Sekoia.io Documentation
23b75d0c 2026 4d3e b916 636c27ba4931
Initializing search
GitHub
Getting started
Sekoia Solutions
Usecases
FAQ and troubleshooting
Integrations
API Documentation
Sekoia.io Documentation
GitHub
Getting started
Getting started
Overview
Where to start
Trainings
Trainings
Training offer overview
Register for a training course
Workspace setup
Workspace setup
Join workspace
Create and manage communities
Account setup
Account setup
Create account
Setup account
Security and access
Security and access
Account security
Account security
Two-Factor Authentication
Security tokens
Password Management Policy
Workspace security
Workspace security
Session duration
Two-Factor Authentication
SSO with OpenID Connect
SSO with Microsoft Entra ID (Azure AD)
SSO with Okta
Users and roles
Users and roles
Invite users
Manage users
Deactivate inactive users
Roles and permissions
Roles and permissions
Built-in roles
Custom roles
Intake Restricted roles
Notifications
Notifications
Notification system
Create notifications
Manage notifications
Notification examples
API Keys
Subscriptions
Usage
Sekoia regions
Roy AI Assistant
Best practices
Troubleshooting tips
Sekoia Solutions
Sekoia Solutions
Threat Context (Intelligence)
Threat Context (Intelligence)
Intelligence overview
Data Models
Consume
Consume
Intelligence
Observables
Telemetry
Feeds
Feeds
Understand the feeds
Create feeds
Manage feeds
Create a detection rule from a feed
Graph Explorations
Reports
Reports
FLINT Reports
External Reports
Export
IOCs Collections
Monitor
Monitor
Dashboards
Threat Landscape
External Integrations
External Integrations
Overview
API
TAXII
Cortex Analyzer
MISP Feed
MISP - Import to IOC Collection
Microsoft Sentinel
OpenCTI Import Connector
OpenCTI Stream Connector
Splunk
Splunk SOAR
Swimlane Turbine
Anomali ThreatStream
PaloAlto Cortex XSOAR
PaloAlto Cortex XSIAM
ThreatQuotient
Detect, Hunt and Respond (Defend)
Detect, Hunt and Respond (Defend)
Defend overview
Quick start guide
Collect
Collect
Integrations
Intakes
Entities
Assets
Optimization rules
Optimization rules
Optimization rules overview
Create an optimization rule
Optimization rules technical references
Detect
Detect
IOCs Detection
Rules Catalog
Built-in Rules
Sigma
Anomaly Detection
IOCs Collections
Investigate
Investigate
Alerts
Events page
Massive event export
Massive event export
Understand massive event export
Export events with CLI
Export events with API
Massive export technical specifications
Massive event export troubleshooting
Cases
Cases
Cases overview
Create and manage cases
Create and manage cases
Create a case
Manage cases
Investigate cases
Investigate cases
Investigate case details
Graph investigation
AI Cases
Using cases custom fields
Using cases custom fields
Cases custom fields overview
Use custom fields in cases
Manage custom field definition
Query custom fields
Asset Context Panel
Events Query Language
Querying Events
Query Builder
Query Builder
Discover the query builder
Create and manage queries
Share and duplicate queries
Data visualization guide
Query builder form mode reference
Sekoia Operating Language
Sekoia Operating Language
SOL overview
Getting started
Understand SOL performance
How-to guides
SOL Datasets
Query examples
Reference: Datasources
Reference: Operators
Reference: Functions
Notebooks
Report
Report
Dashboards
Dashboards
Understanding dashboards
Create and manage dashboards
Configure widgets and layout
Filter data in dashboards
Share dashboards
Built-in widgets reference
Threat Landscape
Automate
Automate
Playbooks
Playbooks On-premises
Manage accounts
Navigate playbooks
Build playbooks
Triggers
Operators
Actions
Debug playbooks
Playbooks JSON Schema
External integrations
External integrations
FortiSOAR
Palo Alto Cortex XSOAR
Swimlane Turbine
Asset Intelligence (Reveal)
Asset Intelligence (Reveal)
Reveal overview
Get started with Reveal
Explore assets context
Visualize attack paths
Discover Points of Interest
Check asset connector health
Reveal enablement matrix
Usecases
Usecases
Export large volumes of events
Implement a blocklist in Sekoia.io
Synchronize Alerts with an external tool
