--- title: Packs description: Browse Observability Pipelines packs by source and destination. breadcrumbs: Docs > Observability Pipelines > Packs --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Packs {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} ## Overview{% #overview %} {% image source="https://docs.dd-static.net/images/observability_pipelines/packs/packs.b87a52886c5259886323ee2a47dcfc00.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/observability_pipelines/packs/packs.b87a52886c5259886323ee2a47dcfc00.png?auto=format&fit=max&w=850&dpr=2 2x" alt="The packs section of Observability Pipelines" /%} When setting up a pipeline to send logs from a specific source to Observability Pipelines, you often need to decide how to process and manage those logs. Questions such as the following might come up: - Which logs from this source are important? - Which logs can safely be dropped? - Should repetitive logs be sampled? - Which fields should be parsed or formatted for the destination? Making these decisions typically requires coordination across multiple teams and detailed knowledge of each log source. Observability Pipelines Packs provide predefined configurations to help you make these decisions quickly and consistently. Packs apply Datadog-recommended best practices for specific log sources such as Akamai, AWS CloudTrail, Cloudflare, Fastly, Palo Alto Firewall, and Zscaler. ### What Packs do{% #what-packs-do %} Each Pack includes source-specific configurations that define: - **Fields that can safely be removed** to reduce payload size - **Logs that can be dropped**, such as duplicate events or health checks - **Logs that should be retained or parsed**, such as errors or security detections - **Formatting and normalization rules** to align logs across different destinations and environments By using Packs, you can apply consistent parsing, filtering, and routing logic for each log source without creating configurations manually. ### Why use Packs{% #why-use-packs %} Packs help teams: - **Reduce ingestion volume and costs** by filtering or sampling repetitive, low-value events - **Maintain consistency** in parsing and field mapping across environments and destinations - **Accelerate setup** by applying ready-to-use configurations for common sources ## Setup{% #setup %} To set up packs: 1. Navigate to the [Pipelines](https://app.datadoghq.com/observability-pipelines) page. 1. Click Packs. 1. Click the pack you want to set up. 1. You can either create a new pipeline from the pack or add the pack to an existing pipeline. - If you clicked Add to New Pipeline, in the new pipeline that was created: - Click the processor group that was added to see the individual processors that the pack added and edit them as needed. See [Processors](https://docs.datadoghq.com/observability_pipelines/processors.md) for more information. - See [Set Up Pipelines](https://docs.datadoghq.com/observability_pipelines/configuration/set_up_pipelines.md) for information on setting up the rest of the pipeline. - If you clicked Add to Existing Pipeline: 1. Select the pipeline you want to add the pack to. 1. Click Add to Existing Pipeline. 1. The pack is added to the last processor group in your pipeline. 