`
`BRDCM_VMW_BIT9`
`BRDCM_VMW_BUILD`
`BRDCM_VMW_CB_AUDIT`
`BRDCM_VMW_CB_CLOUD`
`BRDCM_VMW_CB_HEDR`
`BRDCM_VMW_CB_REPUTATION`
`BRDCM_VMW_CLOUD`
`BRDCM_VMW_CLOUD_DIRECTOR`
`BRDCM_VMW_CLOUD_MARKET`
`BRDCM_VMW_CLOUD_PARTNER_NAVIGATOR`
`BRDCM_VMW_COMMERCE_PORTAL`
`BRDCM_VMW_CSP`
`BRDCM_VMW_DEVELOPER_PLATFORM`
`BRDCM_VMW_EXTENSIBLE_SERVICE_PLATFORM`
`BRDCM_VMW_FEEDBACK`
`BRDCM_VMW_LASTLINE_GCP`
`BRDCM_VMW_LEARNING_PLATFORM`
`BRDCM_VMW_LUMBERJACK`
`BRDCM_VMW_MDAM`
`BRDCM_VMW_PARTNER_HUB`
`BRDCM_VMW_PERFORCE`
`BRDCM_VMW_REVIEW_BOARD`
`BRDCM_VMW_STACKSTORM`
`BRDCM_VMWARE_TANZU_MISSION_CONTROL`
`BRDCM_VMWARE_TANZU_SERVICE_MESH`
`BRDCM_VMWARE_TANZU_WAVEFRONT`
`BRDCM_VMW_VERIFICATION_SERVICE`
`BRDCM_VMW_VRLI`
`BRDCM_VMW_WS1_ACCESS`
`BT_ITAM`
`BT_LUMAX`
`BT_PANOPTICON`
`BMS_BULLSEQUANA_S`
`CYDMAN_CHATGPT_COMPLIANCE_LOGS`
`CFPFZ_EDWARDS_CDATA_ARC`
`CACU_DASHVAULT`
`WPPCBR_COUNTERCEPT_INCIDENTS`
`COHERE_CUSTOM`
`CHRCL_USERS`
`CHRLT_COMMUNITY_HONEY_NETWORK`
`NLNT002_COMM_BAE_SLOAN`
`NLNT002_MMA_MANAGE_MY_ACCOUNT`
`COG_XML`
`JUMP_CMD_REPLACEMENT`
`CME_INTERNAL_APPS`
`CLD_BIZTALK`
`CLD_DCCP_INTEGRATION`
`CLD_DCCP_WEBOPS`
`CLD_HTTPERR`
`CLD_MIASMA_SECRET_SCANNER`
`CLD_CLOUDBEES`
`CLOUDFLARE_SPECTRUM`
`CLD_LAUNCHDARKLY`
`CLD_AZURE_FRONT_DOOR`
`CLD_ORACLE_FUSION`
`CLD_WEBOPS_LICENSING`
`CLD_WEBOPS_LOG4NET`
`CLD_WEBOPS_MYCTX`
`CMMRZ_ACTIMIZE`
`CMMRZ_CAF`
`CMMRZ_CALYPSO`
`CMMRZ_EASYMATCH`
`CMMRZ_GRM_CC`
`CMMRZ_FAMOS`
`CMMRZ_GNRSAPR`
`CMMRZ_GTSNET`
`CMMRZ_HITACHI_STORAGE`
`CMMRZ_HUAWEI_STORAGE`
`CMMRZ_JGPS`
`CMMRZ_LOAN_IQ`
`CMMRZ_MISYS`
`CMMRZ_MUREXEQUITIES`
`CMMRZ_NETAPP_FILER`
`CMMRZ_ORACLE_AUDIT`
`CMMRZ_ORACLE_FINANCIALS`
`CMMRZ_PELICANOFAC`
`CMMRZ_PHOENIX`
`CMMRZ_POSTFIX_DKIMPROXY`
`CMMRZ_POSTFIX_SPAMD`
`CMMRZ_POSTFIX_SQLGREY`
`CMMRZ_VMS`
`CMMRZ_PRIVILEGED_USER_IMPORT`
`CMMRZ_REMIT`
`CMMRZ_SAP_CREDIT`
`CMMRZ_SAP_SQLANYWHERE`
`CMMRZ_SETROPTS_LIST_IMPORT`
`CMMRZ_STB`
`CMMRZ_STB_REPORTER`
`CMMRZ_STERIA_LIQUIDITY_SUITE`
`CMMRZ_SYBASE`
`CMMRZ_TBEN_USER_IMPORT`
`CMMRZ_ZOS_PRIVUSER`
`CMMRZ_ZOS_SETROPS`
`CMMRZ_ZOS_TBENUSER`
`CTS_ONLINE_BANKING_LOGIN`
