Data feeds | SparkLogs

Workloads4

WorkloadLive

DNS server

The DNS Server service is present on the host.

Covered bySystem logServices

Learn more

WorkloadLive

Domain controller

The agent reports the domain controller host role for this machine.

The directory service, Netlogon and Windows Time services are present on the host.

Covered bySecurity logSystem logServicesSystem identitydirectory object changeddirectory object createddirectory object deleted

Learn more

WorkloadLive

Hyper-V host

The Hyper-V Virtual Machine Management or Host Compute service is present on the host.

Covered bySystem logSecurity logServicesProcesses+1hyperv vswitch config restore failedpsdirect handshake probe

Learn more

WorkloadLive

SQL Server

The SQL Server and SQL Server Agent services are present on the host.

A named instance service such as MSSQL$PAYROLL is present. A SQL Server VSS writer service is present and reports state during a backup.

Covered byApplication logSystem logServicesProcesses+2mssql db page corruptionmssql db io failedvss writer failed

Learn more

Event feeds14

Event feedLive2 changes

Microsoft Defender

Microsoft Defender Antivirus detections, remediation outcomes and engine health from the Defender operational channel.

Collected, curated, and searchable

av config changedav definition update failedav engine failed

Reference

Event feedLive

Application log

The Application channel: application crashes and hangs, database and VSS provider faults, certificate and identity-sync failures.

Collected, curated, and searchable

adcs ca chain failedadcs crl publish failedapp crash

Reference

Event feedLive

App platform channels

Application platform channels beyond the classic Application log: packaged-app deployment and readiness, the shell, application compatibility, and Office dialogs. Failures, cleanup residue, and lifecycle records are read from the provider payload.

Collected, curated, and searchable

appid certificate store verification failedappid certificate store verifiedappx activation failed

Reference

Event feedLive

Identity channels

Identity and security operational channels beyond the classic Security log: code integrity and application control, cloud identity and device registration, key and certificate stores, Group Policy, BitLocker posture and the endpoint sensor. The failures are read from the provider payload and the routine narration is held out of the attention bands.

Collected, curated, and searchable

applocker audit would blockapplocker unsupported windows editionbitlocker recovery key backup failed

Reference

Event feedLive

Management channels

Remote management, task scheduling, background transfer and configuration channels, with the transfer failures read and the routine narration held out of the attention bands.

Collected, curated, and searchable

bitlocker policy noncompliantbits transfer faileddfsr partner communication failed

Reference

Event feedLive

Network channels

Connectivity, DHCP, DNS, WLAN, firewall, SMB, RDP, and related channels. Failures, posture facts, and lifecycle records are read from the provider payload.

Collected, curated, and searchable

dhcp address conflict detecteddhcp lease denieddhcp lease failed

Reference

Event feedLive

Platform channels

Kernel, boot, power, device, firmware, and hardware channels the System log does not carry. Device start and removal, boot measurement and TPM initialization failures, and OEM integrity-scan outcomes are read from the provider payload.

Collected, curated, and searchable

device install reboot pendingdevice removal vetoeddevice removed after failure

Reference

Event feedLive12 changes

Security log

The Security channel: sign-in outcomes, privilege use, directory changes and audit policy changes.

Collected, curated, and searchable

account changedaccount createdaccount deleted

Reference

Event feedLive

Setup log

The Setup channel: update and feature install outcomes as Windows itself records them.

Collected, curated, and searchable

patch install failedwin component store corruption

Reference

Event feedLive

Storage channels

The storage channels the System log does not carry: the port and class drivers, NTFS, partitions and volumes, and Storage Spaces. Bad blocks, controller resets, paging failures and volume mount failures are read from the driver payload.

Collected, curated, and searchable

disk bad blockdisk failure predicteddisk paging error

Reference

Event feedLive1 change

System log

The System channel: service, driver, disk, network, cluster and hardware faults from the operating system itself.

