Sources de log pris en charge

Microsoft Exchange

• Microsoft Exchange Message Tracking 2010, 2013, 2016 – comma-delimited

• Microsoft Exchange 2003, 2007, 2010, 2013

Logbinder

• MSExchange

• SharePoint

Qmail

• Qmail v1.x

SAP Business Intelligence

• Business Objects

Microsoft Outlook Web Access

• Microsoft Outlook Web Access

Cisco

• Cisco Iron Port Email Security-II – Cisco Iron Port Email Security
• Cisco IronPort Email Security – Cisco Iron Port Email Security
• Cisco ACS – Cisco ACS Version acs-5.4.0.46-B.221
• Cisco MSE  – Cisco Mobility Services Engine
• Cisco ISE  – Cisco ISE 1.2.0.899

• Cisco Iron Port Email Security-II – Cisco Iron Port Email Security
• Cisco Prime – Cisco Prime Infrastructure version 1.3
• Cisco ACE – Cisco ACE 4700 Series Application Control Engine Appliance
• Cisco TACACS 

Barracuda

• Barracuda Web Application Firewall v7.x, v8.x
• Barracuda Web Application Firewall CEF
• Barracuda Spam & Virus Firewall v4.x

• Barracuda NG Firewall v6.x, v7.x
• Barracuda Web Security Gateway v6.x

Microsoft TMG

• Acceleration Server 2006
• ForeFont-Threat Management Gateway 2010

• Microsoft TMG 2010

Microsoft ISA Server

• Microsoft ISA Server

FSecure

• FSecure Gatekeeper v5.x

• F-Secure v11

Halon Mail Security and Firewall Appliance

• Halon Mail Security and Firewall Appliance

• Halon Security Router

Semantic Security

• Mail Security for Microsoft Exchange
• Symantec MessageLabs

• Symantec Messaging Gateway
• Symantec VIP

Squid

• Squid v1.x, v2.5
• Squid Cache v2.6 and above

• SQUID Proxy

Citrix

• NetScaler v12.x, v11.x, v10.x

• Citrix Access Gateway

ClearSwift

• Clearswift SEG v4.x, 3.x

VeriSec Freja

• Verisec Freja Version R2.4.0.11860-1367

Activtrak

• Activtrak 4.3.x.x

Vade Retro AntiSpam

• Vade Retro AntiSpam

Mideye

• Mideye Server v4.x

Team Center

• Teamcenter by Siemens Version v10.1.2.1

SMS Passcode

• SMS Passcode v6.x, v7.x, v8.x

Sitecore

• Sitecore 8.x

Shibboleth

• Shibboleth v2.x, v3.x

Rubrik

• Rubrik

Rhebo

• Rhebo

Perago

• Perago

Pega

• Pega PRPC v7.22

Dell

• Dell OpenManage v7.x, v8.x

RSA SecurID

• RSA Authentication Manager 7.x and 8.x
• RSA SecurID Appliance 130

• RSA SecurID Appliance 250

Wallix

• Wallix v10.x
• Wallix AdminBastion v4.2.3 build 24048 (wab-4.2.3.0-wallix1)

• Wallix Proxy WPA R50 4.2.1

Extreme Network

• ExtremeXOS version 12.5.4.5

• Extreme Networks Management Center v7.x, v8.x

EZProxy

• EZproxy v5.x, v6.x

Multi Modem iSMS

• The MultiModem iSMS Intelligent SMS server

Trustwave SEG

• Trustwave SEG

• Trustwave SEG, previously known as MailMarshal SEG or MailMarshal SMTP

Bluecoat

• Access Logs for BlueCoat SG/BlueCoat SG Proxy – SGOS 6.5.2.1

Radware DefensePro

• Radware DefensePro v3.6

Zscaler

• Zscaler NSS with the provided feed format

Free Radius

• Free Radius VPN, Server and WLAN

Ping Identity

• PingFederate Server v8.x

Safenet

• SafeNet KeySecure v 7.1

• Safenet 2FA (Two Factor Authentication)

Smoothwall Webproxy

• Smoothwall Webproxy

Fail2ban

• Fail2ban v0.8

Lenovo

• Lenovo Storage V3700 V2/V5030 Series

PortWise

• PortWise Authentication Server v4.x

Websense

• Forcepoint Websense v8.X

• Forcepoint (Websense) V10000 G3 – Software v8.2

MobilityGuard

• MobilityGuard OneGate v16

Mimecast

• Mimecast v3.x

IBoss

• iBoss URL Filtering Appliance

First Class

• OpenText FirstClass Server 16.0

Exim

• Exim 4.89

Cyberlytic

• Cyberlytics CTP all version

Centrify

• Centrify Server Suite 2017

Balabit

• Balabit Shell Control Box 5.0.2

BeyondTrust

• Bomgar Remote Support v16.2.1
• Privileged Access Management 
• PowerBroker Insight Version v6.4.7.118

