SIEM / XDR

Connect your SIEM or XDR platform to Zaun for log ingestion, alert correlation, and threat detection.

CrowdStrike Falcon LogScale

Category: SIEM (formerly Humio) | Auth: API Key

Required Credentials

Field	Description
Personal API Token	For querying/searching data (inherits user role permissions)
LogScale URL	Your LogScale instance base URL

Capabilities

Feature	Description
Repository Discovery	Enumerate all repositories and views via GraphQL
Streaming Search	Real-time queries with field statistics
Async Query Jobs	Create background queries with paginated results (JSON, CSV, NDJSON)

Supports LogScale query language: filtering, pipe operators, groupBy, fieldstats, timechart. Relative time ranges: 36hours, 7days, etc.

Setup Steps

In LogScale, click user icon > Manage your account.
Go to Personal API Token > Reset Token > copy the token.
Ensure the user has read access to the repositories you want Zaun to query.
Paste Token and URL into Zaun. Auth: Authorization: Bearer <token>

Large aggregation queries block until complete. For big datasets, enable allowEventSkipping for faster results.

Devo

Category: SIEM / Log Analytics | Auth: Token Auth

Required Credentials

Field	Description
Authentication Token	Scoped to specific tables
Devo Domain URL	Your Devo instance endpoint (e.g. `https://apiv2-us.devo.com`)

Capabilities

Feature	Description
LINQ Queries	Execute queries against Devo tables with epoch or ISO 8601 timestamps
Table Discovery	Discover available tables and their field definitions
Query Jobs	List and monitor scheduled/running query jobs

Response formats: json/compact, json/simple, csv, tsv. Table names use domain.table format.

Setup Steps

Log in to Devo > Administration > Credentials > Tokens.
Click New Token. Set Name, Authorized User, and Target Table(s) (e.g. siem.logtrust.*).
Copy the token and paste into Zaun along with your domain URL.

Token must include access to siem.logtrust.alert.info for health checks to pass.

Rapid7 InsightIDR

Category: SIEM / XDR | Auth: API Key

Required Credentials

Field	Description
API Key	Platform API key (User Key or Org Key)
Region	Select from the regional endpoints below

Auth header: X-Api-Key: <key>

Regional Endpoints

Region	API Base URL
US-1	`us.api.insight.rapid7.com`
US-2	`us2.api.insight.rapid7.com`
US-3	`us3.api.insight.rapid7.com`
EU	`eu.api.insight.rapid7.com`
CA	`ca.api.insight.rapid7.com`
AU	`au.api.insight.rapid7.com`
AP	`ap.api.insight.rapid7.com`

Capabilities

Feature	Description
Investigations	Search, view, update investigations (status, priority, disposition, assignee)
Alerts	List alerts and Rapid7 product alerts per investigation
Comments	Create, list, manage investigation comments (PUBLIC/PRIVATE visibility)
Discovery	Enumerate investigation sources, alert types, detection rules

Investigation statuses: OPEN, INVESTIGATING, WAITING, CLOSED. Priorities: LOW, MEDIUM, HIGH, CRITICAL.

Setup Steps

Log in to the Rapid7 Insight Platform.
Create a dedicated service user with read-only access to InsightIDR.
Administration > API Key Management > Generate New User Key.
Copy the key immediately (cannot be retrieved later).
Select your Region and paste the API Key into Zaun.

Use an Org Key for organization-wide access, or a User Key scoped to a single user's permissions.

Splunk

Category: SIEM / Log Analytics | Auth: Token Auth

Required Credentials

Field	Description
Authentication Token	JWT token generated in Splunk
Splunk Host URL	e.g. `https://splunk-host:8089` (management port)

Required Role Capabilities

Capability	Purpose
`search`	Execute SPL search queries
`list_settings`	View server and index info (optional, for discovery)

Zaun executes search queries via POST /services/search/v2/jobs/export. The service account needs search access to relevant indexes.

Setup Steps

Enable token auth: Settings > Tokens > Enable Token Authentication.
Create a service account role with search capability and limit it to relevant indexes.
Create a user with that role. Settings > Tokens > New Token, select the user, set expiration.
Paste Token and Host URL into Zaun.

Ensure the management port (8089 by default) is accessible from Zaun's IP range. For Splunk Cloud, use the REST API endpoint provided in your Splunk Cloud admin panel.

Stellar Cyber

Category: Open XDR | Auth: API Key / JWT

Required Credentials

Field	Description
API Key	Generated per user in Stellar Cyber UI
DP Hostname	Data Processor hostname

Only local user accounts can access the API. SSO-authenticated users cannot generate API keys.

Capabilities

Feature	Description
Case Management	List, view, update cases (status, severity, assignee, tags)
Alerts & Observables	View alerts, IPs, users, hosts, files linked to cases
Data Search	Elasticsearch DSL queries against indices (`aella-ser-`, `aella-assets-`, `aella-users-*`)
Activity Audit	Case activity history, score history, computed summaries

Case statuses: New, In Progress, Resolved, Cancelled. Severity: Critical, High, Medium, Low.

Setup Steps

Create a dedicated local service account in System > Users (do not use SSO).
In the user's profile > API Keys tab, generate an API Key.
Paste API Key and DP Hostname into Zaun.

Trend Micro Vision One

Category: XDR Platform | Auth: API Key

Required Credentials

Field	Description
API Token	Bearer token from Vision One console
Region Base URL	Regional API endpoint

Capabilities

Feature	Description
Workbench Alerts	List, view, update XDR alert status and investigation results
OAT Detections	Query Observed Attack Techniques with time range filters
Endpoint Inventory	List and view endpoint details by agent GUID
Response Actions	Isolate and restore endpoints (requires appropriate role)

Investigation statuses: New, Investigating, Resolved. Results: True Positive, False Positive, Informational.

Setup Steps

In Vision One > Administration > API Keys > Add API Key.
Name it, select Analyst role (or Auditor for read-only). Set expiration.
Copy the token (shown only once) and paste into Zaun with the correct regional URL.

Use Auditor role for read-only access. Analyst or higher is needed for response actions (endpoint isolation).

SIEM / XDR

On this page