Skip to main content

Example Ingestion Sources for Cloud SIEM

This section shows examples of sources you can use to ingest data into Cloud SIEM. There are many sources you can use to ingest data into Cloud SIEM. The sources described in this section are just a few.

tip

The most common method to ingest data into Cloud SIEM is to install a Cloud-to-Cloud Integration Framework source and select the Forward to SIEM option in the configuration UI, or to click the +Add Field link and add a field whose name is _siemForward and value is true. Once you do that, add another field named _parser with value that points to the parser associated with that source type, for example, /Parsers/System/Cisco/Cisco ASA. This ensures that the logs from that type of source are properly parsed and normalized into structured records in Cloud SIEM.

For all available methods to ingest data into Cloud SIEM, see Recommended methods to ingest data into Cloud SIEM.

Auth0 thumbnail icon

Auth0

Configure an HTTP source to ingest Auth0 log messages and send them to Cloud SIEM’s Auth0 system parser.

AWS Load Balancer thumbnail icon

AWS Application Load Balancer

Configure collection and ingestion of AWS ALB log messages from an S3 bucket to be parsed by Cloud SIEM.

AWS CloudTrail thumbnail icon

AWS CloudTrail

Configure a CloudTrail source on a hosted collector to ingest CloudTrail log messages to be parsed by Cloud SIEM.

AWS GuardDuty thumbnail icon

AWS GuardDuty

Configure an HTTP source to ingest AWS GuardDuty log messages and send them to Cloud SIEM's system parser.

AWS Network Firewall thumbnail icon

AWS Network Firewall

Configure collection and ingestion of AWS Network Firewall log messages from an S3 bucket to be parsed by Cloud SIEM.

AWS VPC Flow thumbnail icon

AWS VPC Flow

Configure collection and ingestion of VPC Flow logs from an S3 bucket to be parsed by Cloud SIEM.

Carbon Black Cloud thumbnail icon

Carbon Black Cloud

Configure collection of Carbon Black Cloud logs messages from an S3 bucket to be parsed by Cloud SIEM.

Check Point Firewall thumbnail icon

Check Point Firewall

Configure a syslog source to ingest Check Point Firewall log messages to be parsed by Cloud SIEM.

Cisco ASA thumbnail icon

Cisco ASA

Configure a syslog source to ingest Cisco ASA log messages to be parsed by Cloud SIEM.

Cisco Meraki icon

Cisco Meraki

Configure a syslog source to ingest Cisco Meraki log messages to be parsed by Cloud SIEM Cisco.

Corelight Zeek icon

Corelight Zeek

Configure a syslog source to ingest Corelight Zeek log messages and send them to Cloud SIEM's log mapper.

Fortigate Firewall icon

Fortigate Firewall

Configure a syslog source to ingest Fortigate Firewall log messages to be parsed by Cloud SIEM.

G Suite Alert Center icon

G Suite Alert Center

Collect log messages from G Suite Alert Center to be parsed by Cloud SIEM.

Kemp LoadMaster icon

Kemp LoadMaster

Configure a syslog source to ingest Kemp LoadMaster messages to be parsed by Cloud SIEM.

Linux OS Syslog icon

Linux OS Syslog

Configure a syslog source to ingest Linux OS log messages to be parsed by Cloud SIEM.

Microsoft 365 Audit icon

Microsoft 365 Audit (Office 365 Audit)

Configure collection of Microsoft 365 log messages to be parsed by Cloud SIEM. 

Microsoft Azure Activity Log icon

Microsoft Azure Activity Log

Configure an HTTP Source to ingest Microsoft Azure Activity Log messages and to be parsed by Cloud SIEM.

Microsoft Windows icon

Microsoft Windows

Configure collection of Windows Event Log messages and send them to the Cloud SIEM mapper.

Nginx Access Logs icon

Nginx Access Logs

Configure a syslog source to ingest Nginx Access log messages to be parsed by Cloud SIEM.

Okta icon

Okta

Configure an Okta source to ingest Okta log messages and send them to Cloud SIEM’s system parser.

OneLogin icon

OneLogin

Learn how to collect OneLogin log messages and send them to Sumo Logic to be ingested by Cloud SIEM.

Osquery icon

Osquery

Configure an HTTP source to ingest osquery log messages and send them to the Cloud SIEM system parser.

Palo Alto Firewall icon

Palo Alto Firewall

Configure collection of Palo Alto Firewall log messages to be parsed by Cloud SIEM's system parser.

SentinelOne icon

SentinelOne

Learn how to collect SentinelOne log messages and send them to be ingested by Cloud SIEM.

Signal Sciences WAF icon

Signal Sciences WAF

Lean how to collect Signal Sciences WAF log messages and sending them to Sumo Logic to be ingested by Cloud SIEM.

Symantec Blue Coat Proxy icon

Symantec Blue Coat Proxy

Configure a Syslog source to collect and send Symantec Proxy Secure Gateway (ProxySG) log messages to Cloud SIEM.

ZScaler NSS icon

ZScaler NSS

Configure collection of ZScaler NSS log messages to be parsed by Cloud SIEM's system parser for ZScaler NSS.

Zscaler Private Access icon

Zscaler Private Access

Configure an HTTP source to ingest Zscaler Private Access log messages and send them to Cloud SIEM's system parser.

Status
Legal
Privacy Statement
Terms of Use

Copyright © 2025 by Sumo Logic, Inc.