1. Click on the group to review the individual processors and edit them as needed. See [Processors](https://docs.datadoghq.com/observability_pipelines/processors.md) for more information. ## Available packs{% #available-packs %} Search or filter the table by source or destination. Select a pack name for details. | Pack | Source | Destination | Description | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Abnormal.ai - Abuse Campaigns](https://docs.datadoghq.com/observability_pipelines/packs/abnormal_ai_abuse_campaigns.md) | Abnormal.ai | Any destination | This pack flags malicious abuse-mailbox campaigns and failed remediation attempts across reported messages. | | [Abnormal.ai - Abuse Mailbox Messages Not Analyzed](https://docs.datadoghq.com/observability_pipelines/packs/abnormal_ai_abuse_mailbox_messages.md) | Abnormal.ai | Any destination | This pack tracks the backlog of user-reported abuse mailbox messages Abnormal.ai did not analyze. | | [Abnormal.ai - Audit Logs](https://docs.datadoghq.com/observability_pipelines/packs/abnormal_ai_audit_logs.md) | Abnormal.ai | Any destination | This pack flags failed admin actions and mass remediation events from the Abnormal.ai portal audit trail. | | [Abnormal.ai - Threats](https://docs.datadoghq.com/observability_pipelines/packs/abnormal_ai_threats.md) | Abnormal.ai | Any destination | This pack flags unremediated high-risk email threats like business email compromise (BEC), extortion, and credential phishing targeting VIPs. | | [Active Directory](https://docs.datadoghq.com/observability_pipelines/packs/active_directory.md) | Active Directory | Any destination | This pack processes Active Directory Domain Services events, including Kerberos authentication, directory-service changes, and DCSync replication abuse. | | [Akamai CDN](https://docs.datadoghq.com/observability_pipelines/packs/akamai_cdn.md) | Akamai | Any destination | Akamai logs show client requests and responses at the edge. | | [AlphaSOC Findings](https://docs.datadoghq.com/observability_pipelines/packs/alphasoc_findings.md) | AlphaSOC | Any destination | AlphaSOC findings flag DNS and IP threats detected across your network. | | [Amazon CloudFront](https://docs.datadoghq.com/observability_pipelines/packs/amazon_cloudfront.md) | AWS | Any destination | AWS CloudFront logs show requests, cache use, and edge activity. | | [Amazon Connect](https://docs.datadoghq.com/observability_pipelines/packs/amazon_connect.md) | AWS | Any destination | This pack extracts contact and agent signals from Amazon Connect logs, flagging abandoned calls and fraud risk. | | [Amazon VPC Flow Logs](https://docs.datadoghq.com/observability_pipelines/packs/amazon_vpc_flow_logs.md) | AWS | Any destination | Amazon VPC Flow Logs capture network traffic between VPC resources. | | [Argo CD](https://docs.datadoghq.com/observability_pipelines/packs/argo_cd.md) | Argo CD | Any destination | This pack processes Argo CD sync, health, and RBAC events from the application controller and API server. | | [Auth0](https://docs.datadoghq.com/observability_pipelines/packs/auth0.md) | Auth0 | Any destination | Auth0 logs cover login, signup, MFA, and API activity. | | [Aviatrix Controller API Audit](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_controller_api_audit.md) | Aviatrix | Any destination | Aviatrix Controller audit logs capture API commands, user attribution, and results. | | [Aviatrix FQDN Firewall](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_fqdn_firewall.md) | Aviatrix | Any destination | Aviatrix FQDN firewall logs capture egress domain requests and policy enforcement. | | [Aviatrix Gateway Network Stats](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_gateway_network_stats.md) | Aviatrix | Any destination | Aviatrix gateway net stats logs expose per-interface rx/tx bytes, packet counts, and network drop events. | | [Aviatrix Gateway System Stats](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_gateway_system_stats.md) | Aviatrix | Any destination | Aviatrix gateway system stats expose per-gateway CPU, memory, and disk utilization across cloud gateways. | | [Aviatrix L4 Microsegmentation](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_l4_microsegmentation.md) | Aviatrix | Any destination | Aviatrix DCF microsegmentation logs capture