`CWT_AQUA`
`CWT_BOOK2GO`
`CWT_CCRECON`
`CWT_CIP`
`CWT_CXP`
`CWT_FINANCE`
`CWT_GLOBAL_MATRIX`
`CWT_GPM`
`CWT_MDF`
`CWT_MYCWTCHINA_OBT`
`CWT_MYCWT_MOBILE`
`CWT_MYCWT_WEB`
`CWT_NDC`
`CWT_OCI_AUDIT`
`CWT_OCI_SERVICE`
`CWT_PORTRAIT`
`CWT_POWER_BASE`
`CWT_POWER_EXPRESS`
`CWT_POWER_HOTEL`
`CWT_POWER_LIBRARY`
`CWT_POWER_TURBO`
`CWT_POWER_VAULT`
`CWT_PROTEGRITY`
`CWT_ROOMIT`
`CWT_SATOTRAVEL_FORMS`
`CWT_SATOVACATIONS`
`CWT_SATOVACATIONSEUROPE`
`CWT_SCA`
`CWT_TEAMMATE`
`CWT_TRAVCOM`
`CWT_VACATIONS`
`CWT_VERINT`
`CWT_WINGS`
`CWT_WORLDSPAN`
`CWT_YEEGO`
`PLUMDINGO_SELECT`
`CYDQSTRADE_QUESTRADE`
`CYDQSTRADE_SFE`
`CYDERES_IOC`
`IDME_WALLET`
`IDME_VERIFICATION`
`IDME_SUPPORT`
`IDME_REFEREE`
`IDME_OBLITERATE_SERVICE`
`IDME_MGM`
`IDME_IPS`
`IPFIRE`
`IDME_INTELLIGENCE`
`IDME_IDP`
`IDME_IDENTITY`
`IDME_GATEWAY`
`IDME_FRAUD`
`IDME_EVENTS_API`
`IDME_ENCRYPTION`
`IDME_DISNEY`
`IDME_DEVELOPER`
`IDME_CORE_API`
`IDME_AUTHORITY`
`IDME_ARCS`
`IDME_ADMIN`
`IDME_ACCOUNT`
`IDME_PEXIP`
`DHCTSAND_SOLARIS`
`EGSEQUINIX_CMT`
`ENUF_DERIVED`
`ENUF_IDAAS`
`ENUF_KRS`
`ENUF_OCSP`
`ENUF_POSTGRES`
`ENUF_SECURITY_MGR`
`ENTR_KCAAS`
`DQM`
`EQUIMAPS`
`EQIX_METAL_API`
`EUZEO_RBAC_PROVISION_MANAGER`
`EUZEO_RBAC_UNITY`
`ETSY_ASSET_LOGS`
`ETSY_WEB_LOGS`
`ENGELVOLKERS_JAMF_WANDERA`
`FLGST_ALTERYX`
`FLGST_APEX`
`FLGST_COGNOS`
`FLGST_TABLEAU`
`FLGST_FILENET_P8`
`FLGST_FINTRAC`
`FLGST_KOFAX`
`FLGST_MORTRAC`
`FLGST_PARADATEC`
`FLGST_WARLOC`
`FLGST_SERVICING_FTP`
`FLGST_SERVICING_IMGPROC`
`FLGST_WEBPORTAL`
`FORM3_CODE_INSIGHT`
`F9_VCC_FDM`
`FLCV_BO_PIC`
`GC_ASAWEB`
`GC_BADSVC`
`GC_BBSWRK`
`GC_BINDINGRESTRICTIONS`
`GC_CLMIDS`
`GC_CAASIM`
`GC_CAMSIM`
`GC_CHTAPI`
`GC_CLFEDS`
`GC_CLMERS`
`GM_CMMING`
`GC_CMMCTL`
`GC_CMMEML`
`GC_COMMKT`
`GC_DOTCOM`
`GC_DRSPRD`
`GC_DRSFUN`
`GC_EOORC`
`GC_EODOC`
`GC_EPPAKS`
`GC_FASAKS`
`GC_FORMSNET`
`GC_FRMSVC`
`GC_HUT8WEB`
`GC_INJBIP`
`GC_INJTAK`
`GC_INJURYPROCESSING`
`GC_MKTTSV`
`GC_NBAFAP`
`GC_NGSARM`
`GC_PHNAPI`
`GC_RATABASEAPP`
`GC_RGTAPI`
`GC_SLFNAS`
`GC_SLVWAS`
`GC_SSPKCL`
`GC_TBSREN`
`GC_TBSCEP`
`GC_TELDCS`
`GC_UWSORT`
`GIS_DOCAUTH`