Zertificon Z1

• Zertificon Z1

Boxaudit

• Boxaudit

Integrity Scanner

• Integrity Scanner

F5 ASM

• F5 ASM

DirectAccess

• Microsoft DirectAccess

Avaya NAC

• Avaya NAC

Barracuda

• Barracuda Web Application Firewall v7.x, v8.x
• Barracuda Web Application Firewall CEF
• Barracuda Spam & Virus Firewall v4.x

• Barracuda NG Firewall v6.x, v7.x
• Barracuda Web Security Gateway v6.x

BRO IDS

• Bro IDS 2.5.x

CheckPoint Firewall

• CheckPoint R7X
• Checkpoint CEF

• Checkpoint Syslog
• CheckPoint Firewalls (OPSEC-LEA)

Cisco

• Cisco FWSM – Cisco Catalyst 65XX series
• Cisco TACACS
• Cisco Meraki MR18
• Cisco VSG CEF, Cisco VSG 4.2(1)VSG2(1.1)
• Cisco PIX/ASA

• Cisco IOS/CatOS
• Cisco VSG
• Cisco FirePower
• Cisco SourceFire IDS/IPS

Clavister CorePlus

• Clavister Coreplus v9.x

Juniper Firewall

• JunOS
• Juniper Secure Access
• Juniper VGW
• Juniper SSG140
• Juniper Netscreen IDP

• Juniper Secure Access WELF
• JunOS SRX Firewall
• Juniper MAG-2600: 8.0R7
• Juniper ISG

NetGear Firewall

• NetGear Firewall (FWG114P)

Palo Alto Network Firewall

• CEF all version of PanOS
• PanOS v6.1, v7.1, v8.0, v8.1, v9.0 for CSV Log

• PaloAlto Next-Generation Firewalls
• PaloAlto Networks Panorama

Sidewinder Firewall

• Forcepoint Sidewinder 8.x

SnapGear Firewall

• SnapGear (McAfee) Firewall

Stonesoft

• StoneSoft Audit, Alert, FW, IPS, L2FW, SSLVPN log

• StoneGate Firewall v5.x.x
• StoneGate Management Center v5.x.x

Watchguard Firewall

• Watchguard Firewall v11.x
• Watchguard NGFW

• Watchguard UTM

ForeScout

• ForeScout CounterACT v7.1
• ForeScout Network Access Control

• Generic package for ForeScout v7

FortiGate

• FortiGate v4.x, v5.x, v6.x

• Fortinet Fortigate NGFW & UTM

Honeyd

• Honeyd v1.5

RedSocks

• Redsocks v3.7.0 alpha1

Nortel Contivity Secure IP

• Nortel Contivity Secure IP Services Gateway

Sophos

• Sophos Unified Threat Management v8, v9
• Sophos UTM WAF XG310

• Sophos XG Firewall v15.x
• Sophos Enterprise Console Server 2012, 2012 R2, 2016

Snort

• Snort v2.x

• Snort IDS

Cyberark

• Cyberark v8.x & v9.x
• CyberArk EPV (CEF)

• CyberArk PTA (CEF)
• CyberArk EPM

FireEye

• FireEye
• FireEye CEF

• FireEye CMS CEF
• FireEye Web

Draytek Vigor

• Draytek Vigor 3300V Firewall

Bluecoat

• Access Logs for BlueCoat SG/BlueCoat SG Proxy – SGOS 6.5.2.1

Cyberoam

• Cyberoam UTM and NGFW 10.x

Intermapper

• Intermapper Monitor Software v5.x, v6.x

PfSense Firewall

• PfSense Firewall v2.x

SonicWall Firewall

• STOSonicWall Firewall version 6.x and above

• Secure Mobile Access SonicWALL SRA EX7000 Version:11.4.0-468

Airlock

• Airlock WAF v6.x

Deny All WAF

• Deny All Web Application Firewall v6.x

HP

• LP_HP TippingPoint Network Security

• LP_HP TippingPointNetworkSecurityManagementSystem for HP TippingPoint Network Security Management System (SMS)