east-west policy enforcement across cloud gateways. | | [Aviatrix L7/TLS Inspection](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_l7_tls_inspection.md) | Aviatrix | Any destination | Aviatrix L7/TLS inspection logs capture TLS session context and policy enforcement. | | [Aviatrix Suricata IDS/IPS](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_suricata_ids_ips.md) | Aviatrix | Any destination | Aviatrix Suricata IDS/IPS alerts capture signature hits on gateway network traffic. | | [Aviatrix Tunnel Status](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_tunnel_status.md) | Aviatrix | Any destination | Aviatrix tunnel status logs capture Site2Cloud and transit link state changes, events, and failure causes. | | [Aviatrix VPN Session](https://docs.datadoghq.com/observability_pipelines/packs/aviatrix_vpn_session.md) | Aviatrix | Any destination | Aviatrix VPN gateway logs capture per-user session lifecycles, auth events, and gateway traffic volumes. | | [AWS Application Load Balancer Logs](https://docs.datadoghq.com/observability_pipelines/packs/aws_alb.md) | AWS | Any destination | AWS ALBs capture HTTP request activity routed through them. | | [AWS CloudTrail](https://docs.datadoghq.com/observability_pipelines/packs/aws_cloudtrail.md) | AWS | Any destination | AWS CloudTrail records API calls and account activity across AWS services. | | [AWS CloudWatch Logs](https://docs.datadoghq.com/observability_pipelines/packs/aws_cloudwatch_logs.md) | AWS | Any destination | AWS CloudWatch Logs captures log streams from Lambda, ECS, and more. | | [AWS Config](https://docs.datadoghq.com/observability_pipelines/packs/aws_config.md) | AWS | Any destination | AWS Config monitors and records resource configuration changes. | | [AWS Elastic Load Balancer Logs](https://docs.datadoghq.com/observability_pipelines/packs/aws_elb.md) | AWS | Any destination | AWS ELBs captures HTTP and HTTPS requests from Classic Load Balancers. | | [AWS GuardDuty](https://docs.datadoghq.com/observability_pipelines/packs/aws_guardduty.md) | AWS | Any destination | AWS GuardDuty detects threats in your AWS account. | | [AWS Lambda](https://docs.datadoghq.com/observability_pipelines/packs/aws_lambda.md) | AWS | Any destination | AWS Lambda logs capture invocations, errors, and cold starts. | | [AWS Network Load Balancer Logs](https://docs.datadoghq.com/observability_pipelines/packs/aws_nlb.md) | AWS | Any destination | AWS NLBs captures connection activity and performance data. | | [AWS Route 53](https://docs.datadoghq.com/observability_pipelines/packs/aws_route_53.md) | AWS | Any destination | AWS Route 53 captures DNS queries across your AWS infrastructure. | | [AWS Security Hub](https://docs.datadoghq.com/observability_pipelines/packs/aws_security_hub.md) | AWS | Any destination | AWS Security Hub aggregates security findings across AWS. | | [AWS WAF](https://docs.datadoghq.com/observability_pipelines/packs/aws_waf.md) | AWS | Any destination | AWS WAF captures AWS WAF logs from CloudWatch, S3, or Firehose. | | [Azure NSG](https://docs.datadoghq.com/observability_pipelines/packs/azure_nsg.md) | Azure | Any destination | Azure Network Security Group v2 flow logs record per-connection decisions and byte counts. | | [BlueCat DNS](https://docs.datadoghq.com/observability_pipelines/packs/bluecat_dns.md) | BlueCat | Any destination | BlueCat BDDS syslog captures DNS queries and DHCP leases. | | [Check Point](https://docs.datadoghq.com/observability_pipelines/packs/checkpoint.md) | Check Point | Any destination | This pack processes Check Point logs in CEF format, with or without syslog prefix. | | [Cisco ACI](https://docs.datadoghq.com/observability_pipelines/packs/cisco_aci.md) | Cisco | Any destination | Cisco ACI syslog events capture fabric