Cloud SIEM Content Packs provide out-of-the box content for key security integrations. Depending on the integration, a Content Pack can include the following:
Detection Rules to provide comprehensive coverage of your environmentAn interactive dashboard with detailed insights into the state of logs and security signals for the Content Pack Investigator , an interactive graphical interface for investigating suspicious activity by a user or resourceWorkflow Automation , to automate actions and accelerate investigation and remediation of issuesConfiguration guides Content Packs are grouped into the following categories:
Cloud Audit : AWS CloudTrail, Azure Security, GCP Audit Logs, Kubernetes Audit LogsCloud Security : Google Security Command Center, WizAuthentication : 1Password, Auth0, Cisco DUO, JumpCloud, OktaCollaboration : Google Workspace, Microsoft 365, Slack Audit LogsNetwork : Check Point Quantum Firewall, Cisco Meraki, Cisco Secure Firewall, Cisco Umbrella DNS, Cloudflare, Palo Alto Networks Firewall, Palo Alto Panorama, ZeekWeb Security : NGINXCloud developer tools : GitHubEndpoint : CrowdStrikeMonitor the security and compliance levels of your AWS operations.
The AWS CloudTrail Content Pack includes:
Protect your Azure environment by tracking attacker activity.
The Azure Security Content Pack includes:
Protect your GCP environment by monitoring audit logs.
The GCP Audit Logs Content Pack includes:
Gain coverage by monitoring audit logs in your Kubernetes control plane.
The Kubernetes Audit Logs Content Pack includes:
Track and analyze Google Security Command Center findings.
The Google Security Command Center Content Pack includes:
View and monitor Wiz audit logs and issues, including toxic combinations.
The Wix Content Pack includes:
Monitor account activity with 1Password Events Reporting.
The 1Password Content Pack includes:
Monitor and generate signals around Auth0 user activity.
The Auth0 Content Pack includes:
Monitor and analyze MFA and secure access logs from Cisco DUO.
The Cisco DUO Content Pack includes:
Tracks user activity by monitoring JumpCloud audit logs.
The JumpCloud Content Pack includes:
Track user activity by monitoring Okta audit logs.
The Okta Content Pack includes:
Optimize your security monitoring within Google Workspace.
The Google Workspace Content Pack includes:
Monitor key security events from Microsoft 365 logs.
The Microsoft 365 Content Pack includes:
View, analyze, and monitor Slack audit logs.
The Slack Content Pack includes:
Monitor and alert on your network’s Check Point Quantum firewalls.
The Check Point Quantum Firewall Content Pack includes:
Monitor Cisco Meraki logs and identify attacker activity.
The Cisco Meraki Content Pack includes:
Gain insights into Cisco Secure Firewall logs.
The Cisco Secure Firewall Content Pack includes:
Collect and monitor logs from Cisco Umbrella to gain insights into DNS and Proxy logs.
The Cisco Umbrella Content Pack includes:
Enhance security for your web applications.
The Cloudflare Content Pack includes:
Analyze traffic and detect threats with Palo Alto Networks Firewall.
The Palo Alto Networks Firewall Content Pack includes:
Monitor and detect your Palo Alto Panorama firewalls.
The Palo Alto Panorama Content Pack includes:
Analyze and store Corelight / Zeek logs to gain insights into network threats.
The Zeek Content Pack includes:
Monitor and respond to web-based risks with NGINX.
The NGINX Content Pack includes:
Monitor, secure, and optimize your Atlassian’s Jira and Confluence environments.
The Atlassian Jira and Confluence Audit Records Content Pack includes:
Track user activity and code change history by monitoring GitHub audit logs.
The GitHub Content Pack includes:
Collect Snowflake logs to monitor for threats, conduct hunts, and perform investigations.
The Snowflake Content Pack includes:
Improve the security posture of your endpoints with CrowdStrike.
The CrowdStrike Content Pack includes:
Endpoint security and mobile threat defense (MTD) for Mac and mobile devices.
The Jamf Protect Content Pack includes:
Integrate SentinelOne Singularity Endpoint alerts and threats into Cloud SIEM.
The SentinelOne Content Pack includes:
Monitor and analyze your Windows system for potential threats with Windows Event Logs.
The Windows Event Logs Content Pack includes:
Additional helpful documentation, links, and articles:
