NEW200+ connectorsnow onboarded — pipe any security source into OCSF effortlessly.Read the announcement
Book a demoStart now
Consulting
About us
Book a demoStart now
Back to home
Integrations

200+ connectors.
One schema.

Every connector ships with a vetted, versioned OCSF mapping out of the box — making Derwent Labs the most complete OCSF-native security data pipeline available. Browse the full catalogue, or pipe anything in with our universal inputs.

200+
pre-mapped connectors
OCSF 1.7
out of the box
< 5 min
to first event
242 connectors
Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS
Network Security
OCSF
Cisco Firepower FTD
Cisco Firepower FTD
Network Security
OCSF
Cisco ASA
Cisco ASA
Network Security
OCSF
Fortinet FortiGate
Fortinet FortiGate
Network Security
OCSF
C
Check Point Firewall
Network Security
OCSF
J
Juniper SRX
Network Security
OCSF
S
SonicWall
Network Security
OCSF
W
WatchGuard Firebox
Network Security
OCSF
P
pfSense / OPNsense
Network Security
OCSF
B
Barracuda CloudGen Firewall
Network Security
OCSF
S
Sophos XG / XGS
Network Security
OCSF
S
Snort IDS/IPS
Network Security
OCSF
S
Suricata IDS/IPS
Network Security
OCSF
Z
Zeek (Bro) NSM
Network Security
OCSF
D
Darktrace NDR
Network Security
OCSF
E
ExtraHop Reveal(x)
Network Security
OCSF
V
Vectra AI NDR
Network Security
OCSF
C
Corelight
Network Security
OCSF
N
NetFlow / IPFIX collectors
Network Security
OCSF
Cisco Stealthwatch / Secure Network Analytics
Cisco Stealthwatch / Secure Network Analytics
Network Security
OCSF
F
F5 BIG-IP Advanced WAF
Network Security
OCSF
H
HAProxy
Network Security
OCSF
N
Nginx
Network Security
OCSF
Z
Zscaler Internet Access
Network Security
OCSF
Z
Zscaler Private Access
Network Security
OCSF
N
Netskope
Network Security
OCSF
C
CrowdStrike Falcon
Endpoint Security
OCSF
Microsoft Defender for Endpoint
Microsoft Defender for Endpoint
Endpoint Security
OCSF
S
SentinelOne
Endpoint Security
OCSF
C
Carbon Black (VMware)
Endpoint Security
OCSF
C
Cylance (Blackberry)
Endpoint Security
OCSF
Cortex XDR (Palo Alto)
Cortex XDR (Palo Alto)
Endpoint Security
OCSF
Elastic Security (EDR)
Elastic Security (EDR)
Endpoint Security
OCSF
Bitdefender GravityZone
Bitdefender GravityZone
Endpoint Security
OCSF
E
ESET Protect
Endpoint Security
OCSF
S
Symantec Endpoint Security
Endpoint Security
OCSF
T
Trend Micro Apex One
Endpoint Security
OCSF
M
Malwarebytes EDR
Endpoint Security
OCSF
H
Huntress
Endpoint Security
OCSF
C
Cybereason
Endpoint Security
OCSF
D
Deep Instinct
Endpoint Security
OCSF
T
Tanium
Endpoint Security
OCSF
T
Trellix (FireEye/McAfee)
Endpoint Security
OCSF
W
WithSecure Elements
Endpoint Security
OCSF
S
Sophos Intercept X
Endpoint Security
OCSF
W
Wazuh (OSSEC)
Endpoint Security
OCSF
Okta
Okta
Identity & Access
OCSF
Microsoft Entra ID (Azure AD)