health, endpoint moves, and admin activity. | | [Cisco ASA](https://docs.datadoghq.com/observability_pipelines/packs/cisco_asa.md) | Cisco | Any destination | Cisco ASA firewall logs capture syslog events for traffic, VPNs, and security alerts. | | [Cisco ASA - Google SecOps](https://docs.datadoghq.com/observability_pipelines/packs/cisco_asa_google_secops.md) | Cisco | Google SecOps | This pack maps Cisco ASA syslog events to the UDM schema in Google Security Operations. | | [Cisco ASA - Microsoft Sentinel](https://docs.datadoghq.com/observability_pipelines/packs/cisco_asa_microsoft_sentinel.md) | Cisco | Microsoft Sentinel | This pack maps parsed Cisco ASA syslog events to the CommonSecurityLog schema in Microsoft Sentinel. | | [Cisco FTD](https://docs.datadoghq.com/observability_pipelines/packs/cisco_ftd.md) | Cisco | Any destination | Cisco FTD syslog events cover access control, intrusion prevention, file detection, and VPN. | | [Cisco IOS](https://docs.datadoghq.com/observability_pipelines/packs/cisco_ios.md) | Cisco | Any destination | Cisco IOS syslog captures security, auth, and routing events. | | [Cisco IOS Traceback](https://docs.datadoghq.com/observability_pipelines/packs/cisco_ios_traceback.md) | Cisco | Any destination | Cisco IOS traceback events signal software faults, memory failures, and CPU issues. | | [Cisco Meraki](https://docs.datadoghq.com/observability_pipelines/packs/cisco_meraki.md) | Cisco | Any destination | Cisco Meraki captures appliance events, flows, VPN firewall, NAT flows, and URL activity. | | [Cisco Meraki - Microsoft Sentinel](https://docs.datadoghq.com/observability_pipelines/packs/cisco_meraki_microsoft_sentinel.md) | Cisco | Microsoft Sentinel | This pack maps parsed Cisco Meraki syslog events to the Syslog table schema in Microsoft Sentinel. | | [Cloudflare](https://docs.datadoghq.com/observability_pipelines/packs/cloudflare.md) | Cloudflare | Any destination | Cloudflare logs show edge traffic, performance, and security. | | [CrowdStrike FDR](https://docs.datadoghq.com/observability_pipelines/packs/crowdstrike.md) | CrowdStrike | Any destination | Falcon Data Replicator (FDR) provides endpoint detection and response. | | [DNS Stream](https://docs.datadoghq.com/observability_pipelines/packs/dns_stream.md) | DNS Stream | Any destination | This vendor-neutral DNS query/response stream includes tunneling and DGA beaconing indicators. | | [Exabeam - Cisco ASA](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_cisco_asa.md) | Cisco | Exabeam | This pack processes Cisco ASA firewall logs sent to Exabeam and filters by ASA code to drop non-actionable syslog noise. | | [Exabeam - CrowdStrike FDR](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_crowdstrike_fdr.md) | CrowdStrike | Exabeam | This pack processes CrowdStrike Falcon Data Replicator events sent to Exabeam and drops sensor and telemetry noise. | | [Exabeam - Fortinet FortiGate](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_fortinet_fortigate.md) | Fortinet | Exabeam | This pack processes FortiGate firewall logs sent to Exabeam and filters out routine traffic and health-check noise. | | [Exabeam - Palo Alto](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_palo_alto.md) | Palo Alto | Exabeam | This pack processes PAN-OS syslog sent to Exabeam and filters empty and duplicate-start traffic logs, leaving raw CSV untouched. | | [Exabeam - SentinelOne Cloud Funnel](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_sentinelone_cloud_funnel.md) | SentinelOne | Exabeam | This pack processes SentinelOne EDR events sent to Exabeam and samples high-volume event types to reduce ingest costs. | | [Exabeam - Windows](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_windows.md) | Windows | Exabeam | This pack