Password
1Password connector setup
Atlassian Organization Audit
Polls audit log events from the Atlassian Organizations REST API (GET /orgs//events-stream).
Azure Event Hubs
Azure Event Hubs connector setup
Bitwarden
Polls organization event logs from the Bitwarden Public API (GET /public/events).
CrowdStrike
Polls detection, audit, and incident events from the CrowdStrike Falcon Event Streams API.
CrowdStrike Spotlight
Polls vulnerability records from the CrowdStrike Falcon Spotlight API (GET /spotlight/combined/vulnerabilities/v1), incrementally by updated_timestamp.
Duo Security
Polls the Cisco Duo Admin API for authentication, telephony, and activity logs, plus optional user inventory snapshots.
Google Cloud Pub/Sub
Consumes messages from a Google Cloud Pub/Sub subscription and emits them to your dataset. This is a streaming connector (long-running consumption, not scheduled polling).
Google Workspace Audit
Polls Google Workspace audit activity from the Admin SDK Reports API (activities.list) for multiple Workspace applications in one connector.
Microsoft Graph Security
Polls Microsoft Defender alerts and incidents plus Microsoft Secure Score posture from Microsoft Graph. The connector is read-only and emits raw Graph objects.
Microsoft Office 365 Audit
Polls unified audit logs from the "Office 365 Management Activity API" for Exchange, SharePoint, Azure AD, General, and DLP workloads.
Slack
Polls the Slack Web API for workspace messages, access logs, and daily inventory snapshots.
Slack Audit
Polls the Slack Audit Logs API and, optionally, org-wide team inventory from the Admin API.