# Supported Logs

## Overview

Panther has native schema support for each of the [sources listed below](#panther-supported-log-sources), with different supported methods to ingest data depending on the log source.

If you would like to ingest logs from a source not listed as Panther-supported, you can either define your own [Custom Log](https://docs.panther.com/data-onboarding/custom-log-types) source or [request support of a new log source](https://docs.panther.com/data-onboarding/..#request).

For information on tracking logged activity within your Panther instance, please see [Panther Audit Logs](https://docs.panther.com/data-onboarding/supported-logs/panther-audit-logs).

View all [Panther-supported log sources in the list below](#panther-supported-log-sources) or in your Panther Console, by navigating to the **Log Sources** > **Add New Source** page. There, you can browse sources in the grid or use the search bar to find a source:

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-716ce58688fa4442c6c6ff436a4e6a321015233b%2FScreenshot%202025-10-20%20at%206.14.24%E2%80%AFPM.png?alt=media" alt="The heading reads, &#x22;What type of logs do you want to monitor with this source?&#x22; and below it is a circled search bar."><figcaption></figcaption></figure>

## Working with Panther-managed schemas

For each Panther-supported log source, Panther produces and maintains associated log schemas. You can find the schemas associated to each source on the source's documentation page.

Certain Panther-managed schemas have [field discovery](https://docs.panther.com/data-onboarding/field-discovery) enabled. To verify whether field discovery is enabled for a specific schema, see [Verifying field discovery is enabled](https://docs.panther.com/field-discovery#verifying-field-discovery-is-enabled).

### Testing a Panther-managed schema

{% hint style="info" %}
The log files can be compressed using the following formats:

* gzip
* zstd (without dictionary)
  {% endhint %}

If you'd like to validate that a Panther-managed schema will parse your logs correctly, you can test sample logs against the Panther-managed schema (just like you can test logs against a custom schema). Follow the steps below:

1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Schemas**.
2. Click on the name of a schema labeled `PANTHER MANAGED`**.**
3. In the upper-right corner, click **Test Schema**.
4. Choose **Upload Sample file** or **Paste sample event(s)**.
5. After uploading your sample(s), in the upper-right corner, click **Run Test**.

<figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4f0d345c2d6c76a893bf71b2f03656e9f426799e%2FScreenshot%202025-06-24%20at%204.07.48%E2%80%AFPM.png?alt=media" alt="There is a slide-out panel titled &#x22;Test schema against sample logs&#x22; and a circled &#x22;Run Test&#x22; button."><figcaption></figcaption></figure>

### Cloning a Panther-managed schema

It is not possible to edit a Panther-managed schema. Instead, you can clone the schema to create a copy of it, which you can edit. To clone a schema:

1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Schemas**.
2. Click on the name of a schema in the list.
3. In the upper-right corner of the schema's details page, click **Clone**.

For information on editing a custom schema, see the [Custom Logs documentation](https://docs.panther.com/custom-log-types#editing-a-custom-schema).

## Panther-supported log sources

Panther offers built-in support for each of the following log sources. Click a tile to learn more about that source:

<table data-view="cards"><thead><tr><th></th><th data-hidden data-card-cover data-type="image">Cover image</th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td>1Password</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c1b7dcff78d9d1de83211162588fab20605f98e0%2Fonepassword.svg?alt=media">onepassword.svg</a></td><td><a href="supported-logs/1password">1password</a></td></tr><tr><td>Apache</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4a58bbd0bb1b7955b835536995a94d4db0d18fa3%2Fapache.svg?alt=media">apache.svg</a></td><td><a href="supported-logs/apache">apache</a></td></tr><tr><td><strong>AppOmni</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-ea962be45bb618047552d59b7b4ed31659e541f2%2Fappomni.svg?alt=media">appomni.svg</a></td><td><a href="supported-logs/appomni">appomni</a></td></tr><tr><td>Asana</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-474da15544ade25956ce40ae6130f27080a78744%2Fasana.svg?alt=media">asana.svg</a></td><td><a href="supported-logs/asana">asana</a></td></tr><tr><td>Atlassian</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-319b5aef4e794221e1820b26bb27ccde74919d16%2Fatlassian.svg?alt=media">atlassian.svg</a></td><td><a href="supported-logs/atlassian">atlassian</a></td></tr><tr><td><strong>Auditd</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-2c841b1159816ce5d1cd9bf82f6fd2a26d934bb8%2Fauditd-16-9.svg?alt=media">auditd-16-9.svg</a></td><td><a href="supported-logs/auditd-logs">auditd-logs</a></td></tr><tr><td>Auth0</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3e5476fdd3b191452d790e37255b1da10391f058%2Fauth0.svg?alt=media">auth0.svg</a></td><td><a href="supported-logs/auth0">auth0</a></td></tr><tr><td>AWS ALB</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-53aa28eac79eec0c04b3f9693f60fd54a0a5ff55%2Faws.alb.svg?alt=media">aws.alb.svg</a></td><td><a href="supported-logs/aws/alb">alb</a></td></tr><tr><td>AWS Aurora</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-a1e06c72d1ed1f83af79c5137483775aba215a68%2Faws_aurora.svg?alt=media">aws_aurora.svg</a></td><td><a href="supported-logs/aws/rds">rds</a></td></tr><tr><td><strong>Amazon Bedrock Model Invocation</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-5315d805b496fadb594a9baef243d94836ce85c8%2Fbedrock_model_invocation.svg?alt=media">bedrock_model_invocation.svg</a></td><td><a href="supported-logs/aws/bedrock-model-invocation">bedrock-model-invocation</a></td></tr><tr><td><strong>AWS CloudFront</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-bb5768a02353d1a4b63fbdb6170aaabd6eef1c84%2Faws_cloudfront.svg?alt=media">aws_cloudfront.svg</a></td><td><a href="supported-logs/aws/cloudfront">cloudfront</a></td></tr><tr><td>AWS CloudTrail</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-0b7c3434a0c4a86f5cfca3283fe8629d20f4beeb%2Faws_cloudtrail.svg?alt=media">aws_cloudtrail.svg</a></td><td><a href="supported-logs/aws/cloudtrail">cloudtrail</a></td></tr><tr><td>AWS CloudWatch</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-37d18664e1c9217723ac8cf9ac046c6300777037%2Faws_cloudwatch.svg?alt=media">aws_cloudwatch.svg</a></td><td><a href="supported-logs/aws/cloudwatch">cloudwatch</a></td></tr><tr><td>AWS Config</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-2a3e0ef2e7c6aede0c381a584e3d0d6fe81f5195%2Faws_config.svg?alt=media">aws_config.svg</a></td><td><a href="supported-logs/aws/config">config</a></td></tr><tr><td>AWS EKS</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-fea82cbf081689eb6c9a5b5f107e14c88c83ce33%2Faws_eks.svg?alt=media">aws_eks.svg</a></td><td><a href="supported-logs/aws/eks">eks</a></td></tr><tr><td>AWS GuardDuty</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4f4b2fe30f2adb1551c6968d9e72c2c9ea12e6c8%2Faws_guardduty.svg?alt=media">aws_guardduty.svg</a></td><td><a href="supported-logs/aws/guardduty">guardduty</a></td></tr><tr><td>AWS NLB</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FI65maDoXQWSizTU2U97J%2Faws.nlb%20(1)_16x9.png?alt=media&#x26;token=ffdddc54-eb4e-420c-8d52-e12b53b76340">aws.nlb (1)_16x9.png</a></td><td><a href="supported-logs/aws/nlb">nlb</a></td></tr><tr><td><strong>AWS Security Hub</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3cbe1f2739b8a8e5bdf7f58bda7c1c31b300b1e4%2Faws_security_hub.svg?alt=media">aws_security_hub.svg</a></td><td><a