Integrations
Find the integration you need before you build a pipeline: filter by where data comes from or goes (source, destination, processor), documentation category (for example Windows Events groups Event Log, DNS, and DHCP; Observability lists APM-style destinations such as New Relic, SigNoz, and HPE OpsRamp; Security includes SIEM and data-lake destinations such as Google SecOps, Splunk HEC, Microsoft Sentinel, and flows aligned with AWS Security Lake), platform, and telemetry signal (logs, metrics, traces).
Each card links to a full reference page; names match that page title. Where the same name exists for both a source and a destination (for example AWS S3), a small Source / Destination chip clarifies which page you are opening.
Tip: Categories here help you browse this documentation. They are not identical to how nodes are grouped in the Praxis palette.
86 integrations found
AWS
AWS S3
DestinationExport telemetry data to Amazon S3 object storage.
AWS Security Lake
Write OCSF Parquet objects to Amazon Security Lake custom sources using the mandated S3 partition layout.
AWS CloudWatch
Collect telemetry from Amazon CloudWatch services.
AWS Inventory
Collect EC2 instances, VPCs and IAM users, roles and groups from an AWS account.
AWS S3
SourceIngest telemetry data from objects stored in S3 buckets.
Azure
Azure Blob Storage
DestinationWrite OTLP JSON or protobuf blobs to Azure Storage containers, with templated blob paths and gzip/zstd compression.
Azure Data Explorer
Ingest logs, metrics and traces into an Azure Data Explorer (Kusto) database, one table per signal.
Azure Monitor
Send logs, metrics and traces to Azure Application Insights as envelope telemetry.
Azure Blob Storage
SourceRead log blobs from an Azure Storage container by polling or Event Grid notifications, including Azure diagnostic archives.
Data Warehouse
Google Cloud
Google Cloud Storage
DestinationShip telemetry payloads to Google Cloud Storage buckets.
GCP Inventory
Collect Compute Engine, Cloud Storage and IAM assets from Cloud Asset Inventory as Google SecOps entity context.
Google Cloud Pub/Sub
Consume telemetry payloads from Pub/Sub subscriptions.
Google Cloud Storage
SourceRead telemetry files from Google Cloud Storage buckets.
Host and File Logs
Kubernetes
K8s App Metrics
Collect application-level metrics from Kubernetes workloads.
K8s Cluster
Collect Kubernetes cluster telemetry.
K8s Events
Ingest Kubernetes event stream for operational monitoring.
K8s Kubelet Stats
Collect node and pod statistics from kubelet endpoints.
K8s Logs
Collect container logs directly from Kubernetes clusters.
K8s OTLP
Receive logs, metrics, and traces from instrumented K8s workloads via OTLP.
Messaging
Network
Network and Security
Observability
OpenTelemetry
Processing
Add Fields
Add custom fields to telemetry records.
Batch
Batch telemetry records before export for efficient delivery.
Copy Fields
Copy fields within telemetry payloads.
CSV Transform
Parse and transform CSV telemetry payloads.
Delete Fields
Remove unwanted fields from logs, metrics, or traces.
Filter By Condition Logs
Filter log records using OTTL conditions.
Filter By Condition Metrics
Filter metric records using OTTL conditions.
Filter By Condition Traces
Filter trace records using OTTL conditions.
Filter By Severity
Filter logs by severity criteria.
Google SecOps Standardization
Map logs to Google SecOps ingestion labels and schema.
K8s Attributes
Enrich telemetry with Kubernetes metadata.
Log Deduplication
Reduce duplicate log noise before export.
Lookup
Enrich records using external lookup mappings.
Masking
Mask sensitive fields in telemetry payloads.
OTTL Transform
Apply custom OTTL transformations.
Parse JSON
Parse JSON payloads into structured fields.
Parse Timestamp
Parse and normalize event timestamps from payload fields.
Parse With Regex
Extract structured fields using regex patterns.
Rename Fields
Rename fields in telemetry payloads.
Replace Fields
Replace field values using matching rules.
Resource Detection
Auto-detect and attach resource metadata.
Set Severity
Map field values to OpenTelemetry severity levels.
Set Trace Context
Set trace_id and span_id for log-to-trace correlation.
Security
Google SecOps
Forward logs to Google SecOps (Chronicle) over gRPC or HTTPS (ImportLogs).
Google SecOps Data Processor Integration
Link SecOps pipeline output to a configured Google SecOps data processing integration.
Microsoft Sentinel
Send OCSF-shaped logs to Microsoft Sentinel via the Azure Monitor Logs Ingestion API (DCE, DCR streams).
Splunk HEC
Export logs to Splunk using the HTTP Event Collector (HEC).
Active Directory Inventory
Snapshot every computer object in an Active Directory domain over LDAP, classified as domain controller, server or workstation, with simple, NTLM, Kerberos or Windows integrated authentication.
CrowdStrike Falcon
Stream Falcon detections, incidents and audit events from the Event Streams API over a long-lived datafeed connection.
Duo
Poll the Duo Admin API for MFA authentication logs — logins, denials, enrollments and fraud reports — and resume from the last delivered record.
Google SecOps Detections
Pull rule and curated detections from another Google SecOps instance through the Chronicle API, for a custom log type such as CHRONICLE_DETECTIONS_CUSTOM.
Huntress
Collect Huntress Managed EDR incident reports — endpoint, identity, email and SIEM threats the Huntress SOC confirmed — with every update, from the Huntress API.
Microsoft Entra ID
Fetch Entra ID users (with managers) for Google SecOps AZURE_AD_CONTEXT, and optionally groups, devices and admin role assignments, from Microsoft Graph.
Microsoft Graph Security Alerts
Collect Microsoft Defender XDR alerts (Endpoint, Identity, Office 365, Sentinel and more) from the Microsoft Graph security API for Google SecOps MICROSOFT_GRAPH_ALERT.
Obsidian Security
Poll the Obsidian Security API for alerts, SaaS events and Obsidian audit logs, and resume from the last delivered record.
Okta
Poll the Okta System Log API for identity and access events — sign-ins, MFA, admin changes — with cursor-based resumption.
SecOps Streams
Define stream selection for Google SecOps pipelines by log type and ingestion method.
Splunk HEC Source
Expose a Splunk-compatible HTTP Event Collector endpoint so Splunk forwarders post events into the praxis-collector unchanged.
Splunk Search API
Pull events from an existing Splunk deployment via the REST search API. One-shot backfill or continuous polling. Used to migrate Google/Chronicle Forwarder Splunk collectors.
Wazuh
Collect security events and telemetry from Wazuh pipelines.
Webhook
Auth0
Receive Auth0 events through webhook-driven ingestion.
Cisco Meraki
Receive Cisco Meraki alerts and events through webhooks.
HTTP Listener
Accept generic webhook and HTTP payload integrations.
HubSpot
Ingest HubSpot webhook events for observability workflows.
Jira
Ingest Jira webhook payloads and issue events.