`GCSOC2PRD_GOVTECH_CATCHALL`
`GCSOC2PRD_GOVTECH_LAW_WINEVTLOG`
`GCSOC2PRD_GOVTECH_LAW_WINDOWS_DNS`
`GCSOC2PRD_GOVTECH_LAW_AZURE_NSG_FLOW`
`GCSOC2PRD_GOVTECH_LAW_AZURE_GATEWAY`
`GCSOC2PRD_GOVTECH_LAW_AZURE_FRONT_DOOR`
`GCSOC2PRD_GOVTECH_LAW_MICROSOFT_DEFENDER_CLOUD_ALERTS`
`GCSOC2PRD_GOVTECH_LAW_AZURE_FIREWALL`
`GCSOC2STG_GOVTECH_LAW_WINEVTLOG`
`GCSOC2STG_GOVTECH_LAW_WINDOWS_DNS`
`GCSOC2STG_GOVTECH_LAW_AZURE_NSG_FLOW`
`GCSOC2STG_GOVTECH_LAW_AZURE_GATEWAY`
`GCSOC2STG_GOVTECH_LAW_AZURE_FRONT_DOOR`
`GCSOC2STG_GOVTECH_LAW_MICROSOFT_DEFENDER_CLOUD_ALERTS`
`GCSOC2STG_GOVTECH_LAW_AZURE_FIREWALL`
`HK_H3C_WIRELESS`
`HOLALUZ_COREAPP`
`HYPER_INFINITY_USER_CONTEXT`
`IRONMOUNTAIN_SECURESYNC`
`IRONMOUNTAIN_ONEIL`
`IRM_INSIGHT`
`JET_AIRBUS_320`
`JET_AIRBUS_220_ANS`
`JET_AIRBUS_220_CMS`
`JET_AIRBUS_220_HMU`
`JET_AIRBUS_220_IMS`
`KRGR_EASYFILL_PHARMACY`
`KRGR_STRATUS`
`LG_KEYFACTOR`
`LENDBUZZ_JAMF`
`LENDBUZZ_CROWDSTRIKE`
`LFE_HULK`
`LFE_INEO`
`MAGGIO_APP_LAV`
`MED_REST_API_AUDIT`
`MB_ABUSE`
`MC_SHERIFF`
`ML002_GIFT_CARD`
`ML002_HONEYPOT`
`MOOM_AMUI_IAM`
`MOOM_SDR`
`MOOM_WEBBILLPAY`
`MONTA_WAREHOUSE`
`MTSBS_CISCO_ASA_FIREWALL_MMTH`
`MT_APPLIED_MENDIX`
`MT_APPLIED_PRINT`
`MT_RESCALE_HPC`
`MY_BECI`
`NTHRP_ANT_DETECTION_SUMMARY`
`NCR_CURRENCY`
`NCR_DIGITAL_INSIGHT_CAS`
`NCR_DIGITAL_USP`
`NCR_ETL`
`NCR_GSDB`
`NCR_ISDMS`
`NCR_ITPPM`
`NCR_MCAD_PDM`
`NCR_PWD_MGR`
`NCR_STAR_JIRA`
`NETENRICH_ASE`
`NOMI_BRIDGEKEEPER`
`NTR_ASSET_CONTEXT`
`NYK_DAM_TRANSACT`
`NINENOW_AUDIT`
`HANNA_KASEYA_IT_GLUE`
`KNRTH_COMMONFATE`
`OHIODAS_AVEPOINT_FOR_M365`
`PARXL_MERAKI_CLOUD`
`PINKUNICORN_H2_BAS`
`PINKUNICORN_H2_CHANNEL`
`PRISMA_SD_WAN`
`PRMTH_FIRSTIQ`
`PRMTH_PWSS`
`RAL_IOC`
`RAMP_BOA`
`RENAULT_CGW`
`RENAULT_IRN_74011`
`RENAULT_IRN_55386`
`RENAULT_IRN_71123`
`RENAULT_IRN_PROXYINETJSON`
`RENAULT_IRN_69476`
`RENAULT_IRN_70535`
`RENAULT_IRN_68712`
`RENAULT_IVC1`
`RENAULT_IVC2`
`RENAULT_IVI2`
`RENAULT_IRN_7052`
`RENAULT_IRN_66421`
`RENAULT_IRN_69207`
`RENAULT_IRN_6889`
`RENAULT_SGW`
`RENAULT_IRN_70759`
`RENAULT_IRN_74898`
`RENAULT_IRN_73882`
`RENAULT_IRN_72284`
