Skip to content

Docs
Integrations

GitHub Discord LinkedIn

Select theme

Guides
- Quickstart
- Setup
  - Create an account
  - Size a node
  - Provision a node
  - Deploy a node
    
    Ansible
    Azure
    Docker
    Linux
    macOS
  - Configure a node
  - Start the node API
  - Tune node performance
  - Deploy the platform
- Usage
  - Basics
    
    Run pipelines
    Manage a pipeline
    Install a package
    Collect metrics
  - Data
    
    Shape data
    Parse nested data
    Deduplicate events
  - Storage
    
    Import into a node
    Export from a node
    Show available schemas
    Transform data at rest
  - Security
    
    Enrich with Network Inventory
    Enrich with Threat Intel
    Execute Sigma rules
- Contribution
- Development
Tutorials
- Map Data to OCSF
- Write a Package
Explanations
- Architecture
- Configuration
- Enrichment
- Packages
- Glossary
- FAQs
Reference
- Language
- Configuration
- Platform CLI
- API
  - Node
    
    Overview
    
    Operations
    
    Returns a success response
    Create a new pipeline
    Delete an existing pipeline
    Launch a new pipeline
    List all existing pipelines
    Reset the TTL of an existing pipeline
    Update pipeline state
    Return data from a pipeline

GitHub Discord LinkedIn

Select theme

Overview
Integrations
- Amazon
- Google
  - Cloud Storage
  - Pub/Sub
- Microsoft
  - Azure
    
    Blob Storage
    Log Analytics
  - Defender
  - Windows Event Logs
- AMQP
- Elasticsearch
- Email
- File
- Fluent Bit
- FTP
- Graylog
- HTTP(S)
- Kafka
- Network Interface
- OpenSearch
- Snowflake
- Splunk
- Suricata
- TCP
- UDP
- Velociraptor
- Zeek
- ZeroMQ
- Zscaler

GitHub Discord LinkedIn

Select theme

On this page

Overview

On this page

Overview

Quickstart

WIP

This page is still work in progress.

Last updated: Mar 6, 2025