Microsoft Entra ID (Azure AD)
Identity & Access
OCSF
Active Directory / AD DS
Active Directory / AD DS
Identity & Access
OCSF
P
Ping Identity / PingFederate
Identity & Access
OCSF
O
OneLogin
Identity & Access
OCSF
J
JumpCloud
Identity & Access
OCSF
Duo Security (Cisco)
Duo Security (Cisco)
Identity & Access
OCSF
R
RSA SecurID
Identity & Access
OCSF
F
ForgeRock (now Ping)
Identity & Access
OCSF
C
CyberArk PAM
Identity & Access
OCSF
B
BeyondTrust PIM
Identity & Access
OCSF
D
Delinea (Thycotic) Secret Server
Identity & Access
OCSF
HashiCorp Vault
HashiCorp Vault
Identity & Access
OCSF
Google Workspace SSO
Google Workspace SSO
Identity & Access
OCSF
Microsoft ADFS
Microsoft ADFS
Identity & Access
OCSF
RADIUS servers (Cisco ISE, FreeRADIUS)
RADIUS servers (Cisco ISE, FreeRADIUS)
Identity & Access
OCSF
S
Sailpoint IdentityNow
Identity & Access
OCSF
S
Saviynt
Identity & Access
OCSF
AWS IAM / CloudTrail
AWS IAM / CloudTrail
Identity & Access
OCSF
AWS CloudTrail
AWS CloudTrail
Cloud & CSPM
OCSF
AWS GuardDuty
AWS GuardDuty
Cloud & CSPM
OCSF
AWS Security Hub
AWS Security Hub
Cloud & CSPM
OCSF
AWS VPC Flow Logs
AWS VPC Flow Logs
Cloud & CSPM
OCSF
AWS WAF
AWS WAF
Cloud & CSPM
OCSF
AWS Config
AWS Config
Cloud & CSPM
OCSF
AWS Inspector v2
AWS Inspector v2
Cloud & CSPM
OCSF
AWS Macie
AWS Macie
Cloud & CSPM
OCSF
Microsoft Azure Monitor
Microsoft Azure Monitor
Cloud & CSPM
OCSF
Microsoft Defender for Cloud
Microsoft Defender for Cloud
Cloud & CSPM
OCSF
Azure Sentinel (Microsoft Sentinel)
Azure Sentinel (Microsoft Sentinel)
Cloud & CSPM
OCSF
GCP Cloud Audit Logs
GCP Cloud Audit Logs
Cloud & CSPM
OCSF
GCP Security Command Center
GCP Security Command Center
Cloud & CSPM
OCSF
Google Chronicle SOAR
Google Chronicle SOAR
Cloud & CSPM
OCSF
Prisma Cloud (Palo Alto)
Prisma Cloud (Palo Alto)
Cloud & CSPM
OCSF
W
Wiz
Cloud & CSPM
OCSF
O
Orca Security
Cloud & CSPM
OCSF
L
Lacework
Cloud & CSPM
OCSF
A
Aqua Security
Cloud & CSPM
OCSF
S
Sysdig Secure
Cloud & CSPM
OCSF
F
Falco (runtime security)
Cloud & CSPM
OCSF
Snyk
Snyk
Cloud & CSPM
OCSF
T
Tenable Cloud Security
Cloud & CSPM
OCSF
Kubernetes Audit Logs
Kubernetes Audit Logs
Cloud & CSPM
OCSF
T
Tenable Nessus / Tenable.sc / Tenable.io
Vulnerability Mgmt
OCSF
Qualys VMDR
Qualys VMDR
Vulnerability Mgmt
OCSF
R
Rapid7 InsightVM / Nexpose
Vulnerability Mgmt
OCSF
Microsoft Defender Vulnerability Mgmt
Microsoft Defender Vulnerability Mgmt
Vulnerability Mgmt
OCSF
C
CrowdStrike Spotlight
Vulnerability Mgmt
OCSF
O
OpenVAS / Greenbone
Vulnerability Mgmt
OCSF
N
Nmap
Vulnerability Mgmt
OCSF
W
Wiz (cloud vulnerability)
Vulnerability Mgmt
OCSF
O
Orca Security
Vulnerability Mgmt
OCSF
L
Lansweeper
Vulnerability Mgmt
OCSF
ServiceNow Vulnerability Response
ServiceNow Vulnerability Response
Vulnerability Mgmt
OCSF
I
Ivanti Security Controls
Vulnerability Mgmt
OCSF
T
