The universal agent that turns endpoint logs into detection

Sources the agent reads on the host, and listeners for devices that cannot run one.

• filetail Core

  Tails plain-text log files (application logs, web server logs, Kubernetes container logs) and forwards each line as an event, surviving file rotation and agent restarts.

• http_in Core

  Accepts log lines pushed over HTTP(S), for sources such as webhooks, IoT/edge devices and app log shippers that cannot run the agent or speak syslog.

• journald Core

  Reads the Linux systemd journal and forwards each entry as an event, resuming exactly where it left off after a restart.

• syslog_in Core

  Listens for incoming syslog (RFC 5424/3164 over TCP/UDP, or a local unix socket) so the agent can act as a gateway for devices that cannot run an agent themselves.

• etw Apex

  Streams Windows ETW (Event Tracing for Windows) kernel and application telemetry in real time, capturing high-volume activity such as process creation, network connections and DNS that never reaches the Windows Event Log.

• linux_audit Apex

  Collects Linux kernel audit records - process executions, file-access watches, logins, privilege changes - reassembled into one structured event per audit event.

• modbus_in Apex

  Polls Modbus TCP/RTU industrial devices (PLCs, RTUs, meters) and emits events only on meaningful register changes, threshold crossings or device outages, never a raw telemetry stream. Read-only by construction.

• mqtt_in Apex

  Subscribes to an MQTT broker and turns each published message into an event, the common ingest shape for IoT/edge sensors and devices.

• oslog Apex

  Reads the macOS unified log, backfilling the gap since the agent's last run and then following new entries live.

• relay_in Apex

  Receives events over the agent's own acknowledged relay transport, so a gateway agent can concentrate traffic from edge agents with guaranteed delivery instead of best-effort TCP.

• snmptrap_in Apex

  Listens for SNMP traps and informs (v1/v2c/v3) from network and OT devices - switches, firewalls, UPSes, PLC gateways - and turns each notification into an event.

• windows_eventlog Apex

  Collects the Windows Event Log, the OS's structured record of system, security and application activity including Sysmon, with live subscription and resumable checkpoints.

• wmi Apex

  Polls Windows Management Instrumentation (WMI) via WQL queries for system-inventory and live-state data: running services, installed hotfixes, disk usage, hardware.

Parsing, field shaping and volume reduction, applied at the edge before anything leaves the host.

• add_fields Core

  Stamps static key/value fields such as tenant, site or environment onto every event so it stays attributable downstream.

• expr Core

  Applies simple conditional rules to set, remove or rename fields, or drop events, based on their content.

• filter Core

  Drops events by severity ceiling or field value, the simplest way to cut noise at the edge.

• parse_csv Core

  Parses delimited (CSV/TSV/W3C) message text into structured, queryable fields.

• parse_json Core

  Explodes a JSON log line into structured fields.

• parse_kv Core

  Splits key=value formatted log text into structured fields.

• parse_xml Core

  Flattens an XML log payload into structured, dotted-path fields.

• adaptive_sample Apex

  Automatically adjusts the sampling rate to hold event volume near a target as traffic rises and falls, keeping both the start and the tail of a burst visible.

• dedup Apex

  Drops duplicate events sharing the same key within a time window, keeping only the first occurrence.

• lookup Apex

  Enriches events by joining a field's value against a local table such as an asset inventory or CMDB export, e.g. turning a hostname into its owning team and environment.

• quota Apex

  Enforces a hard daily volume cap, in events and/or bytes, on a pipeline, dropping events once the budget is spent.

• redact Apex

  Removes or masks sensitive values such as emails, credit card numbers or custom patterns from events before they leave the endpoint.

• sample Apex

  Keeps a configurable 1-in-N fraction of events, either sequentially or consistently by key, to thin high-volume sources.

• throttle Apex

  Caps the rate of events passed per key, or globally, within a time window, dropping the excess.

• trim_fields Apex

  Shrinks event size by dropping unwanted fields and truncating oversized values.

Standard syslog to any aggregator, or straight into a named platform's own ingest API.

• syslog Core

  Forwards every event as standard RFC 5424 syslog over TCP (with TLS/mTLS) or UDP, the vendor-neutral default output any aggregator or SIEM accepts.

• hec Apex

  Forwards events to Splunk's HTTP Event Collector, with an optional indexer-acknowledgment mode for confirmed-indexed delivery.

• kafka Apex

  Produces events to an Apache Kafka (or Kafka-compatible) topic with per-record delivery acknowledgment and at-least-once retry.

• loki Apex

  Pushes events to Grafana Loki's ingest API as labeled log streams.

• otlp Apex

  Forwards events as OpenTelemetry Protocol (OTLP) logs, over gRPC or HTTP, to any OTel-native collector or backend.

• relay Apex

  Sends events to another agent over an acknowledged reliable transport, for hops such as an unreliable WAN or an edge-to-hub link where plain TCP syslog isn't safe enough.

• s3 Apex

  Writes event batches as objects to an S3 (or S3-compatible) bucket for archive and data-lake pipelines, including a native AWS Security Lake OCSF/Parquet feed.

• sentinel Apex

  Sends events to Microsoft Sentinel / Azure Monitor Logs via the Logs Ingestion API.

• snare Apex

  Emits events in the legacy Snare format for SIEMs already built to parse an NXLog/Snare feed.

• xsiam Apex

  Sends events to a Palo Alto Cortex XSIAM tenant via its HTTP log collector.