Synchronize Assets with an Active Directory
Send notifications to a Webhook using a playbook
Use your own CTI in Sekoia.io
Investigate overusage
Log volume reduction strategies
FAQ and troubleshooting
FAQ and troubleshooting
General
Alerts
Events
Events
Events FAQ
Events QA
Facing issues with logs collection
Storage
Storage
Data storage and retention
Restore Data from cold storage
Understand Exalog storage engine
Migrate to Exalog
Intelligence
Intelligence
Detection
Questions about IoC revokation
Questions about detection rules
Assets
Ingestion
Ingestion
Delay with event ingestion or alert creation
Subscriptions
Subscriptions
Allocate trial subscription
Subscriptions notifications
Sekoia.io Endpoint agent
Datetime representation
Reveal troubleshooting
Integrations
Integrations
Introduction
Ingestion methods
Ingestion methods
Overview
Cloud & SaaS
Cloud & SaaS
Overview
AWS S3
Azure Event Hub
Google Pub/Sub
HTTPS
HTTPS
Overview
Formatting options
Compression
Forwarding logs using a third-party application
Graylog
Logstash
Syslog
Syslog
Overview
Sekoia.io Forwarder
Third-party syslog services
Rsyslog
Syslog NG
Secured forwarding
NetFlow
NetFlow
Sekoia.io NetFlow Concentrator
List of Intakes
List of Intakes
Overview
Applicative
Applicative
1Password EPM
Apache HTTP Server
Azure Activity Logs
Azure Files
Azure MySQL
Cloudflare Audit Logs
Fastly WAF Audit logs
Github Audit Logs
Google Workspace / ChromeOS
Google Cloud Audit Logs
LockSelf LockPass/LockTransfer/LockFiles
Microsoft IIS
Microsoft Sentinel
New Relic Alerts
Salesforce
Sekoia.io activity logs
Sekoia.io forwarder logs
Systancia Cleanroom
Veeam Backup
Wiz Audit Logs
Email
Email
Checkpoint Harmony Email and Collaboration
Cisco Email Security Appliance
FortiMail
Hornetsecurity 365 Total Protection
Mimecast Email Security
Office 365
Office 365 Message Trace (deprecated)
Office 365 Message Trace (Graph API)
Postfix
Proofpoint On Demand
Proofpoint Targeted Attack Protection
Retarus Email Security
SpamAssassin
Trend Micro Email Security
Vade Cloud
Vade M365
Endpoint
Endpoint
Azure Windows
Bitdefender GravityZone
Check Point Harmony Mobile
CrowdStrike Falcon
CrowdStrike Falcon Telemetry
Cybereason MalOp
Cybereason MalOp activity
Eset Protect
Google Kubernetes Engine (GKE)
Harfanglab
IBM AIX
IBM iSeries (AS/400)
Kaspersky Endpoint Security
Kubernetes Audit Logs
Linux AuditBeat
Log Insight Windows
Lookout Mobile Endpoint Security
Microsoft Defender XDR (Microsoft 365 Defender)
Microsoft Defender XDR (Graph API)
Microsoft Intune
Nozomi Central Management Console
Nucleon EDR
Palo Alto Cortex XDR (EDR)
Panda Security Aether
Pradeo MTD
SentinelOne
SentinelOne Cloud Funnel 2.0
Sekoia.io Endpoint Agent
Sophos EDR
Stormshield SES
Symantec Endpoint Protection
TEHTRIS Endpoint Detection & Reponse
Tanium
Trellix ATD
Trellix EDR
Trend Micro Apex One / Vision One Endpoint
Trend Micro Vision One Workbench
Trend Micro Vision One Observed Attack Techniques
WatchGuard EPDR
VMWare ESXi
VMWare VCenter
Windows
Winlogbeat
WithSecure Elements
Generic
Generic
CEF
Raw
OCSF
IAM
IAM
Tenable Identity Exposure / Alsid
Azure Key Vault
BeyondTrust PRA Sessions
BeyondTrust PRA Syslog
BeyondTrust PRA Team
BeyondTrust PRA Vault Account Activity
Cisco Duo Security
Cyberark Digital Vault
CyberArk Identity Audit Logs
Delinea Platform Audit Logs
FreeRADIUS
Jumpcloud Directory Insights
Keycloak Events
ManageEngine ADAudit Plus
Microsoft Entra ID (Azure AD)
Microsoft Entra ID (via Graph API)
Okta System log
One Identity SPS Session logs
OpenLDAP
PingFederate
RSA SecurID
Rubycat PROVE IT
SentinelOne Singularity Identity
Silverfort Universal MFA
Wallix
Network
Network
Amazon VPC Flow Logs
Azure Application Gateway
ArubaOS Switch
BIND
Cato SASE
Cisco Catalyst SD-WAN
Cisco IOS
Cisco Meraki MX
Cisco NX-OS
Citrix NetScaler / ADC
Cloudflare Access Request
Cloudflare DNS Gateway
Cloudflare DNS logs
Cloudflare Gateway HTTP
Cloudflare Gateway Network
Cloudflare HTTP requests
EfficientIP SOLIDServer DDI
Ekinops OneOS
F5 BIG-IP
Google VPC Flow Logs
HAProxy
ISC DHCP
Infoblox DDI
Juniper Network Switches
Microsoft Always On VPN
NGINX
Netfilter
OPNSense
OpenSSH
OpenVPN
PfSense
Pulse Connect Secure