Collected, curated, and searchable

av unsigned code blockeddcom activation timeoutdcom register timeout

Reference

Event feedLive

PowerShell

PowerShell engine and script-block channels, with whole script blocks reassembled and labelled for generated framework code, repeats and watchlisted commands.

Collected, curated, and searchable

win powershell script block framework codewin powershell script block repeatedwin powershell script block sensitive command

Reference

Event feedLive

CBS log

Component-Based Servicing: what the servicing stack actually did to a package, and why it stopped.

Collected, curated, and searchable

win component store assembly missingwin component store corruptionwin component store corruption recurring

Reference

Event feedLive

DISM log

DISM servicing operations: image and component-store maintenance and their failure detail.

Collected, curated, and searchable

win dism command failedwin dism feature change failedwin dism health command run

Reference

Config Changes14

Config changeLive

Account

A user or computer account in the directory or on the local host.

5 actions · 9 reasons · 1 sources

createddeleteddisabled

Reference

Config changeLive

Audit policy subcategory

One subcategory of the Windows audit policy, which decides what the Security log records.

1 actions · 1 reasons · 1 sources

updated

Reference

Config changeLive

Endpoint protection setting

One setting of the endpoint protection product on the host.

1 actions · 1 reasons · 1 sources

updated

Reference

Config changeLive

Endpoint protection component

One protection component of the endpoint protection product, such as real-time scanning.

2 actions · 1 reasons · 1 sources

disabledenabled

Reference

Config changeLive

Directory object

A directory object that is neither an account nor a group, such as an organizational unit or a policy container.

3 actions · 3 reasons · 1 sources

createddeletedupdated

Reference

Config changeLive

Domain policy

The password and lockout policy of one domain.

1 actions · 1 reasons · 1 sources

updated

Reference

Config changeLive

Firewall rule

One rule in the Windows Firewall, which decides what traffic the host accepts.

5 actions · 3 reasons · 1 sources

createddeleteddisabled

Reference

Config changeLive

Security group

A security group, both the group itself and who belongs to it.

5 actions · 5 reasons · 1 sources

createddeletedmember_added

Reference

Config changeLive

Logon right

A right that decides how an account may sign in, such as locally at the keyboard or as a service.

2 actions · 2 reasons · 1 sources

createddeleted

Reference

Config changeLive

Registry value

A value in the Windows registry that auditing is turned on for.

3 actions · 3 reasons · 1 sources

createddeletedupdated

Reference

Config changeLive

Scheduled task

A job Task Scheduler runs on a trigger or a clock.

4 actions · 4 reasons · 1 sources

createddeleteddisabled

Reference

Config changeLive

Network share

A folder the host publishes on the network over SMB.

1 actions · 1 reasons · 1 sources

created

Reference

Config changeLive

System clock

The clock of the host the event came from.

1 actions · 1 reasons · 1 sources

updated

Reference

Config changeLive

Windows service

A background program the Service Control Manager starts and stops on the host.

1 actions · 1 reasons · 2 sources

installed

Reference

Device health22

Device healthLive

Agent overhead

What the SparkLogs agent stack itself costs the host: CPU, working set and handles.

Collected, curated, and searchable

sparklogs agent cpu over budgetsparklogs agent handle over budgetsparklogs agent memory over budget

Reference

Device healthLive

Agent pipeline

The agent spool and delivery pipeline: how much is queued and when it last drained.

Collected, curated, and searchable

Reference

Device healthLive

Collector health

Per-collector health for the shipper the agent runs.

Collected, curated, and searchable

Reference

Device healthLive

Crash dumps

Whether this host can write a usable crash dump when Windows or an application crashes.

Collected, curated, and searchable

page file too small for the dump

Reference

Device healthLive

Crashes

Windows and application crashes with decoded error details and local dump analysis when available.

Collected, curated, and searchable

kernel crashrecurring kernel crashesprocess crash

Reference

Device healthLive

Volumes

Every fixed volume: free space, fill trend, protection state and whether the filesystem is readable.