processes Windows Event Logs sent to Exabeam and filters to codes Exabeam parsers use, keeping raw XML intact for parsing. | | [Exabeam - Zscaler](https://docs.datadoghq.com/observability_pipelines/packs/exabeam_zscaler.md) | Zscaler | Exabeam | This pack processes Zscaler ZIA web, ZIA DNS, and ZPA logs sent to Exabeam and filters and samples routine traffic. | | [ExtraHop](https://docs.datadoghq.com/observability_pipelines/packs/extrahop.md) | ExtraHop | Any destination | ExtraHop Reveal(x) detections surface network threats and behavioral anomalies. | | [ExtraHop - Microsoft Sentinel](https://docs.datadoghq.com/observability_pipelines/packs/extrahop_microsoft_sentinel.md) | ExtraHop | Microsoft Sentinel | This pack tags ExtraHop Reveal(x) network detections with severity and IPs for Microsoft Sentinel ingestion. | | [F5](https://docs.datadoghq.com/observability_pipelines/packs/f5.md) | F5 | Any destination | F5 logs capture traffic, security policy, and intrusion events. | | [Fastly](https://docs.datadoghq.com/observability_pipelines/packs/fastly.md) | Fastly | Any destination | Fastly CDN logs record client requests, cache states, and delivery performance. | | [Fortinet - Microsoft Sentinel](https://docs.datadoghq.com/observability_pipelines/packs/fortinet_microsoft_sentinel.md) | Fortinet | Microsoft Sentinel | This pack maps FortiGate logs to the CommonSecurityLog schema in Microsoft Sentinel. | | [Fortinet Firewall](https://docs.datadoghq.com/observability_pipelines/packs/fortinet_firewall.md) | Fortinet | Any destination | Fortinet firewall logs record allowed, denied, and other network traffic. | | [GCP Firewall](https://docs.datadoghq.com/observability_pipelines/packs/gcp_firewall.md) | Google Cloud | Any destination | GCP VPC Firewall logs record allowed and denied traffic. | | [Google Cloud Audit](https://docs.datadoghq.com/observability_pipelines/packs/google_cloud_audit.md) | Google Cloud | Any destination | Google Cloud Audit logs capture admin activity and policy violations. | | [Google SecOps - AWS VPC](https://docs.datadoghq.com/observability_pipelines/packs/google_secops_aws_vpc.md) | AWS | Google SecOps | This pack maps AWS VPC flow records to the UDM schema in Google Security Operations. | | [Google SecOps - Fortinet Firewall](https://docs.datadoghq.com/observability_pipelines/packs/google_secops_fortinet_firewall.md) | Fortinet | Google SecOps | This pack maps Fortinet firewall logs to the UDM schema in Google Security Operations. | | [Google SecOps - Palo Alto Firewall](https://docs.datadoghq.com/observability_pipelines/packs/google_secops_palo_alto_firewall.md) | Palo Alto | Google SecOps | This pack remaps PAN-OS logs to the UDM schema in Google Security Operations. | | [Google SecOps - Windows Event Log](https://docs.datadoghq.com/observability_pipelines/packs/google_secops_windows_event_log.md) | Windows | Google SecOps | This pack maps Windows security events to the UDM schema in Google Security Operations. | | [HAProxy Ingress](https://docs.datadoghq.com/observability_pipelines/packs/haproxy_ingress.md) | HAProxy | Any destination | HAProxy Ingress logs record how Kubernetes ingress traffic is routed and served. | | [Infoblox](https://docs.datadoghq.com/observability_pipelines/packs/infoblox.md) | Infoblox | Any destination | Infoblox NIOS syslog captures DNS, DHCP, audit, and CEF activity from appliances. | | [Istio Proxy](https://docs.datadoghq.com/observability_pipelines/packs/istio_proxy.md) | Istio | Any destination | Istio Proxy logs capture inbound and outbound traffic handled by Envoy. | | [Juniper SRX Firewall Traffic Logs](https://docs.datadoghq.com/observability_pipelines/packs/juniper_srx_traffic.md) | Juniper | Any destination | Juniper SRX Firewall records network session data. | | [Kube