href="supported-logs/aws/security-hub">security-hub</a></td></tr><tr><td>Amazon Security Lake</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-fafc84ee76551259f41d1b69da5e38e2d8048348%2Famazon_security_lake.svg?alt=media">amazon_security_lake.svg</a></td><td><a href="supported-logs/aws/security-lake">security-lake</a></td></tr><tr><td>AWS S3</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-0baffb4f00320284e112c8e99cd2185087a7d21b%2Faws_s3_server_access.svg?alt=media">aws_s3_server_access.svg</a></td><td><a href="supported-logs/aws/s3">s3</a></td></tr><tr><td>AWS Transit Gateway</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-fa6bb205372491340d0d946d5d7a6b80a53ef7a7%2FAWS_Transit_Gateway.svg?alt=media">AWS_Transit_Gateway.svg</a></td><td><a href="supported-logs/aws/transit-gateway">transit-gateway</a></td></tr><tr><td>AWS VPC</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-9b1a6b67318e5eaa2a503271dcafa928821d3095%2Faws_vpc.svg?alt=media">aws_vpc.svg</a></td><td><a href="supported-logs/aws/vpc">vpc</a></td></tr><tr><td>AWS WAF</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-fd725146ecef3de834284a422eaf6569f2532fa9%2Faws_waf.svg?alt=media">aws_waf.svg</a></td><td><a href="supported-logs/aws/waf">waf</a></td></tr><tr><td><strong>Axonius</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-f891160b745a53c10bb552277eaf0c18be177593%2Faxonius.svg?alt=media">axonius.svg</a></td><td><a href="supported-logs/axonius">axonius</a></td></tr><tr><td><strong>Azure Monitor</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4cede887846eb275bddf8793fdf82bb681e9faee%2Fazure_monitor.svg?alt=media">azure_monitor.svg</a></td><td><a href="supported-logs/azure-monitor">azure-monitor</a></td></tr><tr><td>Bitwarden</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-0ff54e18546a78925039cc6606870e272e383c37%2Fbitwarden.svg?alt=media">bitwarden.svg</a></td><td><a href="supported-logs/bitwarden">bitwarden</a></td></tr><tr><td>Box</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-ca61136f06608d9c92158285d003325dff0f8950%2Fbox.svg?alt=media">box.svg</a></td><td><a href="supported-logs/box">box</a></td></tr><tr><td>Carbon Black</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c270fb62db620100c979e3d276a1dab5f2066679%2Fcarbonblack-v2.svg?alt=media">carbonblack-v2.svg</a></td><td><a href="supported-logs/carbon-black">carbon-black</a></td></tr><tr><td>Cisco Umbrella</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-590d622026d84604533d67678ffd3a859690970f%2Fcisco1.svg?alt=media">cisco1.svg</a></td><td><a href="supported-logs/ciscoumbrella">ciscoumbrella</a></td></tr><tr><td>Cloudflare</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-e135ac0952c6ca4efacd874c400ea562dea1b14d%2Fcloudflare.svg?alt=media">cloudflare.svg</a></td><td><a href="supported-logs/cloudflare">cloudflare</a></td></tr><tr><td>CrowdStrike</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-ddbe3ffb0da43773fcbcb50ddca1bd8d71a3154a%2Fcrowdstrike.svg?alt=media">crowdstrike.svg</a></td><td><a href="supported-logs/crowdstrike/falcon-data-replicator">falcon-data-replicator</a></td></tr><tr><td>Docker</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-ffe94f30ca94ee369fd13d58689986ff25229d46%2Fdocker.svg?alt=media">docker.svg</a></td><td><a href="supported-logs/docker">docker</a></td></tr><tr><td><strong>Docusign</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-93f350e6be482a838b95772de2ee9ba0d4752b4d%2Fdocusign.svg?alt=media">docusign.svg</a></td><td><a href="supported-logs/docusign">docusign</a></td></tr><tr><td>Dropbox</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-d18ff3f3064c9b3c00a4e6671ad8edb8b37ec890%2Fdropbox.svg?alt=media">dropbox.svg</a></td><td><a href="supported-logs/dropbox">dropbox</a></td></tr><tr><td>Duo Security</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c77bb524a25a8bb551d566498936e8d6a0679da5%2Fduo.svg?alt=media">duo.svg</a></td><td><a href="supported-logs/duo">duo</a></td></tr><tr><td>Databricks</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-ab7e64bb84ba68fccaff9769faae29a2e39f32ed%2Fdatabricks.svg?alt=media">databricks.svg</a></td><td><a