`RENAULT_IRN_74143`
`RENAULT_IRN_70132`
`RENAULT_IRN_50567`
`RENAULT_IRN_8185`
`RENAULT_IRN_77153`
`RENAULT_IRN_67551`
`RENAULT_IRN_73940`
`RENAULT_IRN_75039`
`RENAULT_IRN_69293`
`RENAULT_IRN_74601`
`RQJVFQZC_XTON_PAM`
`RQIHENBY_SRE_LICENSING`
`RQIHENBY_LOGSTASH`
`RQ5XB66T_PINGCAP_TIDB_DB_AUDIT`
`ALICLOUD_ACTIONTRAIL`
`NTTDT001_SAP_ETD`
`SHOPIFY_SANTA_FAA`
`SLB_FRIEND_LOGS`
`SCHWAB_ASSETS`
`SCHWAB_ET_RULES`
`SCHWAB_IDENTITIES`
`SCHWAB_RRBUS`
`SCHWAB_SDS_INSIGHTS`
`SITEMINDER_CM`
`SITEMINDER_LH`
`SITEMINDER_NEXUS`
`SITEMINDER_PAY`
`SITEMINDER_MFA`
`SITEMINDER_PMSX`
`SML_SITEMINDER_PP`
`SITEMINDER_PP`
`SITEMINDER_TBB`
`SLB_GEMS_AUDIT`
`SLB_INTOUCH`
`SLB_FDP`
`SLB_FMP`
`SLB_BI_EDW`
`SLSFR_DATA_SCIENCE`
`SLSFR_HELIX_CORE`
`SNF_SANOFI_FORENSICS`
`SNF_FORENSIC_MFT`
`SNF_FORENSIC_EVTX`
`SNF_FORENSIC_PREFETCH`
`SNF_FORENSIC_HAYABUSA`
`SNF_FORENSIC_AUTORUNS`
`SPO_SERVICE_DISCOVERY`
`SPO_ACCESS_PROXY`
`SPO_AUDITBEAM`
`SPO_BACKSTAGE`
`SPO_BANDMANAGER`
`SPO_DNS_RESOLVER`
`SPO_SECCOLLECTOR`
`SPO_TALOS`
`STUDENT_01`
`STUDENT_02`
`STUDENT_03`
`STUDENT_04`
`STUDENT_05`
`STUDENT_06`
`STUDENT_07`
`STUDENT_08`
`STUDENT_09`
`STUDENT_10`
`STUDENT_11`
`STUDENT_12`
`STUDENT_13`
`STUDENT_14`
`STUDENT_15`
`STUDENT_16`
`STUDENT_17`
`STUDENT_18`
`STUDENT_19`
`STUDENT_20`
`STUDENT_21`
`STUDENT_22`
`STUDENT_23`
`STUDENT_24`
`STUDENT_25`
`STUDENT_26`
`STUDENT_27`
`STUDENT_28`
`STUDENT_29`
`STUDENT_30`
`SHOPIFY_APV`
`SHOPIFY_CMDB`
`SHOPIFY_CLOUD_PORTAL`
`SHOPIFY_CUSTOM`
`SHOPIFY_DEVICE`
`SHOPIFY_DOCUSIGN`
`SHOPIFY_GENEA`
`SHOPIFY_GPT`
`SHOPIFY_KAFKA`
`SHOPIFY_MODE`
`SHOPIFY_MONORAIL`
`SHOPIFY_MINERVA`
`SHOPIFY_PROTON`
`SHOPIFY_PT_UE`
`SHOPIFY_RAILS`
`SHOPIFY_SANTA`
`SHOPIFY_SECURITY_AUDITOR`
`SHOPIFY_SENSHOP`
`SHOPIFY_SVC_INT`
`SHOPIFY_SVC_INT_2`
`SHOPIFY_TOKEN`
`SHOPIFY_TUPLE`
`SHOPIFY_VAULT`
`STARLING_ARCV2`
`SRVNF_FORCEPOINT_BITGLASS`
`STCKM_SM_HEARTBEAT`
`STCKN_SM_HEARTBEAT`
`SRMGMBH_ADMIN_PROXY`
`SYTMEIS_ADMIN_PROXY`
`TPXBL_SERVICE_DESK_PLUS`
`TELEPASS_WINEVTLOG`
`TEMPEST_CUSTOM`
`TTM_TRIO_CHORDIANT`
`TTM_ONESYS`
`THENT_THENTIA_APP`
`UCR_MYACCOUNT`
