Skip to content
LogSeam

Connect the source. Skip the mapping project.

LogSeam already knows the common log sources: which fields hold the users, addresses and hosts your analysts search on.

The bucket you pick
The pipeline
The data lake
Searches, detection rules and investigations

Inputs

Log sources, grouped by what they cover. Your searches, detection rules and investigations run on them.

Network & Firewall

  • Aruba ClearPass
  • AWS VPC Flow
  • Azure NSG Flow
  • Cato SASE
  • Check Point Quantum
  • Cisco AnyConnect
  • Cisco ASA/Firepower
  • Cisco ISE
  • Corelight
  • Darktrace
  • FortiGate
  • GCP VPC Flow
  • GlobalProtect
  • Illumio
  • Juniper SRX
  • Meraki MX
  • NetFlow/IPFIX/sFlow
  • Palo Alto NGFW
  • SonicWall
  • Sophos XGS
  • Suricata
  • Thinkst Canary
  • Vectra AI
  • WatchGuard
  • Windows Firewall
  • Zeek
  • Zscaler ZPA

Identity & Access

  • 1Password Events
  • Active Directory
  • Auth0
  • AWS IAM
  • BeyondTrust PRA
  • CyberArk PAM
  • Defender for Identity
  • Delinea Secret Server
  • Duo
  • Entra ID
  • Entra ID Governance
  • ForgeRock
  • JumpCloud
  • Okta
  • Okta System Log
  • OneLogin
  • Ping Identity
  • SailPoint

Endpoint

  • Carbon Black
  • Cortex XDR
  • CrowdStrike Falcon Insight
  • Defender for Endpoint
  • Elastic Defend
  • Intune
  • Linux auditd
  • Linux syslog/journald
  • macOS Unified Log
  • osquery
  • PowerShell Script Block
  • SentinelOne
  • Sophos Intercept X
  • Sysmon
  • Trellix
  • Trend Micro Vision One
  • Wazuh
  • Windows Security Log

Cloud & SaaS

  • AWS Config
  • Azure Activity
  • Box
  • CloudTrail
  • Defender for Cloud
  • GCP Audit
  • GCP SCC
  • GitHub Audit
  • Google Workspace
  • GuardDuty
  • Lacework
  • O365 Unified Audit
  • Prisma Cloud
  • Salesforce Event Log
  • Security Hub
  • Slack Audit
  • Wiz

Infrastructure

  • ArgoCD
  • Cribl Stream Audit
  • Docker
  • EKS Audit
  • Falco
  • HashiCorp Vault
  • Istio
  • Kubernetes Audit
  • Lambda
  • Terraform Cloud
  • Veeam

Web

  • Akamai
  • Apache
  • AWS WAF
  • Azure WAF
  • Cloudflare Gateway
  • Cloudflare WAF
  • F5 ASM
  • HAProxy
  • NGINX
  • Zscaler ZIA

Vulnerability

  • AWS Inspector
  • CrowdStrike Spotlight
  • Defender Vulnerability Management
  • GitGuardian
  • Qualys VMDR
  • Semgrep
  • Tenable.io
  • Veracode

Threat intelligence feeds

  • AbuseIPDB
  • Anomali ThreatStream
  • ANY.RUN
  • CrowdStrike Falcon Intelligence
  • DomainTools
  • GreyNoise
  • MISP
  • VirusTotal

Email

  • Abnormal
  • Barracuda
  • Check Point Harmony Email
  • Cisco Secure Email
  • Defender for Office 365
  • DMARC reports
  • Mimecast
  • Proofpoint TAP

DNS

  • Cisco Umbrella
  • Cloudflare DNS Firewall
  • CoreDNS
  • Infoblox
  • Route 53 Resolver
  • Windows DNS

Data security

  • AWS Macie
  • Code42 Incydr
  • Netskope
  • Purview DLP
  • Snowflake Access History
  • Symantec DLP

Ticketing audit logs

  • Jira Service Management
  • PagerDuty
  • ServiceNow ITSM
  • Splunk SOAR
  • XSOAR

Asset inventory

  • Armis
  • Axonius
  • runZero
  • ServiceNow CMDB

Certificates

  • AWS ACM / Private CA

SIEM

Their data can be moved into LogSeam.

  • IBM QRadar
  • Microsoft Sentinel
  • Splunk

Enrichment

What the providers listed here say about an IP address, domain, file hash or URL. Looked up during an investigation.

Only providers set up in your LogSeam account are asked. A lookup sends the provider the indicator, not the log it came from.

Answers are stored and reused, so one can be hours or days old.

  • abuse.ch
  • AbuseIPDB
  • AlienVault OTX
  • GreyNoise
  • IPinfo
  • MISP
  • Recorded Future
  • Shodan
  • URLScan
  • VirusTotal

Outputs

Where LogSeam sends alerts: Slack, Microsoft Teams, PagerDuty, email, or a webhook at a URL you set.

A webhook can carry a bearer token, an API key or basic auth.

  • Email
  • Microsoft Teams
  • PagerDuty
  • Slack
  • Webhook

Models

Set the model for each kind of work, run it on your own provider key, and see what each agent spends and who changed a model.

  • Anthropic
  • AWS Bedrock
  • Groq
  • MiniMax
  • Ollama Cloud
  • OpenAI
  • OpenRouter

The catalog lists every log source LogSeam knows today.

Each is one product or log type, so a vendor can appear more than once. CrowdStrike is listed under Endpoint, Vulnerability and Threat intelligence feeds.

Each keeps its own field names. None is flattened into a common schema.

  • VirusTotal, AbuseIPDB, GreyNoise and MISP are listed twice: as log sources under Threat intelligence feeds, and as Enrichment providers.
  • PagerDuty is listed twice: its audit log under Ticketing audit logs, and under Outputs.
  • ServiceNow ITSM, ServiceNow CMDB and Jira Service Management are log sources only. None is an output.

Every new source is a project.

A new source means a parser, a field map to your schema and a ticket in someone's queue, while the security team waits to search it. Multiply that by every tool the business buys.

Today

  1. New source
  2. Parser
  3. Field map
  4. Ticket queue
  5. Searchable

With LogSeam

  1. New source
  2. Searchable and watched

If you can't search it, you can't investigate it.

Sources arrive known, not mapped.

Ready when it lands. A connected source arrives ready to search. No schema to map to. Logs keep each vendor's own field names, a folder for each source. Searchable in plain language. Ask about a user or an address and LogSeam knows where to look. Watched, not just stored. Detection rules are written for each source you connect.

What if our source isn't listed?

LogSeam takes any source that sends JSON. A custom source is reviewed with you before it is set up.