The SOC's coverage is only as good as the telemetry it receives. This reference lists supported sources, the detections each enables, and how to connect them. Everything here lands in the same cross-vendor log ingestion and normalization layer, where events are parsed and enriched with asset, identity, and threat-intelligence context before a rule ever runs. Connect identity and endpoints first — they carry the highest-value signal.
Identity
| Provider | Method | Key signals |
|---|---|---|
| Microsoft Entra ID | OAuth connector (read-only) | Sign-ins, MFA, risky users, role changes |
| Okta | API token connector | Auth events, MFA, admin changes |
| Google Workspace | Service-account connector | Login, admin audit, OAuth grants |
Connecting identity enables detections for impossible-travel sign-ins, MFA fatigue, privilege escalation, and suspicious OAuth grants.
Endpoints
| Source | Method | Notes |
|---|---|---|
| intSignal Security Suite | Native | On by default, no setup |
| Microsoft Defender for Endpoint | API integration | Streaming API + ingest key |
| Third-party EDR | Integration + ingest key | Check availability with your engineer |
Endpoint telemetry drives process-behavior, malware, persistence, and lateral-movement detections.
Network
- Firewalls — forward traffic and threat logs via syslog to a collector.
- DNS — forward query logs to detect tunneling and known-bad domains.
- Proxies / secure web gateways — forward access logs.
Cloud
| Platform | Log | Method |
|---|---|---|
| AWS | CloudTrail (+ GuardDuty) | Cross-account role or S3 forwarding |
| Azure | Activity + sign-in logs | Diagnostic settings to event hub |
| GCP | Cloud Audit Logs | Pub/Sub export |
SaaS
Connect business-critical SaaS — email, file storage, and collaboration — to catch account takeover, data exfiltration, and malicious sharing.
Note
Do not have a source listed here? Ask your onboarding engineer — new integrations are added regularly, and generic syslog/HTTP ingestion covers many sources not named above.
Connecting a source
Most connectors are added in Portal → Settings → Integrations: choose the source, authorize or paste credentials, then confirm green data health under SOC → Data health. See Getting started for the recommended order.