href="supported-logs/databricks">databricks</a></td></tr><tr><td>Envoy</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-40bbf46aacc3f8b20f2e12ee7aa170362b12a01d%2Fenvoy.svg?alt=media">envoy.svg</a></td><td><a href="supported-logs/envoy">envoy</a></td></tr><tr><td>Fastly</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-a526b7d8e089119ef18aa6ddf0ea58d96b61093e%2Ffastly.svg?alt=media">fastly.svg</a></td><td><a href="supported-logs/fastly">fastly</a></td></tr><tr><td>Fluentd</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3fb87da7c04171a1457b2667794ff3ebde6f0c40%2Ffluentd.svg?alt=media">fluentd.svg</a></td><td><a href="supported-logs/fluentd">fluentd</a></td></tr><tr><td><strong>GCP</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-b710dc2a7f6954fa324397c3bf4177b0041528b7%2FGCP1.svg?alt=media">GCP1.svg</a></td><td><a href="supported-logs/gcp">gcp</a></td></tr><tr><td>GitHub</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3f199b7e548baab05bd3760caa6a04e1b0ae742f%2Fgithub.svg?alt=media">github.svg</a></td><td><a href="supported-logs/github">github</a></td></tr><tr><td>GitLab</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3dafe02c8d53aa0a221450079685e5e77c71f9f9%2Fgitlab.svg?alt=media">gitlab.svg</a></td><td><a href="supported-logs/gitlab">gitlab</a></td></tr><tr><td>Google Workspace</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-a98f8809c0656b7f197cba478ec3ea56843d5f82%2Fgoogleworkspace.svg?alt=media">googleworkspace.svg</a></td><td><a href="supported-logs/googleworkspace">googleworkspace</a></td></tr><tr><td>Heroku</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-708966ed56de3a6b9812e43eb5a70355b984d106%2Fheroku.svg?alt=media">heroku.svg</a></td><td><a href="supported-logs/heroku">heroku</a></td></tr><tr><td>Iru (formerly Kandji)</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fzg09Ip25DSResfcScxOC%2Firu%20(1)_16x9.png?alt=media&#x26;token=f592dbd0-96df-4835-935c-d79e524eb291">iru (1)_16x9.png</a></td><td><a href="supported-logs/iru">iru</a></td></tr><tr><td>Jamf Pro</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-7b0577db1adfd16168b9f1b593e03c867ff10bd4%2Fjamf_pro.svg?alt=media">jamf_pro.svg</a></td><td><a href="supported-logs/jamfpro">jamfpro</a></td></tr><tr><td><strong>Juniper</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-56aa7b70383ddf63e6e8ea1b80c77be22b180205%2Fjuniper.svg?alt=media">juniper.svg</a></td><td><a href="supported-logs/juniper">juniper</a></td></tr><tr><td>Lacework</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-74d7842274fccf42ee8cb26668cd46925251c7fa%2Flacework.svg?alt=media">lacework.svg</a></td><td><a href="supported-logs/lacework">lacework</a></td></tr><tr><td><strong>Material Security</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-2c1482d7f09c8998ddd9116842353e800e827b03%2Fmaterial.svg?alt=media">material.svg</a></td><td><a href="supported-logs/material-security">material-security</a></td></tr><tr><td><strong>Microsoft 365</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-d732d91a462c9edd7fda99d4e735a460f4d4b1a7%2Fm365.svg?alt=media">m365.svg</a></td><td><a href="supported-logs/microsoft365">microsoft365</a></td></tr><tr><td><strong>Microsoft Defender XDR</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4d9b91941e1db7338f51ffd70d4364ffad83ea47%2Fmicrosoft_defender_xdr.svg?alt=media">microsoft_defender_xdr.svg</a></td><td><a href="supported-logs/microsoft-defender-xdr">microsoft-defender-xdr</a></td></tr><tr><td><strong>Microsoft Entra ID Audit</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-6b95eb2cea4231d8c4831367cb24ac897d58e228%2Fazure_audit.svg?alt=media">azure_audit.svg</a></td><td><a href="supported-logs/entra-id-audit">entra-id-audit</a></td></tr><tr><td>Microsoft Graph</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-da3a5dba9155d79bc844d15d98add330a2c6d325%2Fmicrosoft_graph.svg?alt=media">microsoft_graph.svg</a></td><td><a href="supported-logs/microsoftgraph">microsoftgraph</a></td></tr><tr><td>Microsoft Intune</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-0d250193415a04bd75020b5407dad060b03b7481%2Fmicrosoft_intune.svg?alt=media">microsoft_intune.svg</a></td><td><a href="supported-logs/microsoft-intune">microsoft-intune</a></td></tr><tr><td>MongoDB Atlas</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-6f03364bdbbe3ccc4c7dea899dfd696951a5cc18%2Fmongodb.svg?alt=media">mongodb.svg</a></td><td><a