Tanium Comply
Vulnerability Mgmt
OCSF
Microsoft Defender for Office 365
Microsoft Defender for Office 365
Email & Web Security
OCSF
Google Workspace Gmail
Google Workspace Gmail
Email & Web Security
OCSF
P
Proofpoint Email Security
Email & Web Security
OCSF
M
Mimecast
Email & Web Security
OCSF
B
Barracuda Email Security
Email & Web Security
OCSF
Cisco Email Security (IronPort)
Cisco Email Security (IronPort)
Email & Web Security
OCSF
A
Abnormal Security
Email & Web Security
OCSF
C
Cofense (PhishMe)
Email & Web Security
OCSF
T
Trellix Email Security
Email & Web Security
OCSF
Z
Zscaler Web Security
Email & Web Security
OCSF
S
Symantec Web Security Service
Email & Web Security
OCSF
B
Bluecoat / Symantec Proxy
Email & Web Security
OCSF
M
McAfee Web Gateway
Email & Web Security
OCSF
Cisco Umbrella (DNS/Web)
Cisco Umbrella (DNS/Web)
Email & Web Security
OCSF
A
Akamai ETP (DNS Security)
Email & Web Security
OCSF
Cloudflare Gateway
Cloudflare Gateway
Email & Web Security
OCSF
Splunk Enterprise / Cloud
Splunk Enterprise / Cloud
SIEM & SOAR
OCSF
Microsoft Sentinel
Microsoft Sentinel
SIEM & SOAR
OCSF
I
IBM QRadar
SIEM & SOAR
OCSF
E
Exabeam Fusion SIEM
SIEM & SOAR
OCSF
Google SecOps (Chronicle)
Google SecOps (Chronicle)
SIEM & SOAR
OCSF
Elastic SIEM / Security
Elastic SIEM / Security
SIEM & SOAR
OCSF
S
Securonix
SIEM & SOAR
OCSF
D
Devo SIEM
SIEM & SOAR
OCSF
Sumo Logic
Sumo Logic
SIEM & SOAR
OCSF
L
LogRhythm
SIEM & SOAR
OCSF
AlienVault USM (AT&T)
AlienVault USM (AT&T)
SIEM & SOAR
OCSF
G
Graylog
SIEM & SOAR
OCSF
Amazon Security Lake (OCSF)
Amazon Security Lake (OCSF)
SIEM & SOAR
OCSF
Snowflake
Snowflake
SIEM & SOAR
OCSF
Databricks
Databricks
SIEM & SOAR
OCSF
Palo Alto XSIAM
Palo Alto XSIAM
SIEM & SOAR
OCSF
Palo Alto XSOAR (Cortex)
Palo Alto XSOAR (Cortex)
SIEM & SOAR
OCSF
Splunk SOAR (Phantom)
Splunk SOAR (Phantom)
SIEM & SOAR
OCSF
I
IBM Resilient (SOAR)
SIEM & SOAR
OCSF
T
Tines (SOAR)
SIEM & SOAR
OCSF
T
Torq (SOAR)
SIEM & SOAR
OCSF
S
Shuffle SOAR
SIEM & SOAR
OCSF
Microsoft 365 (SharePoint, Teams, Exchange)
Microsoft 365 (SharePoint, Teams, Exchange)
SaaS & CASB
OCSF
Google Workspace (Drive, Meet, Admin)
Google Workspace (Drive, Meet, Admin)
SaaS & CASB
OCSF
Salesforce
Salesforce
SaaS & CASB
OCSF
B
Box
SaaS & CASB
OCSF
Dropbox Business
Dropbox Business
SaaS & CASB
OCSF
Slack
Slack
SaaS & CASB
OCSF
Zoom
Zoom
SaaS & CASB
OCSF
ServiceNow
ServiceNow
SaaS & CASB
OCSF
Jira / Confluence (Atlassian)
Jira / Confluence (Atlassian)
SaaS & CASB
OCSF
GitHub Enterprise
GitHub Enterprise
SaaS & CASB
OCSF
GitLab
GitLab
SaaS & CASB
OCSF
W
Workday
SaaS & CASB
OCSF
S
SAP
SaaS & CASB
OCSF
Okta (SaaS identity layer)
Okta (SaaS identity layer)
SaaS & CASB
OCSF
N
Netskope CASB
SaaS & CASB
OCSF
M
McAfee MVISION CASB
SaaS & CASB
OCSF
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
