Log Management Integrations
This guide describes how Log Management connects to external systems and other Cloudaware modules.
External SIEM/SOAR and Log Tools
Conflux can forward enriched events to downstream tools such as:
- SIEM/SOAR platforms via generic or product‑specific webhook destinations.
- Third‑party log analysis tools that accept HTTP, syslog, or other supported protocols.
Typical patterns:
- Use Conflux as the log aggregation and enrichment tier, then forward only high‑value events (for example, alerts, findings, or specific log categories) to external tools.
- Preserve Cloudaware CMDB enrichment (tags, owners, applications) in forwarded events so downstream systems can use the same context.
SaaS and Identity Integrations
Conflux also ingests logs from SaaS and identity providers such as:
- Okta and OneLogin (authentication and audit logs).
- GitLab (audit event streaming or S3 exports).
- Cloudflare and similar services (security and access logs).
These integrations are configured using API tokens, webhooks, or storage-based exports that point to Conflux endpoints.
Relation to Other Cloudaware Modules
Log Management collaborates with other modules:
- Monitoring — uses logs as one of the signals for alerts and SLOs.
- Intrusion Detection (Wazuh) — sends security telemetry and findings into Conflux and may refer to logs to enrich investigations.
- Advanced Analytics — can consume log‑derived datasets for cross‑module KPIs and long‑term analysis.
APIs and Automation
For programmatic access:
- Use Cloudaware APIs to query log‑derived datasets or export data to your own storage.
- Combine Conflux data with Cloudaware CMDB and other modules in automation (for example, ticketing, remediation, or custom reporting flows).