--- url: https://docs.realmsec.info/integration.md --- # Integration Guide Connect Realm with your security tools, SIEMs, and data infrastructure. ## Sources Security products and platforms that send log data to Realm. | Integration | Description | |--------------------------------------------------------------|------------------------------------------------------| | [Abnormal Security](./abnormal) | Abnormal Security threat logs | | [Akamai ASEC](./akamai_asec) | Akamai Security Events via SIEM Integration API | | [Akamai ASEC CEF](./akamai_asec_cef) | Akamai Security Events via SIEM CEF Connector and Realm Collector | | [AWS ALB](./aws_alb_logs) | Application Load Balancer access logs via S3 and SQS | | [AWS CloudTrail](./aws_cloudtrail) | AWS CloudTrail logs via S3 and SQS | | [AWS VPC Flow Logs](./aws_vpc_flow_logs) | VPC Flow Logs via S3 and SQS | | [Azure Event Hub](./azure_eventhub) | Azure Event Hub as a source | | [Azure Blob Storage](./azure-blob-storage#azure-blob-storage-as-a-source) | Azure Blob Storage as a source | | [Checkpoint Firewall (CEF)](./checkpoint_firewall) | Checkpoint Firewall logs | | [Checkpoint Firewall (Splunk)](./checkpoint_firewall_splunk) | Checkpoint Firewall logs in Splunk format | | [Cisco Duo](./cisco_duo) | Cisco Duo authentication, administrator, and telephony logs | | [Cisco FTD/ASA](./cisco_firewall) | Cisco FTD/ASA logs | | [Cisco ISE](./cisco_ise) | Cisco ISE logs | | [Cisco Meraki Syslog](./cisco_meraki_syslog) | Cisco Meraki syslog logs | | [Cisco Meraki Webhook](./cisco_meraki_webhook) | Cisco Meraki Dashboard alerts via webhook | | [Cisco Umbrella](./umbrella) | Cisco Umbrella logs | | [Cloudflare WAF](./cloudflare) | Cloudflare logs | | [Corelight NDR](./corelight_ndr) | Corelight Network Detection and Response logs | | [CrowdStrike FDR](./crowdstrike) | CrowdStrike Falcon Data Replicator | | [Custom Application Logs: CEF](./cef) | Ingesting custom application logs in CEF format | | [Custom Application Logs: CSV](./csv) | Ingesting custom application logs in CSV format | | [Custom Application Logs: JSON](./json) | Ingesting custom application logs in JSON format | | [Custom Application Logs: Syslog](./syslog) | Ingesting custom application logs in Syslog format | | [CyberArk Privilege Cloud](./cyberark_privilege_cloud) | CyberArk Privilege Cloud audit logs | | [Fastly Next-Gen WAF](./fastly_nextgen_waf) | Fastly Next-Gen WAF request logs | | [Forcepoint NGFW](./forcepoint_ngfw) | Forcepoint NGFW firewall logs (CEF) | | [Fortigate](./fortigate) | Fortigate Firewall logs | | [FortiClient](./forticlient) | FortiClient logs via FortiAnalyzer | | [GCP Logs](./gcp_logs) | GCP logs via Pub/Sub | | [GitHub Audit Logs](./github_audit) | GitHub Enterprise audit logs | | [Google Workspace](./google_workspace) | Google Workspace logs | | [Imperva Cloud WAF](./imperva_cloud_waf) | Imperva Cloud WAF logs | | [Infoblox Threat Defense](./infoblox_threat_defense) | Infoblox logs | | [Infoblox NIOS](./infoblox) | Infoblox NIOS syslog via Realm Collector | | [Jenkins Audit Logs](./jenkins_audit_logs) | Jenkins audit logs via Audit Trail plugin | | [Jenkins Logs via OpenTelemetry](./jenkins_otlp) | Jenkins logs forwarded via OpenTelemetry | | [Linear Audit Logs](./linear_audit) | Linear workspace audit logs via webhook | | [Mimecast Email](./mimecast_email) | Mimecast email event logs | | [Netsuite Audit Logs](./netsuite_audit_logs) | Netsuite Audit logs | | [Okta](./okta) | Okta identity logs | | [Palo Alto Networks](./palo) | Palo Alto logs | | [Prisma Access](./prisma_access) | Prisma Access logs via Strata Logging Service | | [Proofpoint TAP](./proofpoint) | Proofpoint