SaaS & CASB
OCSF
L
Lookout CASB
SaaS & CASB
OCSF
Cisco IOS / NX-OS / Catalyst
Cisco IOS / NX-OS / Catalyst
Network Infrastructure
OCSF
Cisco Identity Services Engine (ISE)
Cisco Identity Services Engine (ISE)
Network Infrastructure
OCSF
Cisco Meraki
Cisco Meraki
Network Infrastructure
OCSF
A
Aruba Networks (HPE)
Network Infrastructure
OCSF
A
Aruba ClearPass NAC
Network Infrastructure
OCSF
J
Juniper EX / MX / QFX
Network Infrastructure
OCSF
A
Arista EOS
Network Infrastructure
OCSF
H
HP ProCurve / Comware
Network Infrastructure
OCSF
U
Ubiquiti UniFi
Network Infrastructure
OCSF
E
Extreme Networks
Network Infrastructure
OCSF
R
Ruckus Wi-Fi
Network Infrastructure
OCSF
Cisco AnyConnect / Secure Client (VPN)
Cisco AnyConnect / Secure Client (VPN)
Network Infrastructure
OCSF
P
Pulse Secure / Ivanti VPN
Network Infrastructure
OCSF
GlobalProtect (Palo Alto VPN)
GlobalProtect (Palo Alto VPN)
Network Infrastructure
OCSF
O
OpenVPN / WireGuard
Network Infrastructure
OCSF
F
F5 BIG-IP (LTM / GTM)
Network Infrastructure
OCSF
C
Citrix ADC / NetScaler
Network Infrastructure
OCSF
DHCP / DNS logs (Windows, BIND, Infoblox)
DHCP / DNS logs (Windows, BIND, Infoblox)
Network Infrastructure
OCSF
I
Infoblox DDI
Network Infrastructure
OCSF
B
BlueCat DDI
Network Infrastructure
OCSF
Windows Security Event Log
Windows Security Event Log
OS & Server
OCSF
Windows DNS Debug Log
Windows DNS Debug Log
OS & Server
OCSF
Windows DHCP Log
Windows DHCP Log
OS & Server
OCSF
Microsoft IIS
Microsoft IIS
OS & Server
OCSF
Active Directory Domain Services
Active Directory Domain Services
OS & Server
OCSF
L
Linux auditd (auditbeat)
OS & Server
OCSF
L
Linux syslog / journald
OS & Server
OCSF
M
macOS Unified Log
OS & Server
OCSF
V
VMware ESXi / vCenter
OS & Server
OCSF
V
VMware NSX
OS & Server
OCSF
C
Citrix Virtual Apps & Desktops
OS & Server
OCSF
O
Oracle Linux / Solaris
OS & Server
OCSF
I
IBM AIX
OS & Server
OCSF
Kubernetes (API server audit)
Kubernetes (API server audit)
OS & Server
OCSF
Docker daemon
Docker daemon
OS & Server
OCSF
AWS EC2 (via CloudWatch Agent)
AWS EC2 (via CloudWatch Agent)
OS & Server
OCSF
Azure VMs (via AMA agent)
Azure VMs (via AMA agent)
OS & Server
OCSF
GCP Compute Engine (via Ops Agent)
GCP Compute Engine (via Ops Agent)
OS & Server
OCSF
GitHub (Enterprise / Cloud)
GitHub (Enterprise / Cloud)
DevSecOps
OCSF
GitLab
GitLab
DevSecOps
OCSF
B
Bitbucket
DevSecOps
OCSF
Jenkins
Jenkins
DevSecOps
OCSF
GitHub Actions
GitHub Actions
DevSecOps
OCSF
GitLab CI/CD
GitLab CI/CD
DevSecOps
OCSF
CircleCI
CircleCI
DevSecOps
OCSF
T
TeamCity
DevSecOps
OCSF
Azure DevOps
Azure DevOps
DevSecOps
OCSF
S
SonarQube (SAST)
DevSecOps
OCSF
Snyk (SCA / SAST)
Snyk (SCA / SAST)
DevSecOps
OCSF
C
Checkmarx
DevSecOps
OCSF
V
Veracode
DevSecOps
OCSF
J
JFrog Artifactory
DevSecOps
OCSF
J
JFrog Xray
DevSecOps
OCSF