`UNICO_AUTO`
`UNICO_CHECK`
`UNICO_CHECK_LEGACY`
`UNICO_COFRE`
`UNICO_DOC`
`UNICO_HODOR`
`UNICO_IDENTITY`
`UNICO_IDPAY`
`UNICO_KEYCLOACK`
`UNICO_PEOPLE`
`UNICO_SIGN`
`UNICO_SKILL`
`UNICO_TECH`
`UNICO_YOU`
`VCTR727_AURUS`
`VZ_NSIHOSTING_N3SV`
`VUHL_BREAKING_GLASS`
`VMO2_ERICSSON_ALOG`
`VMO2_ERICSSON_TSP`
`VMO2_NOKIA_SLNBI`
`WELLS_EMON`
`WELLS_TSC`
`WF_MITRE_MAPPING`
`SAMC_DIGITAL_PHARMACY`
`VANGUARD_ACTIVE_ALERTS`
`VIRUSTOTAL_FILE_METADATA`
`WMT_AZURE_AD`
`WMT_DREAM`
`WMT_AZURE_AD_AUDIT`
`WMT_APPVAULT`
`WMT_ARKENSTONE`
`WMT_BANHAMMER`
`WMT_BOSS`
`WMT_CAAS`
`WMT_CASSANDRA_ARKENSTONE`
`WMT_CHATGPT`
`WMT_CLOUD_UNIX`
`WMT_COMPLIANCE`
`WMT_CONCORD`
`WMT_CONNEXUS`
`WMT_CUSTOM_1`
`WMT_CUSTOM_2`
`WMT_CUSTOM_3`
`WMT_DB2`
`WMT_DIGITAL_PHARMACY_IVR`
`WMT_EJBCA`
`WMT_GENERIC`
`WMT_GENAI`
`WMT_GITHUB`
`WMT_ESTAR`
`WMT_HELPDESKCHAT`
`WMT_HIPAA_AUDIT`
`WMT_IAM`
`WMT_IOC_FEED`
`WMT_LOOPER`
`WMT_LUNA_HSM`
`WMT_MXAPP`
`WMT_ONPREM_UNIX`
`WMT_P2PE`
`WMT_POS_FIM`
`WMT_POWER_BI`
`WMT_RAPTR`
`WMT_RLSOLUTION`
`WMT_SPARTAN`
`WMT_SCAN_AND_GO`
`WMT_SIM_CLOG`
`WMT_SIM_FLOG`
`WMT_SIM_SLOG`
`WMT_SOX_JDE`
`WSGC_ECOM`
`WMT_SPARKDRIVER`
`WMT_SSHD`
`WMT_SAMP`
`WMT_TENCENT`
`WMT_TERADATA`
`WMT_TORBIT_ODND`
`WMT_TRACK`
`WMT_TRAVEL_MONITOR`
`WMT_UDP_WORKBENCH`
`WMT_UEBA_MODELS`
`WMT_UNIX_AUTH`
`WMT_VDI`
`WMT_VIVALDI`
`WMT_WCNP_HIPAA`
`WMT_WCNP_PCI_APPS`
`WMT_WCNP_APPS`
`WMT_WCNP_APP_HIPAA`
`WMT_MILLIWAYS_EVE`
`WMT_PEANUT_BUTTER`
`WMT_APIPROXY`
`WMT_FALCON_SSO`
`WMT_COWM`
`WMT_MEMBERSHIP_EXPRESS`
`WSI_OAUTH`
`CYBERSHIELD_CATCH_ALL`
`CYBERSHIELD_LINUX_SERVER_DEV`
`CYBERSHIELD_SAMOOR`
`CYBERSHIELD_SECAUTO_AUDIT`
`NO_PRODUCT_SOURCE`
`NO_EXTERNAL`
`RESERVED_LOG_TYPE_1`
`RESERVED_LOG_TYPE_2`
`RESERVED_LOG_TYPE_3`
`RESERVED_LOG_TYPE_4`
`RESERVED_LOG_TYPE_5`
`RESERVED_LOG_TYPE_6`
`RESERVED_LOG_TYPE_7`
`RESERVED_LOG_TYPE_8`
`RESERVED_LOG_TYPE_9`
`RESERVED_LOG_TYPE_10`
`RESERVED_LOG_TYPE_11`
`RESERVED_LOG_TYPE_12`
`RESERVED_LOG_TYPE_13`
`RESERVED_LOG_TYPE_14`
`RESERVED_LOG_TYPE_15`
`RESERVED_LOG_TYPE_16`
`RESERVED_LOG_TYPE_17`
`RESERVED_LOG_TYPE_18`
`RESERVED_LOG_TYPE_19`