href="supported-logs/mongodb">mongodb</a></td></tr><tr><td>Netskope</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-eef158ce40957061430bbd8b71925ea12d745cf2%2Fnetskope.svg?alt=media">netskope.svg</a></td><td><a href="supported-logs/netskope">netskope</a></td></tr><tr><td>Nginx</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-1f3dba9edcc0ec9be29197de838cc7c9ba4cd7a2%2Fnginx.svg?alt=media">nginx.svg</a></td><td><a href="supported-logs/nginx">nginx</a></td></tr><tr><td>Notion</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-930438631cc169d284b7e5c2e2d99eb9fc36a9b3%2Fnotion.svg?alt=media">notion.svg</a></td><td><a href="supported-logs/notion">notion</a></td></tr><tr><td>Okta</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c26c8683874afa923fd9faab94641b66fbe635c4%2Fokta.svg?alt=media">okta.svg</a></td><td><a href="supported-logs/okta">okta</a></td></tr><tr><td>OneLogin</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-70fe0e714b53af13391e569ee3e5081ef11cb4c3%2Fonelogin.svg?alt=media">onelogin.svg</a></td><td><a href="supported-logs/onelogin">onelogin</a></td></tr><tr><td>OpenAI</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FewaS9Ql2OZ23dW9ABduu%2FOpenAI.svg?alt=media&#x26;token=81464d11-44e4-43bb-b551-fb70cb586c97">OpenAI.svg</a></td><td><a href="supported-logs/openai">openai</a></td></tr><tr><td><strong>Orca Security</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-8eb243cccdf56780ed594227a7554c3f7fd02ab4%2Forca.png?alt=media">orca.png</a></td><td><a href="supported-logs/orca-security">orca-security</a></td></tr><tr><td>Osquery</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-247ba7846e8e9a4e32f0f6b49f726cce49912093%2Fosquery.svg?alt=media">osquery.svg</a></td><td><a href="supported-logs/osquery">osquery</a></td></tr><tr><td>OSSEC</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3df147e764bc561ea7d6503aee63584757ab5389%2Fossec.svg?alt=media">ossec.svg</a></td><td><a href="supported-logs/ossec">ossec</a></td></tr><tr><td>Panther Audit Logs</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-00563d7274e623f82ac79a789d0ae6d8f895e56d%2Fpanther%20logo%2016%3A9.svg?alt=media">panther logo 16:9.svg</a></td><td><a href="supported-logs/panther-audit-logs">panther-audit-logs</a></td></tr><tr><td><strong>Proofpoint</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-01f42889fe9ffc1ff3ec574a9ad2ba453e477647%2Fproofpoint.svg?alt=media">proofpoint.svg</a></td><td><a href="supported-logs/proofpoint">proofpoint</a></td></tr><tr><td><strong>Push Security</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-91a3fa392d00244f2c8806acd51a768ec3b3640e%2Fpush.svg?alt=media">push.svg</a></td><td><a href="supported-logs/push-security">push-security</a></td></tr><tr><td>Salesforce</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3c4f5ecbcee94692f1d4b18ff72d57e979facab3%2Fsalesforce.svg?alt=media">salesforce.svg</a></td><td><a href="supported-logs/salesforce">salesforce</a></td></tr><tr><td>SentinelOne</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-283fc501b65def02fa03d408820b407598eeecd7%2FsentinelOne.svg?alt=media">sentinelOne.svg</a></td><td><a href="supported-logs/sentinel-one">sentinel-one</a></td></tr><tr><td>Slack</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-80f62de20016b894a39c76300e377a9a4e38f733%2Fslack.svg?alt=media">slack.svg</a></td><td><a href="supported-logs/slack">slack</a></td></tr><tr><td><strong>Snowflake Audit</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-44ac849e41cb118a2c15e896c92e95ce6dc2607b%2Fsnowflake_audit.svg?alt=media">snowflake_audit.svg</a></td><td><a href="supported-logs/snowflake">snowflake</a></td></tr><tr><td>Snyk</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-d41401b65cfca3374d9ecc95a8d0e5161ab99455%2Fsnyk.svg?alt=media">snyk.svg</a></td><td><a href="supported-logs/snyk">snyk</a></td></tr><tr><td>SOCRadar</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-20a49e282deefa239577bd485bb0cfd304042c7d%2Fsocradar.svg?alt=media">socradar.svg</a></td><td><a href="supported-logs/socradar">socradar</a></td></tr><tr><td>Sophos</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-adf0a1087b4b7c069d06ef1255fe25fbd5b65ddd%2Fsophos.svg?alt=media">sophos.svg</a></td><td><a