HashiCorp Vault (secrets)
HashiCorp Vault (secrets)
DevSecOps
OCSF
AWS Secrets Manager
AWS Secrets Manager
DevSecOps
OCSF
T
Trivy / Grype
DevSecOps
OCSF
C
Claroty Platform
OT & IoT
OCSF
D
Dragos Platform
OT & IoT
OCSF
N
Nozomi Networks Guardian
OT & IoT
OCSF
Microsoft Defender for IoT
Microsoft Defender for IoT
OT & IoT
OCSF
A
Armis Platform
OT & IoT
OCSF
F
Forescout Platform
OT & IoT
OCSF
Cisco Cyber Vision
Cisco Cyber Vision
OT & IoT
OCSF
R
Radiflow iSID
OT & IoT
OCSF
S
Siemens SINEMA RC
OT & IoT
OCSF
R
Rockwell FactoryTalk
OT & IoT
OCSF
G
GE Digital Predix
OT & IoT
OCSF
AWS IoT Core
AWS IoT Core
OT & IoT
OCSF
Azure IoT Hub
Azure IoT Hub
OT & IoT
OCSF
I
Ignition SCADA (Inductive Automation)
OT & IoT
OCSF
O
OSIsoft PI (AVEVA)
OT & IoT
OCSF
M
Modbus / DNP3 gateways
OT & IoT
OCSF
Microsoft Purview (DLP)
Microsoft Purview (DLP)
DLP & Data Security
OCSF
S
Symantec DLP
DLP & Data Security
OCSF
F
Forcepoint DLP
DLP & Data Security
OCSF
D
Digital Guardian DLP
DLP & Data Security
OCSF
N
Nightfall AI
DLP & Data Security
OCSF
I
Imperva DAM
DLP & Data Security
OCSF
I
IBM Guardium
DLP & Data Security
OCSF
V
Varonis DatAdvantage
DLP & Data Security
OCSF
N
Netwrix Auditor
DLP & Data Security
OCSF
M
ManageEngine DataSecurity Plus
DLP & Data Security
OCSF
T
Thales / Vormetric
DLP & Data Security
OCSF
V
Vera (now HelpSystems)
DLP & Data Security
OCSF
Need a connector we don’t have yet?
Tell us what you need and we’ll add it. Universal S3 and HTTP connectors cover the rest in the meantime.
Request integration
Common questions

FAQ

What is an OCSF connector list?
An OCSF connector list is a catalogue of security data sources — EDR tools, cloud platforms, identity providers, SIEMs, and network devices — each with a pre-built mapping to the OCSF schema. Derwent Labs maintains 200+ such connectors, so connecting a source produces normalised OCSF 1.7 events immediately.
Are all Derwent Labs connectors OCSF-mapped?
Yes. Every connector in the catalogue ships with a vetted OCSF 1.7 mapping maintained by Derwent Labs — not a community template you need to validate. Each tile in this catalogue displays an OCSF badge to confirm the mapping is live and versioned.
What security data pipeline integrations do you support?
Derwent Labs connects to sources across network security, endpoint, identity, cloud and CSPM, vulnerability management, email security, SIEM and SOAR, SaaS, OT/IoT, and DevSecOps. If you don't see a source you need, use the universal S3 or HTTP connector, or request it directly.
What is OCSF? — the schema behind every connectorDerwent Labs vs Cribl — connector comparison
The backbone for security telemetry

One schema.
Every tool.

Normalise every byte of your security telemetry to OCSF. Stop maintaining parsers. Stop rewriting detections. Start shipping signal.