`RESERVED_LOG_TYPE_20`
`RESERVED_LOG_TYPE_21`
`RESERVED_LOG_TYPE_22`
`RESERVED_LOG_TYPE_23`
`RESERVED_LOG_TYPE_24`
`RESERVED_LOG_TYPE_25`
`RESERVED_LOG_TYPE_26`
`RESERVED_LOG_TYPE_27`
`RESERVED_LOG_TYPE_28`
`RESERVED_LOG_TYPE_29`
`RESERVED_LOG_TYPE_30`
`RESERVED_LOG_TYPE_31`
`RESERVED_LOG_TYPE_32`
`RESERVED_LOG_TYPE_33`
`RESERVED_LOG_TYPE_34`
`RESERVED_LOG_TYPE_35`
`RESERVED_LOG_TYPE_36`
`RESERVED_LOG_TYPE_37`
`RESERVED_LOG_TYPE_38`
`RESERVED_LOG_TYPE_39`
`RESERVED_LOG_TYPE_40`
`RESERVED_LOG_TYPE_41`
`RESERVED_LOG_TYPE_42`
`RESERVED_LOG_TYPE_43`
`RESERVED_LOG_TYPE_44`
`RESERVED_LOG_TYPE_45`
`RESERVED_LOG_TYPE_46`
`RESERVED_LOG_TYPE_47`
`RESERVED_LOG_TYPE_48`
`RESERVED_LOG_TYPE_49`
`RESERVED_LOG_TYPE_50`
`LT_1`
`LT_2`
`LT_3`
`LT_4`
`LT_5`
`LT_6`
`LT_7`
`LT_8`
`LT_9`
`LT_10`
`LT_11`
`LT_12`
`LT_13`
`LT_14`
`LT_15`
`LT_16`
`LT_17`
`LT_18`
`LT_19`
`LT_20`
`LT_21`
`LT_22`
`LT_23`
`LT_24`
`LT_25`
`LT_26`
`LT_27`
`LT_28`
`LT_29`
`LT_30`
`LT_31`
`LT_32`
`LT_33`
`LT_34`
`LT_35`
`LT_36`
`LT_37`
`LT_38`
`LT_39`
`LT_40`
`LT_41`
`LT_42`
`LT_43`
`LT_44`
`LT_45`
`LT_46`
`LT_47`
`LT_48`
`LT_49`
`LT_50`
`LT_51`
`LT_52`
`LT_53`
`LT_54`
`LT_55`
`LT_56`
`LT_57`
`LT_58`
`LT_59`
`LT_60`
`LT_61`
`LT_62`
`LT_63`
`LT_64`
`LT_65`
`LT_66`
`LT_67`
`LT_68`
`LT_69`
`LT_70`
`LT_71`
`LT_72`
`LT_73`
`LT_74`
`LT_75`
`LT_76`
`LT_77`
`LT_78`
`LT_79`
`LT_80`
`LT_81`
`LT_82`
`LT_83`
`LT_84`
`LT_85`
`LT_86`
`LT_87`
`LT_88`
`LT_89`
`LT_90`
`LT_91`
`LT_92`
`LT_93`
`LT_94`
`LT_95`
`LT_96`
`LT_97`
`LT_98`
`LT_99`
`LT_100`
`LT_101`
`LT_102`
`LT_103`
`LT_104`
`LT_105`
`LT_106`
`LT_107`
`LT_108`
`LT_109`
`LT_110`
`LT_111`
`LT_112`
`LT_113`
`LT_114`
`LT_115`
`LT_116`
`LT_117`
`LT_118`
`LT_119`
`LT_120`
`LT_121`
`LT_122`
`LT_123`
`LT_124`
`LT_125`
`LT_126`
`LT_127`
`LT_128`
`LT_129`
`LT_130`
`LT_131`
`LT_132`
`LT_133`
`LT_134`
`LT_135`
`LT_136`
`LT_137`
`LT_138`
`LT_139`
`LT_140`
`LT_141`
`LT_142`
`LT_143`
`LT_144`
`LT_145`
`LT_146`
`LT_147`
`LT_148`
`LT_149`
`LT_150`
`LT_151`
`LT_152`
`LT_153`
`LT_154`
`LT_155`
`LT_156`
`LT_157`
`LT_158`
`LT_159`
`LT_160`
`LT_161`
