Connect your data

Integrations

Integrations connect datagab to the tools you already use. Open Integrations from the name menu, pick a tool and follow the steps. Each integration brings its own pipeline, so logs arrive already in the shared format, and many include a ready-made dashboard.

Integrations work in one of two ways:

• Pull: datagab reads logs from the tool's API on a schedule, using credentials you give it.
• Push: the tool sends logs to datagab, using an API key from your organization.

Common first integrations are Microsoft 365, Entra ID, Okta, Google Workspace, AWS and Cloudflare.

The datagab agent for Linux

The datagab agent runs on your Linux servers and sends what happens on them to datagab. It collects:

• Programs that start and network connections they make
• Changes to important files
• Logins and changes to users
• Installed packages and open ports
• Server logs
• A list of the software running programs have loaded, which datagab checks for known vulnerabilities

It also reports facts used for host security checks, and can carry out response actions, such as stopping a process or isolating a server from the network, once a person approves them.

In the consoleObservability › Logs › Add Log Source shows the install command for your organization.

Connections and credentials

Connections hold the credentials datagab uses to read from and act on other tools. They are stored in an encrypted vault and are never shown again after you save them.

You can group connections, tag them and decide which roles may use each one, for example so only the security team can use the connection that disables users.

In the consoleAutomation › Workflows › Connections.

Pipelines

Pipelines shape logs before they are stored. Use them to parse fields, add location and threat intelligence, drop noisy events, spot sensitive data and route copies to other places.

In the consoleObservability › Pipelines and Observability › Logs › Pipelines.