Stormshield

• Stormshield Network Security v3 and above

Tenable Security Center

• Nessus for Tenable Security Center Vulnerability Management

Intermapper

• Intermapper Monitor Software v5.x, v6.x

NetScreen Firewall

• ScreenOS 5.4.0

Airlok

• Airlock WAF v6.x

Integrity Scanner

• Integrity Scanner

Threat Intelligence

• Emerging ThreatCritical StackCSIS

Qulays

• QualysGuard Vulnerability Management

A10 Web Application Firewall

• A10 Web Application Firewall

Halon

• Halon Security Router

StirTaxii

• Logs with Cyber Threat Intelligence (CTI) written in STIX format

Carbon Black

• Bit9 Security System v6.x

Trend Micro

• Trend Micro Control Manager v3.x, v5.x, v6.x
• Trend Micro Office Scan v10.x, 11.x
• Trend Micro DB
• Trend Micro Deep Discovery Inspector v2.x, v3.x

• Trend Micro IMSVA SMTP Relay v9
• Trend Micro IWSVA v6.5
• Trend Micro Deep Security Agent v6.x and above

FSecure

• FSecure Gatekeeper v5.x

• F-Secure v11

Symantec Security

• Symantec Endpoint Protection Version 12.1 RU6

• Symantec AntiVirus Corporate Edition

Sophos

• Sophos Endpoint Antivirus version 5.2.1 R2

Kaspersky

• Kaspersky Antivirus
• Kaspersky DB
• Kaspersky Endpoint Security 10

• Kaspersky LEEF
• Kaspersky Security Center (KSC)

Cylance

• Cylance Protect v1.4.x and above
• Cylance Optics v2.0

• Cylance EPO

SentinelOne

• All versions of SentinelOne with CEF log format

Malwarebytes

• CEF logs for Malwarebytes Breach Remediation
• CEF logs for Malwarebytes Endpoint Security

• CEF logs for Malwarebytes Timeliner

ESET

• ESET Server

Bitdefender

• BitDefender GravityZone 5.1.21-460

• BitDefender Endpoint Security 5.3.20-6642

DNS Analytics

• CSIS Secure DNS
• SecureDNS

• DNS BIND

McAfee EPO

• McAfee EPO Antivirus

• McAfee ePolicy Orchestration Server

Microsoft Defender ATP

• Microsoft Defender ATP

NCSCross

• NCS Cross v5, v4

UEBA Analytics

• UEBA Analytics

JSON Normalizer

• JSON Normalizer for any valid JSON logs

Ascom

• Ascom UCM

LogPoint Agent

• LogPoint Agent

Oracle

• Oracle WebLogic Server 12c

• Oracle Financials

IBM

• Generic IBM IMM log format
• IBM Iseries
• IBM Z/OS Communications Server v2.01

• IBM Integrated Management Module (IMM) firmware version: 4.31
• IBM RACF
• IBM AS400 & IBM iSeries Platform Logs

AgileSI

• AgileSI v2.x

SAP

• SAP Financial Planning
• SAP HR
• SAP PLM

• SAP SRM
• SAP CRM
• SAP ABAP and HANA Platforms

Microsoft Dynamics

• Microsoft Dynamics

MS-SQL

• MS-SQL Server 2005, 2008, 2012, 2014, 2016

Oracle

• Oracle 10g, 11g, 10.xg
• Oracle Database 10g

• Oracle on Windows

IBM

• IBM DB2 on z/OS

• IBM DB2 on Linux, Unix, Windows

Sybase

• Sybase Adaptive Server Enterprise 15.x

Office 365

• Office 365

Salesforce

• Salesforce

CloudTrail

• AWS Cloudtrail

Eventhubs

• Azure Eventhubs

Incapsula

• Incapsula

Zscaler

• Zscaler NSS

Veritas-SaaS Backup and Application Protection

• VeritasSaaS Backup

CiscoAMP

• CiscoAMP

CiscoUmbrella

• Cisco Umbrella AWS S3 buckets

MysqlRDS

• AWS MysqlRDS

CloudWatch

• AWS CloudWatch

VPCFlowLog

• AWS VPCFlowLog

DFLabs

• DFLabs

ServiceNow

• ServiceNow

Regulatory Compliance

• GDPR on Windows, Unix, Firewall
  • Special Cases for GDPR:
    • The LP_GDPR: File System Activities dashboard and report packages require configuration of WIndows and Palo Alto Firewall only.
    • The LP_GDPR: User Privilege Escalation dashboard and report packages require configuration of Windows and Unix only. 
• GPG 13 on entire dependent sources
• PCI DSS on entire dependent sources
• ISO on entire dependent sources
• NERC-CIP on entire dependent sources
• SANS 6 Categories on entire dependent sources
• NIST on entire dependent sources.
• GLBA on entire dependent sources.
• HIPAA on entire dependent sources.
• SOX on entire dependent sources.