Keystone integrations
34 integrations in the public catalog. Customers sign in to download them.
9 of 9 integrations
- AWS EventBridge (inbound event source) AWS events through an EventBridge API destination: CloudWatch alarm state changes, GuardDuty and Security Hub findings, AWS Health and EC2 state changes, and anything else as external.aws.event.
- Azure Event Grid (inbound event source) Azure resource and service events from an Event Grid subscription: resources written or deleted, blobs created, and anything else as external.azure.event.
- Azure Monitor (inbound event source) Alerts from an Azure Monitor action group's webhook, in the common alert schema, as external.azure.alert_fired and external.azure.alert_resolved. Give the action group the endpoint's address, token included, and turn on the common alert schema.
- GitHub (inbound event source) Pushes, published releases and finished workflow runs from a repository or organization webhook, as external.github.push, external.github.release and external.github.workflow_run. Content type application/json; paste the endpoint's secret into the webhook's Secret.
- NetFlow, IPFIX and sFlow (through an edge adapter) (inbound event source) Flow records summarised at the edge (the netflow-adapter pack: goflow2 collects NetFlow v5/v9, IPFIX and sFlow; Vector reduces them per minute to the top talkers).
- OpenTelemetry (OTLP/HTTP) (inbound event source) Metrics from an OpenTelemetry Collector or SDK over OTLP/HTTP, as protobuf or JSON, gzip or not: gauges, cumulative sums (as counters) and histograms (as .count and .sum counters), written into one metric object.
- Prometheus Alertmanager (inbound event source) Each alert in an Alertmanager webhook notification becomes an event: external.alertmanager.firing or external.alertmanager.resolved. Give Alertmanager the endpoint's address, token included, as a webhook_config url.
- SNMP traps (inbound event source) SNMP traps from network devices, forwarded by a Keystone trap relay installed near them (trap-relay/README.md): interfaces down and up, restarts, authentication failures, and any other trap as external.snmp.trap.
- Syslog (through an edge adapter) (inbound event source) Syslog lines that an edge adapter near the senders chose to forward (the syslog-adapter pack: Vector, filtering and classifying at the edge).
No integrations match . Show all integrations