Squid
Jizo AI / Sesame Jizo NDR
Umbrella DNS Logs
Unbound
Network Security
Network Security
Akamai Guardicore On-Premises
Akamai Guardicore Saas
Akamai WAF
Aleph Alerts
AWS CloudTrail
Amazon CloudFront Logs
Amazon GuardDuty
Amazon WAF
Azure Front Door
Azure Network Watcher (NSG flow logs; deprecated)
Azure Network Watcher (Virtual Network Flow Logs)
Barracuda CloudGen Firewall
Bitsight SPM
Broadcom Cloud Secure Web Gateway
Broadcom Edge Secure Web Gateway
Broadcom Siteminder
Check Point
Cisco Identity Services Engine (ISE)
Cisco Secure Firewall
Cisco Web Security Appliance
Claroty xDome
Clavister Next-Gen Firewall
Cloudflare WAF / Firewall Events
Cyberwatch Detection
Darktrace Threat Visualizer
Datadome Protection
Daspren Parad
Digital Shadows SearchLight
ExtraHop Reveal(x) 360
F5 Distributed Cloud
Fastly Next-Gen WAF
Forcepoint Secure Web Gateway
Forcepoint Management Server
Forcepoint NGFW
FortiProxy
FortiWeb
Fortigate
Gatewatcher AionIQ (<=v102)
Gatewatcher AionIQ (>=v103)
Google Cloud Load Balancing
Imperva Web Application Firewall
Juniper Next Gen Firewall
Lacework Cloud Security
McAfee Web Gateway / Skyhigh Secure Web Gateway - On Prem
McAfee Web Gateway / Skyhigh Secure Web Gateway - SaaS
Nanocorp
NeroSwarm Honeypot
Netskope Events
Netskope Log Streaming (Transaction Events)
Netskope Transaction Events (deprecated)
Nozomi Vantage
OGO Shield WAF
Olfeo SAAS
Olfeo Secure Web Gateway
Palo Alto Next-Generation Firewall
Palo Alto Prisma access
Radware DefensePro
Seckiot Citadelle
Security Scorecard Vunerability Assessment Scanner
SonicWall Firewall
SonicWall SMA
Sophos Firewall
Sophos Threat Analysis Center
Stormshield Network Security
Suricata
Thinkst Canary
Trapster
Trellix Network Security
Trellix ePO
Trellix ePO - On Prem
Trend Micro Deep Security / Workload Security
Ubika Cloud Protector Next Generation Alerts
Ubika Cloud Protector Next Generation Traffic Logs
Ubika WAAP Gateway
Umbrella IP Logs
Umbrella Proxy Logs
Varonis Data Security
Vectra Cognito Detect
Vectra Respond UX - Entity Scoring
WatchGuard Firebox
Wiz Cloud configuration findings
Wiz Issues
Wiz Threat Detections
Wiz Vulnerability Findings
Zscaler Internet Access
Zscaler Private Access
Threat Intelligence
Threat Intelligence
MokN - Baits
Prodaft USTA
List of Playbooks Actions
List of Playbooks Actions
Applicative
Applicative
ElasticSearch
Mandrill
Mattermost
New Relic
PagerDuty
Ilert
Cloud Providers
Cloud Providers
AWS
Azure Monitor
Google Cloud
Collaboration Tools
Collaboration Tools
Atlassian JIRA
Git
ServiceNow
The Hive
The Hive V5
Email
Email
Microsoft Outlook
Endpoint
Endpoint
Bitdefender GravityZone
CrowdStrike Falcon
Eset
HarfangLab
Microsoft Windows Server
MicrosoftDefenderXDR
Palo Alto Cortex XDR (EDR)
Palo Alto Cortex XSIAM
Panda Security
SentinelOne
Sophos
Stormshield SES
TrendMicro VisionOne
WithSecure
Generic
Generic
HTTP
OpenAI
RSS
Sekoia.io
Utils
IAM
IAM
Microsoft Active Directory
Microsoft Entra ID
Network
Network
DNS
Fortigate Firewalls
Sophos
Stormshield
Zscaler
Overview
Threat Intelligence
Threat Intelligence
Censys
Certificate Transparency
Detection Rules
Digital Shadows
GLIMPS
IKnowWhatYouDownload
IPInfo
IPtoASN
MISP
MWDB
OSINT
Onyphe
Public Suffix
Shodan
Tranco
Triage
VirusTotal
Whois
List of Asset Connectors
List of Asset Connectors
Overview
Vulnerability
Vulnerability
Tenable.io
Device
Device
AWS EC2
Crowdstrike Falcon
Harfanglab EDR
Microsoft Defender XDR (Microsoft 365 Defender)
Okta
SentinelOne EDR
Sophos EDR
User
User
AWS IAM
Microsoft Active Directory
Microsoft Entra ID
Okta
How to develop a new Integration
How to develop a new Integration
Overview
Automation
Automation
Overview
Action
Create a Module
Development Guidelines
Module
Trigger
Formats
Formats
Overview
Create a Format
Datasources
Definition of a structured event
Definition of the taxonomy
How to write a parser
How to write smart descriptions
Troubleshooting
Best Practices
Best Practices
Overview
Authentications
Networks
Endpoints
FAQ
FAQ
Overview
General Questions
General Questions
Bug VS Improvement Requests
API Documentation
23b75d0c 2026 4d3e b916 636c27ba4931
Redirecting...
Redirecting...
Back to top