Proxy](https://docs.datadoghq.com/observability_pipelines/packs/kube_proxy.md) | Kubernetes | Any destination | This pack keeps kube-proxy errors and warnings only, dropping routine iptables sync noise fired every cycle. | | [Microsoft DNS](https://docs.datadoghq.com/observability_pipelines/packs/microsoft_dns.md) | Microsoft | Any destination | This pack parses the classic Windows DNS Server debug text log (dns.log) and decodes query names and response codes. | | [MITRE ATT&CK AWS WAF Enrichment](https://docs.datadoghq.com/observability_pipelines/packs/mitre_attack_aws_waf_enrichment.md) | AWS | Any destination | This pack tags AWS WAF logs with MITRE ATT&CK tactics and techniques. | | [MITRE ATT&CK CloudTrail Enrichment](https://docs.datadoghq.com/observability_pipelines/packs/mitre_attack_cloudtrail_enrichment.md) | AWS | Any destination | This pack tags CloudTrail logs with MITRE ATT&CK tactics and techniques. | | [MITRE ATT&CK FortiGate Enrichment](https://docs.datadoghq.com/observability_pipelines/packs/mitre_attack_fortigate_enrichment.md) | Fortinet | Any destination | This pack tags FortiGate logs with MITRE ATT&CK tactics and techniques. | | [MITRE ATT&CK Okta Enrichment](https://docs.datadoghq.com/observability_pipelines/packs/mitre_attack_okta_enrichment.md) | Okta | Any destination | This pack tags Okta logs with MITRE ATT&CK tactics and techniques. | | [MITRE ATT&CK Palo Alto Enrichment](https://docs.datadoghq.com/observability_pipelines/packs/mitre_attack_palo_alto_enrichment.md) | Palo Alto | Any destination | This pack tags Palo Alto logs with MITRE ATT&CK tactics and techniques. | | [MITRE ATT&CK Windows Enrichment](https://docs.datadoghq.com/observability_pipelines/packs/mitre_attack_windows_enrichment.md) | Windows | Any destination | This pack tags Windows event logs with MITRE ATT&CK tactics and techniques. | | [Netskope](https://docs.datadoghq.com/observability_pipelines/packs/netskope.md) | Netskope | Any destination | Netskope logs capture cloud app use, policies, and security events. | | [NGINX](https://docs.datadoghq.com/observability_pipelines/packs/nginx.md) | NGINX | Any destination | NGINX logs record client requests, responses, and errors from the web server. | | [Okta](https://docs.datadoghq.com/observability_pipelines/packs/okta.md) | Okta | Any destination | Okta logs show authentication, user activity, and policy events. | | [OpenAI - Audit Logs](https://docs.datadoghq.com/observability_pipelines/packs/openai_audit_logs.md) | OpenAI | Any destination | This pack flags failed logins, new API keys, and privilege changes from OpenAI organization audit logs. | | [OpenTelemetry Logs](https://docs.datadoghq.com/observability_pipelines/packs/opentelemetry_logs.md) | OpenTelemetry | Any destination | OTLP/JSON logs nest events under resourceLogs, scopeLogs, and logRecords arrays, three levels deep per payload. | | [Orca Security](https://docs.datadoghq.com/observability_pipelines/packs/orca_security.md) | Orca Security | Any destination | This pack normalizes Orca Security cloud findings for SIEM and data lake routing. | | [Palo Alto Cortex](https://docs.datadoghq.com/observability_pipelines/packs/palo_alto_cortex.md) | Palo Alto | Any destination | Cortex XDR alerts include severity, MITRE ATT&CK mapping, and source/destination context. | | [Palo Alto Firewall](https://docs.datadoghq.com/observability_pipelines/packs/palo_alto_firewall.md) | Palo Alto | Any destination | Palo Alto firewall logs capture traffic, threat, and system events. | | [Palo Alto Networks - Microsoft Sentinel](https://docs.datadoghq.com/observability_pipelines/packs/palo_alto_microsoft_sentinel.md) | Palo Alto | Microsoft Sentinel | This pack maps PAN-OS logs to the CommonSecurityLog schema in Microsoft