TAP email threat events | | [Radware CSMS DDOS](./radware-csms-ddos) | Radware CSMS DDOS logs | | [Radware WAF](./radware_waf) | Radware DefensePro logs | | [Salesforce Event Monitoring](./salesforce_event_monitoring) | Salesforce Event Monitoring logs | | [SentinelOne Deep Visibility](./sentinelone_deep_visibility) | SentinelOne Deep Visibility logs | | [SentinelOne CEF](./sentinelone) | SentinelOne Events | | [Snowflake Audit Logs](./snowflake-audit-logs) | Snowflake Audit Logs | | [SonicWall](./sonicwall) | SonicWall firewall logs | | [Stripe Activity Logs](./stripe_activity_logs) | Stripe account activity logs | | [Tailscale](./tailscale) | Tailscale logs | | [Windows Event Logs](./windows-event-logs) | Windows Event Logs | | [Wiz Audit Logs](./wiz-api) | Wiz API logs | | [Wiz Cloud Defender](./wiz-cloud-defender) | Wiz Cloud Defender events | | [Zscaler ZIA](./zscaler) | Zscaler NSS VM logs to Splunk | | [Zscaler NSS Cloud Sentinel](./zscaler_zia_nss_cloud_sentinel) | Zscaler NSS Cloud logs to Microsoft Sentinel | | [Zscaler NSS Cloud CrowdStrike](./zscaler_zia_nss_cloud_crowdstrike) | Zscaler NSS Cloud logs to CrowdStrike NG-SIEM/Falcon LogScale | | [Zscaler NSS Cloud Splunk](./zscaler_zia_nss_cloud_splunk) | Zscaler NSS Cloud logs to Splunk | | [Zscaler NSS VM Sentinel](./zscaler_zia_nss_vm_sentinel) | Zscaler NSS VM logs to Microsoft Sentinel | | [Zscaler ZPA](./zscaler_zpa) | Zscaler ZPA access and activity logs | ## Destinations SIEMs and data platforms Realm can forward enriched log data to. | Integration | Description | |---|---| | [AWS S3](./aws-s3) | S3 bucket (source or destination) | | [Azure Blob Storage](./azure-blob-storage#azure-blob-storage-as-a-destination) | Azure Blob Storage as a destination | | [CrowdStrike Next-Gen SIEM](./crowdstrike#crowdstrike-ngsiem-as-a-destination) | CrowdStrike Next-Gen SIEM as a destination | | [Databricks](./databricks) | Databricks via Zerobus Ingest| | [Elasticsearch](./elasticsearch) | Elasticsearch or AWS OpenSearch | | [Exabeam](./exabeam) | Exabeam SIEM | | [Google Cloud Storage](./gcs) | GCS bucket | | [Google SecOps](./google_secops) | Google SecOps | | [Hydrolix](./hydrolix) | Hydrolix Data Lake | | [Microsoft Sentinel](./ms-sentinel) | Microsoft Sentinel | | [Cortex XSIAM by Palo Alto](./palo_xsiam) | Cortex XSIAM | | [Panther SIEM](./panther) | Panther | | [Rapid7 InsightIDR](./rapid7_insightidr) | Rapid7 InsightIDR | | [Securonix](./securonix) | Securonix SIEM | | [Snowflake (Snowpipe)](./snowflake-snowpipe) | Snowflake via Snowpipe from cloud storage | | [Snowflake (Snowpipe Streaming)](./snowflake-snowpipe-streaming) | Snowflake via Snowpipe Streaming | | [Splunk](./splunk) | Splunk SIEM | | [Sumo Logic](./sumo) | Sumo Logic as a destination | ## Transport Methods How data moves between your infrastructure and Realm. | Method | Description | |---|---| | [AWS S3](./aws-s3) | S3 bucket (source or destination) | | [Azure Blob Storage](./azure-blob-storage) | Azure Storage Containers | | [Collector](./collector) | Realm on-premises data collector agent | | [Cloud HTTP (Webhook)](./cloud_http) | Cloud-managed HTTPS webhook endpoint; supported in [Custom CEF](./cef), [Custom CSV](./csv), [Custom JSON](./json) | | [Cloud OTLP](./cloud_otlp) | Cloud-managed OpenTelemetry (OTLP/HTTP) endpoint; supported in [Custom CEF](./cef), [Custom CSV](./csv), [Custom JSON](./json), [Custom Syslog](./syslog) | | [Cloud Syslog](./cloud_syslog) | Cloud-managed syslog endpoint | | [Rsyslog](./rsyslog) | Rsyslog log forwarding | | [Splunk HEC](./splunk-hec) | Splunk HTTP Event Collector | | [Sumo Logic](./sumo_s3) | Sumo Logic as a source |