Appearance
Integration Guide
Connect Realm with your security tools, SIEMs, and data infrastructure.
Sources
Security products and platforms that send log data to Realm.
| Integration | Description |
|---|---|
| Abnormal Security | Abnormal Security threat logs |
| Akamai ASEC | Akamai Security Events via SIEM Integration API |
| Akamai ASEC CEF | Akamai Security Events via SIEM CEF Connector and Realm Collector |
| AWS ALB | Application Load Balancer access logs via S3 and SQS |
| AWS CloudTrail | AWS CloudTrail logs via S3 and SQS |
| AWS VPC Flow Logs | VPC Flow Logs via S3 and SQS |
| Azure Event Hub | Azure Event Hub as a source |
| Azure Blob Storage | Azure Blob Storage as a source |
| Checkpoint Firewall (CEF) | Checkpoint Firewall logs |
| Checkpoint Firewall (Splunk) | Checkpoint Firewall logs in Splunk format |
| Cisco Duo | Cisco Duo authentication, administrator, and telephony logs |
| Cisco FTD/ASA | Cisco FTD/ASA logs |
| Cisco ISE | Cisco ISE logs |
| Cisco Meraki Syslog | Cisco Meraki syslog logs |
| Cisco Meraki Webhook | Cisco Meraki Dashboard alerts via webhook |
| Cisco Umbrella | Cisco Umbrella logs |
| Cloudflare WAF | Cloudflare logs |
| Corelight NDR | Corelight Network Detection and Response logs |
| CrowdStrike FDR | CrowdStrike Falcon Data Replicator |
| Custom Application Logs: CEF | Ingesting custom application logs in CEF format |
| Custom Application Logs: CSV | Ingesting custom application logs in CSV format |
| Custom Application Logs: JSON | Ingesting custom application logs in JSON format |
| Custom Application Logs: Syslog | Ingesting custom application logs in Syslog format |
| CyberArk Privilege Cloud | CyberArk Privilege Cloud audit logs |
| Fastly Next-Gen WAF | Fastly Next-Gen WAF request logs |
| Forcepoint NGFW | Forcepoint NGFW firewall logs (CEF) |
| Fortigate | Fortigate Firewall logs |
| FortiClient | FortiClient logs via FortiAnalyzer |
| GCP Logs | GCP logs via Pub/Sub |
| GitHub Audit Logs | GitHub Enterprise audit logs |
| Google Workspace | Google Workspace logs |
| Imperva Cloud WAF | Imperva Cloud WAF logs |
| Infoblox Threat Defense | Infoblox logs |
| Infoblox NIOS | Infoblox NIOS syslog via Realm Collector |
| Jenkins Audit Logs | Jenkins audit logs via Audit Trail plugin |
| Jenkins Logs via OpenTelemetry | Jenkins logs forwarded via OpenTelemetry |
| Linear Audit Logs | Linear workspace audit logs via webhook |
| Mimecast Email | Mimecast email event logs |
| Netsuite Audit Logs | Netsuite Audit logs |
| Okta | Okta identity logs |
| Palo Alto Networks | Palo Alto logs |
| Prisma Access | Prisma Access logs via Strata Logging Service |
| Proofpoint TAP | Proofpoint TAP email threat events |
| Radware CSMS DDOS | Radware CSMS DDOS logs |
| Radware WAF | Radware DefensePro logs |
| Salesforce Event Monitoring | Salesforce Event Monitoring logs |
| SentinelOne Deep Visibility | SentinelOne Deep Visibility logs |
| SentinelOne CEF | SentinelOne Events |
| Snowflake Audit Logs | Snowflake Audit Logs |
| SonicWall | SonicWall firewall logs |
| Stripe Activity Logs | Stripe account activity logs |
| Tailscale | Tailscale logs |
| Windows Event Logs | Windows Event Logs |
| Wiz Audit Logs | Wiz API logs |
| Wiz Cloud Defender | Wiz Cloud Defender events |
| Zscaler ZIA | Zscaler NSS VM logs to Splunk |
| Zscaler NSS Cloud Sentinel | Zscaler NSS Cloud logs to Microsoft Sentinel |
| Zscaler NSS Cloud CrowdStrike | Zscaler NSS Cloud logs to CrowdStrike NG-SIEM/Falcon LogScale |
| Zscaler NSS Cloud Splunk | Zscaler NSS Cloud logs to Splunk |
| Zscaler NSS VM Sentinel | Zscaler NSS VM logs to Microsoft Sentinel |
| Zscaler ZPA | Zscaler ZPA access and activity logs |
Destinations
SIEMs and data platforms Realm can forward enriched log data to.
| Integration | Description |
|---|---|
| AWS S3 | S3 bucket (source or destination) |
| Azure Blob Storage | Azure Blob Storage as a destination |
| CrowdStrike Next-Gen SIEM | CrowdStrike Next-Gen SIEM as a destination |
| Databricks | Databricks via Zerobus Ingest |
| Elasticsearch | Elasticsearch or AWS OpenSearch |
| Exabeam | Exabeam SIEM |
| Google Cloud Storage | GCS bucket |
| Google SecOps | Google SecOps |
| Hydrolix | Hydrolix Data Lake |
| Microsoft Sentinel | Microsoft Sentinel |
| Cortex XSIAM by Palo Alto | Cortex XSIAM |
| Panther SIEM | Panther |
| Rapid7 InsightIDR | Rapid7 InsightIDR |
| Securonix | Securonix SIEM |
| Snowflake (Snowpipe) | Snowflake via Snowpipe from cloud storage |
| Snowflake (Snowpipe Streaming) | Snowflake via Snowpipe Streaming |
| Splunk | Splunk SIEM |
| Sumo Logic | Sumo Logic as a destination |
Transport Methods
How data moves between your infrastructure and Realm.
| Method | Description |
|---|---|
| AWS S3 | S3 bucket (source or destination) |
| Azure Blob Storage | Azure Storage Containers |
| Collector | Realm on-premises data collector agent |
| Cloud HTTP (Webhook) | Cloud-managed HTTPS webhook endpoint; supported in Custom CEF, Custom CSV, Custom JSON |
| Cloud OTLP | Cloud-managed OpenTelemetry (OTLP/HTTP) endpoint; supported in Custom CEF, Custom CSV, Custom JSON, Custom Syslog |
| Cloud Syslog | Cloud-managed syslog endpoint |
| Rsyslog | Rsyslog log forwarding |
| Splunk HEC | Splunk HTTP Event Collector |
| Sumo Logic | Sumo Logic as a source |