`LT_162`
`LT_163`
`LT_164`
`LT_165`
`LT_166`
`LT_167`
`LT_168`
`LT_169`
`LT_170`
`LT_171`
`LT_172`
`LT_173`
`LT_174`
`LT_175`
`LT_176`
`LT_177`
`LT_178`
`LT_179`
`LT_180`
`LT_181`
`LT_182`
`LT_183`
`LT_184`
`LT_185`
`LT_186`
`LT_187`
`LT_188`
`LT_189`
`LT_190`
`LT_191`
`LT_192`
`LT_193`
`LT_194`
`LT_195`
`LT_196`
`LT_197`
`LT_198`
`LT_199`
`LT_200`
`LT_201`
`LT_202`
`LT_203`
`LT_204`
`LT_205`
`LT_206`
`LT_207`
`LT_208`
`LT_209`
`LT_210`
`LT_211`
`LT_212`
`LT_213`
`LT_214`
`LT_215`
`LT_216`
`LT_217`
`LT_218`
`LT_219`
`LT_220`
`LT_221`
`LT_222`
`LT_223`
`LT_224`
`LT_225`
`LT_226`
`LT_227`
`LT_228`
`LT_229`
`LT_230`
`LT_231`
`LT_232`
`LT_233`
`LT_234`
`LT_235`
`LT_236`
`LT_237`
`LT_238`
`LT_239`
`LT_240`
`LT_241`
`LT_242`
`LT_243`
`LT_244`
`LT_245`
`LT_246`
`LT_247`
`LT_248`
`LT_249`
`LT_250`
`LT_251`
`LT_252`
`LT_253`
`LT_254`
`LT_255`
`LT_256`
`LT_257`
`LT_258`
`LT_259`
`LT_260`
`LT_261`
`LT_262`
`LT_263`
`LT_264`
`LT_265`
`LT_266`
`LT_267`
`LT_268`
`LT_269`
`LT_270`
`LT_271`
`LT_272`
`LT_273`
`LT_274`
`LT_275`
`LT_276`
`LT_277`
`LT_278`
`LT_279`
`LT_280`
`LT_281`
`LT_282`
`LT_283`
`LT_284`
`LT_285`
`LT_286`
`LT_287`
`LT_288`
`LT_289`
`LT_290`
`LT_291`
`LT_292`
`LT_293`
`LT_294`
`LT_295`
`LT_296`
`LT_297`
`LT_298`
`LT_299`
`LT_300`
`LT_301`
`LT_302`
`LT_303`
`LT_304`
`LT_305`
`LT_306`
`LT_307`
`LT_308`
`LT_309`
`LT_310`
`LT_311`
`LT_312`
`LT_313`
`LT_314`
`LT_315`
`LT_316`
`LT_317`
`LT_318`
`LT_319`
`LT_320`
`LT_321`
`LT_322`
`LT_323`
`LT_324`
`LT_325`
`LT_326`
`LT_327`
`LT_328`
`LT_329`
`LT_330`
`LT_331`
`LT_332`
`LT_333`
`LT_334`
`LT_335`
`LT_336`
`LT_337`
`LT_338`
`LT_339`
`LT_340`
`LT_341`
`LT_342`
`LT_343`
`LT_344`
`LT_345`
`LT_346`
`LT_347`
`LT_348`
`LT_349`
`LT_350`
`LT_351`
`LT_352`
`LT_353`
`LT_354`
`LT_355`
`LT_356`
`LT_357`
`LT_358`
`LT_359`
`LT_360`
`LT_361`
`LT_362`
`LT_363`
`LT_364`
`LT_365`
`LT_366`
`LT_367`
`LT_368`
`LT_369`
`LT_370`
`LT_371`
`LT_372`
`LT_373`
`LT_374`
`LT_375`
`LT_376`
`LT_377`
`LT_378`
`LT_379`
`LT_380`
`LT_381`
`LT_382`
`LT_383`
`LT_384`
`LT_385`
`LT_386`
`LT_387`
`LT_388`
`LT_389`