href="supported-logs/sophos">sophos</a></td></tr><tr><td><strong>Sublime Security</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-7f8ec1e0178c30b9d1c85d75a60865b14b08e1e6%2Fsublime.svg?alt=media">sublime.svg</a></td><td><a href="supported-logs/sublime-security">sublime-security</a></td></tr><tr><td>Suricata</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-47db7832bf5c6aedc7a0492a7606d41a0a2574f0%2Fsuricata.svg?alt=media">suricata.svg</a></td><td><a href="supported-logs/suricata">suricata</a></td></tr><tr><td>Sysdig</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-7510773d38d96e4fb13a704658074c1c3cd57bb2%2Fsysdig.svg?alt=media">sysdig.svg</a></td><td><a href="supported-logs/sysdig">sysdig</a></td></tr><tr><td>Syslog</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-e6badfa30a3efacdd41aae6e0a862e627ed14791%2Fsyslog.svg?alt=media">syslog.svg</a></td><td><a href="supported-logs/syslog">syslog</a></td></tr><tr><td><strong>Tailscale</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-3f851ad56b44229570a22c04a3b06039639524d5%2Ftailscale.svg?alt=media">tailscale.svg</a></td><td><a href="supported-logs/tailscale">tailscale</a></td></tr><tr><td>Teleport</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-712a70062ae68789ae6d27997fb7c339fdbca48f%2Fteleport.svg?alt=media">teleport.svg</a></td><td><a href="supported-logs/teleport">teleport</a></td></tr><tr><td>Tenable</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-6d1f4f8cb2ce96c3d318c65646a5f033689ab5d4%2Ftenable.svg?alt=media">tenable.svg</a></td><td><a href="supported-logs/tenable">tenable</a></td></tr><tr><td><strong>Thinkst Canary</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-dfe90b1f661d253e93434d90c045880200eddd89%2Fthinkst_canary.svg?alt=media">thinkst_canary.svg</a></td><td><a href="supported-logs/thinkst-canary">thinkst-canary</a></td></tr><tr><td><strong>Tines</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-31a0db65efad01736bb6b508b2837cd655b97f2f%2Ftines.svg?alt=media">tines.svg</a></td><td><a href="supported-logs/tines">tines</a></td></tr><tr><td><strong>Tracebit</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-4215861828dd9f0ce9cb23b5e77e1afbf1b043c4%2Ftracebit.png?alt=media">tracebit.png</a></td><td><a href="supported-logs/tracebit">tracebit</a></td></tr><tr><td>Upwind</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2F7QO1PFbhfXEKgXKvfSHZ%2Fupwind_16x9.png?alt=media&#x26;token=60e45432-6540-4cad-a50b-32811ebd551f">upwind_16x9.png</a></td><td><a href="supported-logs/upwind">upwind</a></td></tr><tr><td>Windows Event</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-a4fc15fc1bd569f384d884c88877e1d3a6d7e8f6%2Fwindowsevent.svg?alt=media">windowsevent.svg</a></td><td><a href="supported-logs/windows-event-logs">windows-event-logs</a></td></tr><tr><td><strong>Wiz</strong></td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-9e8cbc565e724f46da0d94d026ecca8b42a50d70%2Fwiz.svg?alt=media">wiz.svg</a></td><td><a href="supported-logs/wiz">wiz</a></td></tr><tr><td>Zeek</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-342b898adc8353c334cdefe4ecfcc58bb6ba7a04%2Fzeek.svg?alt=media">zeek.svg</a></td><td><a href="supported-logs/zeek">zeek</a></td></tr><tr><td>Zendesk</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-1ed2768422d574ab46d9631ef0a043d7b2c98b97%2Fzendesk.svg?alt=media">zendesk.svg</a></td><td><a href="supported-logs/zendesk">zendesk</a></td></tr><tr><td>Zoom</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-18e8969da73de6a82f67f1bab0b95fb217d85372%2Fzoom.svg?alt=media">zoom.svg</a></td><td><a href="supported-logs/zoom">zoom</a></td></tr><tr><td>Zscaler</td><td><a href="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-838365d95b0697f329a2994a609c37f083b46c45%2Fzscaler.svg?alt=media">zscaler.svg</a></td><td><a href="supported-logs/zscaler">zscaler</a></td></tr></tbody></table>

## Troubleshooting supported logs

Visit the Panther Knowledge Base to [view articles about supported log sources](https://help.panther.com/Data_Sources/Supported_Logs) that answer frequently asked questions and help you resolve common errors and issues.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/data-onboarding/supported-logs.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
