📄️ Cato Networks
Pull-type. Cato Networks device reading Cato's GraphQL API for its events and audit feeds, XDR stories, site metrics, application usage, sites, and connected users, from datasets, with connectors the platform writes.
📄️ Codeless Connector Framework (CCF)
Pull-type. Codeless Connector Framework poller driven by a Microsoft Sentinel PollingConfig.json file.
📄️ Commvault
Pull-type. Commvault poller reading one Commvault CommServe through its Web Console REST API for its clients, alert rules, backup and restore jobs, and events, from datasets, as ECS documents.
📄️ Datagen
Generates synthetic log traffic for pipeline testing, target connectivity validation, and load characterization.
📄️ DataStream Stats
Pull-type. Subscribes to the Director's NATS JetStream stats stream and republishes route, target, device, pipeline, resource, queue, and log-severity metrics in ECS, Cribl, or Prometheus naming.
📄️ File
Pull-type. Director-side log file collector that polls filesystem globs and forwards matched lines through an optional pipeline.
📄️ 1Password
Pull-type. 1Password device reading 1Password's Events API for its sign-in attempts, audit events, and item usages, from datasets, with connectors the platform writes.
📄️ OTLP
OpenTelemetry Protocol (OTLP) listener that receives logs, metrics, and traces over gRPC and HTTP.
📄️ Prometheus
Pull-type. Prometheus metric endpoint (a node_exporter, an application's /metrics, kube-state-metrics) that Director scrapes in the text exposition format.
📄️ Proofpoint On Demand
Pull-type. WebSocket-based Proofpoint On Demand (POD) log stream consumer for email security events.
📄️ Windows Event Collector (WEC)
Windows Event Collector (WEC) server accepting WS-Man event forwarding with Kerberos/SPNEGO and TLS mutual authentication.