Collected, curated, and searchable

data volume running out of spacedata volume space lowOS volume running out of space

Reference

Device healthLive

Drivers

The device drivers installed on the host, and what changes about them between reports.

Collected, curated, and searchable

driver updateddriver addeddriver removed

Reference

Device healthLive

Feed health

Per-feed health for the inputs the agent is shipping.

Collected, curated, and searchable

Reference

Device healthLive

Products

The installed-product inventory the agent reads from the host.

Collected, curated, and searchable

product installedproduct removedproduct version changed

Reference

Device healthLive

Product summary

A rolled-up view of installed products, including protection-category coverage.

Collected, curated, and searchable

Reference

Device healthLive

Performance

Whole-host CPU and memory posture over a measured window.

Collected, curated, and searchable

cpu busycpu interrupt stormcpu kernel dominated

Reference

Device healthLive

Processes

Per-process cost: CPU, working set, handles and sustained growth.

Collected, curated, and searchable

process handle count high

Reference

Device healthLive

Services

Service configuration and run state, including automatic services that are not running.

Collected, curated, and searchable

automatic service not runningservice flappingservice stuck pending

Reference

Device healthLive

Device IO

Per-device IO posture, including a device that is busy but moving almost nothing.

Collected, curated, and searchable

disk unresponsive

Reference

Device healthLive

Devices

The physical and virtual storage devices attached to the host.

Collected, curated, and searchable

Reference

Device healthLive

Storage IO

Storage throughput, queues and response time per volume.

Collected, curated, and searchable

disk latency degradeddisk saturated

Reference

Device healthLive

System identity

Machine identity and posture, including whether a reboot is pending.

Collected, curated, and searchable

reboot pendingSecure Boot state changedTPM state changed

Reference

Device healthLive

Top processes

Processes selected by CPU, resident memory and read/write I/O, plus system CPU and an unlisted-process remainder.

Collected, curated, and searchable

Reference

Device healthLive

Volume map

How volumes map onto devices and partitions.

Collected, curated, and searchable

Reference

Device healthLive

Shadow storage

Shadow-copy storage allocation and how close it is to its cap.

Collected, curated, and searchable

shadow storage near capshadow copies failing for space

Reference

Device healthLive

Writers

VSS writer state, the canonical evidence behind a failed backup.

Collected, curated, and searchable

VSS writer failed

Reference

Device healthLive

Windows Update

Whether this host is scanning, paused, or falling behind on updates.

Collected, curated, and searchable

update scan is staleupdates paused

Reference

Shippers5

ShipperLiveCollected

Alloy

Ship logs to SparkLogs with Grafana Alloy.

Collected and searchable

Reference

ShipperLiveCollected

Filebeat

Ship logs to SparkLogs with Filebeat and the other Elastic Beats.

Collected and searchable

Reference

ShipperLiveCollected

Logstash

Ship logs to SparkLogs with Logstash.

Collected and searchable

Reference

ShipperLiveCollected

OTel Collector

Ship logs to SparkLogs with the OpenTelemetry Collector.

Collected and searchable

Reference

ShipperLiveCollected

Vector

Ship logs and metrics to SparkLogs with Vector.

Collected and searchable

Reference

Protocols5

ProtocolLiveCollected

Elasticsearch bulk

Send events using the Elasticsearch bulk API shape.

Collected and searchable

Reference

ProtocolLiveCollected

HTTPS JSON

Post JSON events to the SparkLogs ingest endpoint directly.

Collected and searchable

Reference

ProtocolLiveCollected

Loki push

Send events using the Loki push API shape.

Collected and searchable

Reference

ProtocolLiveCollected

OTLP

Send logs to SparkLogs over the OpenTelemetry protocol.

Collected and searchable

Reference

ProtocolLiveCollected

Syslog

Send syslog to SparkLogs from network devices and appliances.

Collected and searchable

Reference

Capture every signal your L3 engineers need to solve tough ticket fast.

See every source against every ticket theme.