Sentinel. | | [Palo Alto Networks - XSIAM](https://docs.datadoghq.com/observability_pipelines/packs/palo_alto_xsiam.md) | Palo Alto | Cortex XSIAM | This pack remaps PAN-OS logs to the Cortex XSIAM flat JSON schema. | | [Proofpoint Email Security](https://docs.datadoghq.com/observability_pipelines/packs/proofpoint_email_security.md) | Proofpoint | Any destination | Proofpoint Email Security logs capture email threats, phishing, and malware detections. | | [Qualys Detections](https://docs.datadoghq.com/observability_pipelines/packs/qualys_detections.md) | Qualys | Any destination | This pack surfaces new, confirmed, and reopened Qualys vulnerability detections, dropping low-severity noise. | | [SentinelOne Cloud Funnel EDR](https://docs.datadoghq.com/observability_pipelines/packs/sentinel_one.md) | SentinelOne | Any destination | SentinelOne Cloud Funnel streams EDR and Deep Visibility events as JSON to cloud storage. | | [Syslog](https://docs.datadoghq.com/observability_pipelines/packs/syslog.md) | Syslog | Any destination | This pack parses generic RFC 3164/5424 syslog with severity mapping and a log-volume metric. | | [Windows DNS Log](https://docs.datadoghq.com/observability_pipelines/packs/windows_dns_log.md) | Windows | Any destination | The Windows DNS Server analytic log covers queries, zone transfers, and dynamic updates. | | [Windows Office 365](https://docs.datadoghq.com/observability_pipelines/packs/windows_office_365.md) | Microsoft | Any destination | This pack flags high-risk Microsoft 365 (M365) Unified Audit Log events: mail-forwarding rules, delegation, and role changes. | | [Windows XML](https://docs.datadoghq.com/observability_pipelines/packs/windows_xml.md) | Windows | Any destination | Windows Event logs capture system, application, and security activity from Windows hosts. | | [WinEventLog](https://docs.datadoghq.com/observability_pipelines/packs/wineventlog.md) | Windows | Any destination | Windows Event Log captures authentication, process creation, and account management events. | | [ZScaler ZIA DNS](https://docs.datadoghq.com/observability_pipelines/packs/zscaler_zia_dns.md) | Zscaler | Any destination | ZScaler Internet Access (ZIA) DNS logs capture org-wide DNS activity and policy actions. | | [Zscaler ZIA Firewall](https://docs.datadoghq.com/observability_pipelines/packs/zscaler_zia_firewall.md) | Zscaler | Any destination | Zscaler Internet Access (ZIA) Firewall logs show network traffic and security events. | | [Zscaler ZIA Tunnel](https://docs.datadoghq.com/observability_pipelines/packs/zscaler_zia_tunnel.md) | Zscaler | Any destination | Zscaler Internet Access (ZIA) Tunnel logs show tunnel health, traffic, and key events. | | [Zscaler ZIA Web Logs](https://docs.datadoghq.com/observability_pipelines/packs/zscaler_zia_web_logs.md) | Zscaler | Any destination | Zscaler Internet Access (ZIA) Web Logs capture user web activity and security actions. | | [Zscaler ZPA](https://docs.datadoghq.com/observability_pipelines/packs/zscaler_zpa.md) | Zscaler | Any destination | Zscaler Private Access captures private app access, sessions, and connections. | SourceAll Abnormal.ai Active Directory Akamai AlphaSOC Argo CD Auth0 Aviatrix AWS Azure BlueCat Check Point Cisco Cloudflare CrowdStrike DNS Stream ExtraHop F5 Fastly Fortinet Google Cloud HAProxy Infoblox Istio Juniper Kubernetes Microsoft Netskope NGINX Okta OpenAI OpenTelemetry Orca Security Palo Alto Proofpoint Qualys SentinelOne Syslog Windows ZscalerDestinationAll Any destination Cortex XSIAM Exabeam Google SecOps Microsoft Sentinel ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Rehydrate archived logs in any SIEM or logging vendor with Observability Pipelines](https://www.datadoghq.com/blog/rehydrate-archived-logs-with-observability-pipelines)