`LT_390`
`LT_391`
`LT_392`
`LT_393`
`LT_394`
`LT_395`
`LT_396`
`LT_397`
`LT_398`
`LT_399`
`LT_400`
`LT_401`
`LT_402`
`LT_403`
`LT_404`
`LT_405`
`LT_406`
`LT_407`
`LT_408`
`LT_409`
`LT_410`
`LT_411`
`LT_412`
`LT_413`
`LT_414`
`LT_415`
`LT_416`
`LT_417`
`LT_418`
`LT_419`
`LT_420`
`LT_421`
`LT_422`
`LT_423`
`LT_424`
`LT_425`
`LT_426`
`LT_427`
`LT_428`
`LT_429`
`LT_430`
`LT_431`
`LT_432`
`LT_433`
`LT_434`
`LT_435`
`LT_436`
`LT_437`
`LT_438`
`LT_439`
`LT_440`
`LT_441`
`LT_442`
`LT_443`
`LT_444`
`LT_445`
`LT_446`
`LT_447`
`LT_448`
`LT_449`
`LT_450`
`LT_451`
`LT_452`
`LT_453`
`LT_454`
`LT_455`
`LT_456`
`LT_457`
`LT_458`
`LT_459`
`LT_460`
`LT_461`
`LT_462`
`LT_463`
`LT_464`
`LT_465`
`LT_466`
`LT_467`
`LT_468`
`LT_469`
`LT_470`
`LT_471`
`LT_472`
`LT_473`
`LT_474`
`LT_475`
`LT_476`
`LT_477`
`LT_478`
`LT_479`
`LT_480`
`LT_481`
`LT_482`
`LT_483`
`LT_484`
`LT_485`
`LT_486`
`LT_487`
`LT_488`
`LT_489`
`LT_490`
`LT_491`
`LT_492`
`LT_493`
`LT_494`
`LT_495`
`LT_496`
`LT_497`
`LT_498`
`LT_499`
`LT_500`

ThreatCollectionType

Different Types of threat collections currently supported.

Enums
`THREAT_COLLECTION_TYPE_UNSPECIFIED`	Threat collection type is unspecified.
`CAMPAIGN`	Threat collection type is campaign.
`REPORT`	Threat collection type is report.
`OPERATION`	Threat collection type is operation.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌

MCP Tools Reference: chronicle.googleapis.com Stay organized with collections Save and categorize content based on your preferences.

Tool: get_ioc_match

Input Schema

GetIocMatchRequest

Output Schema

LegacySearchEnterpriseWideIoCsResponse

IoCDiscoveryInfo

ArtifactIndicator

FieldAndValue

AssetIndicator

Timestamp

FilterProperties

StringPropertiesEntry

StringValues

StringValue

AssociationIdentity

Location

LatLng

IntRange

IpAndPorts

DomainAndPorts

Interval

Link

ThreatCollectionItem

ValueType

EmptyAssetListReasonCode

IocState

Priority

AssociationType

LogType

ThreatCollectionType

Tool Annotations

MCP Tools Reference: chronicle.googleapis.com

Tool: `get_ioc_match`