> For the complete documentation index, see [llms.txt](https://docs.panther.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.panther.com/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs.md). # Supported Logs Panther supports 100+ security log types across 50+ different categories ## Overview Panther has native schema support for all of the following sources, with different supported methods to ingest data depending on the log source. If you do not see a needed source listed as supported, you can either define your own log type via a [Custom Log](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/custom-log-types.md) entry or [request support of a new log source](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding.md#request). ## Panther-supported log sources Expand the block below to see which logs Panther offers built-in support for:
Panther Supported Logs [1Password Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/1password.md) [Azure Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/azure.md) [Apache Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/apache.md) [Asana Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/asana.md) [Atlassian Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/atlassian.md) [Auditd Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/auditd-logs.md) [Auth0 Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/auth0.md) [AWS Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/aws.md) [Bitwarden Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/bitwarden-logs.md) [Box Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/box.md) [Carbon Black Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/carbon-black.md) [Cisco Umbrella Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/ciscoumbrella.md) [Cloudflare Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/cloudflare.md) [CrowdStrike Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/crowdstrike.md) [Docker Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/docker.md) [Dropbox Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/dropbox.md) [Duo Security Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/duo.md) [Fastly Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/fastly.md) [Fluentd Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/fluentd.md) [GCP Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/gcp.md) [GitHub Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/github.md) [GitLab Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/gitlab.md) [Google Workspace Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/googleworkspace.md) [Heroku Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/heroku.md) [Jamf Pro Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/jamfpro.md) [Juniper Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/juniper.md) [Lacework Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/lacework.md) [Microsoft 365 Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/microsoft365.md) [Microsoft Graph Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/microsoftgraph.md) [MongoDB Atlas Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/mongodb.md) [Netskope Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/netskope.md) [Nginx Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/nginx.md) [Okta Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/okta.md) [OneLogin Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/onelogin.md) [Osquery Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/osquery.md) [OSSEC Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/ossec.md) [Salesforce Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/salesforce.md) [SentinelOne Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/sentinel-one.md) [Slack Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/slack.md) [Snyk Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/snyk-logs.md) [Sophos Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/sophos.md) [Suricata Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/suricata.md) [Sysdig Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/sysdig.md) [Syslog Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/syslog.md) [Tailscale Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/tailscale.md) [Teleport Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/teleport.md) [Tenable Vulnerability Management Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/tenable.md) [Tines Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/tines.md) [Windows Event Logs (Beta)](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/windows-event-logs.md) [Zeek Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/zeek.md) [Zendesk Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/zendesk.md) [Zoom Logs](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs/zoom.md)
On the "Add New Source" page in the Panther Console, you can choose a service from the list or use the search bar to find a source.\ ![On the upper right side of the list of services with built-in support, there is a search bar to filter the built-in options.](https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2FXYI6BLfOZXRrxQem8CWs%2Ffilter-log-sources.png?alt=media\&token=cd9b8aa7-b642-44fe-b163-1edd5714059b) ## Working with Panther-managed schemas ### Testing a Panther-managed schema {% hint style="info" %} The log files can be compressed using the following formats: * gzip * zstd (without dictionary) {% endhint %} Need to validate that a Panther-managed schema will work against your logs? You can test sample logs against the Panther-managed schema similarly to testing logs against a custom schema. Follow the steps below: 1. In the Panther Console, go to **Configure > Schemas**. 2. Click on a schema labeled `Panther-managed`**.** 3. In the schema details page, scroll to the bottom of the page where you'll be able to upload logs.
In the Panther Console below a schema, there is a section labeled "Test a schema against sample logs." In that section, there is an option to drag and drop in a file or to select a file to upload.
### Cloning a Panther-managed schema It is not possible to edit a Panther-managed schema. Instead, you can clone the schema to create a copy of it, which you can edit. To clone a schema: 1. Log in to the Panther Console. 2. Click **Configure > Schemas** in the left sidebar. 3. Click on a schema in the list. 4. On the schema's details page, click **Clone** in the upper right corner. For information on editing a custom schema, see the [Custom Logs documentation](/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/custom-log-types.md#editing-a-custom-schema). ## Troubleshooting supported logs Visit the Panther Knowledge Base to [view articles about supported log sources](https://help.panther.com/Data_Sources/Supported_Logs) that answer frequently asked questions and help you resolve common errors and issues. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.panther.com/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/supported-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.