---
title: "Supported Integrations (Security Data Lake)"
slug: "supported-integrations-security-data-lake"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/supported-integrations-security-data-lake"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Supported Integrations (Security Data Lake)

Zscaler MDR supports a diverse array of security providers for both Managed Detection and Response (MDR) and storage in the Security Data Lake.

To add your data to the data lake, you can enable storage on any of your active MDR integrations. Alternatively, you can configure a data lake-only integration — this enables Security Data Lake support for data sources without a product-specific integration or in cases where you need to store additional data that isn’t used for MDR.

## MDR integrations

On the **Integrations** page in the Zscaler MDR portal, there are many product-specific MDR integrations specified. For core anchor integrations, Zscaler MDR can help you with configuration of that integration. For other integrations, Zscaler MDR can help with troubleshooting, but cannot guide the setup of the external data source.

### Integrations with configuration support

| Provider | Supported Platform | Class of Security Data | Data Lake Use Case |
| --- | --- | --- | --- |
| Amazon Web Services | [AWS](/doc/docs/integrate-amazon-web-services-with-red-canary) | Cloud | Retention, Search, Context |
| Broadcom | [Carbon Black Cloud](/doc/docs/how-red-canary-works-with-carbon-black-cloud) | EDR | Retention, Search, Context |
| Broadcom | [Carbon Black EDR](/doc/docs/install-and-uninstall-the-carbon-black-edr-sensor) | EDR | Retention, Search, Context |
| CrowdStrike | [Falcon Insight XDR](/doc/docs/how-red-canary-works-with-crowdstrike-falcon) | EDR | Retention, Search, Context |
| Google | [Cloud Platform (GCP)](/doc/docs/integrate-google-cloud-platform-gcp-with-red-canary) | Cloud | Retention, Search, Context |
| Google | [Workspace](/doc/docs/integrate-google-workspace-with-red-canary) | SaaS | Retention, Search, Context |
| Microsoft | [Azure](/doc/docs/integrate-with-microsoft-azure) | Cloud | Retention, Search, Context |
| Microsoft | [Defender for Endpoint](/doc/docs/integrate-red-canary-to-microsoft-defender-for-endpoint) | EDR | Retention, Search, Context |
| Microsoft | [Entra ID](/doc/docs/integrate-microsoft-entra-id-with-red-canary) | Identity | Retention, Search, Context |
| Microsoft | [Office 365 Management API](/doc/docs/connect-red-canary-to-office-365) | SaaS | Retention, Search, Context |
| Okta | [Workforce Identity](/doc/docs/integrate-okta-workforce-identity-with-red-canary) | Identity | Retention, Search, Context |
| Palo Alto Networks | [Cortex XDR](/doc/docs/integrate-cortex-xdr-with-red-canary) | EDR | Retention, Search, Context |
| Zscaler MDR | [Linux EDR](/doc/docs/linux-edr) | EDR | Retention, Search, Context |
| SentinelOne | [Singularity](/doc/docs/integrate-sentinelone-cloud-funnel-with-red-canary) | EDR | Retention, Search, Context |
| Trend Micro | [Vision One](/doc/docs/integrate-trend-vision-one-with-red-canary) | EDR | Retention, Search, Context |

### Self-configured integrations

| Provider | Supported Platform | Class of Security Data | Data Lake Use Case |
| --- | --- | --- | --- |
| Cisco | [Duo](/doc/docs/integrate-cisco-duo-with-red-canary) | Identity | Retention, Search, Context |
| Cisco | [Firepower](/doc/docs/integrate-cisco-firepower-with-red-canary) | Network | Retention, Search, Context |
| Cisco | [Meraki](/doc/docs/integrate-cisco-meraki-with-red-canary) | Network | Retention, Search, Context |
| Cisco | [Umbrella](/doc/docs/integrate-cisco-umbrella-with-red-canary) | Network | Retention, Search, Context |
| CrowdStrike | [Falcon Identity Protection](/doc/docs/integrate-crowdstrike-falcon-identity-protection-with-red-canary) | Identity | Retention, Search, Context |
| Darktrace | [ActiveAI Security Platform](/doc/docs/integrate-darktrace-enterprise-immune-system-with-red-canary) | Network | Retention, Search, Context |
| Dragos | [Platform](/doc/docs/integrate-dragos-with-red-canary) | Operational Technology (OT) | Retention, Search, Context |
| ExtraHop | [RevealX](/doc/docs/integrate-extrahop-revealx-with-red-canary) | Network | Retention, Search, Context |
| ExtraHop | [Enterprise](/doc/docs/integrate-extrahop-reveal-x-enterprise-with-red-canary) | Network | Retention, Search, Context |
| Fortinet | [FortiAnalyzer](/doc/docs/integrate-fortinet-fortigate-via-fortianalyzer-with-red-canary) | Network | Retention, Search, Context |
| Fortinet | [FortiGate](/doc/docs/integrate-fortinet-fortigate-with-red-canary) | Network | Retention, Search, Context |
| Fortinet | [Lacework FortiCNAPP](/doc/docs/integrate-lacework-with-red-canary) | Cloud | Retention, Search, Context |
| Jamf | [Pro/Protect](/doc/docs/integrate-jamf-edr-with-red-canary) | EDR | Retention, Search, Context |
| Microsoft | [Defender for Cloud](/doc/docs/integrate-microsoft-defender-for-cloud-with-red-canary) | Cloud | Retention, Search, Context |
| Microsoft | [Defender for Cloud Apps](/doc/docs/integrate-microsoft-defender-for-cloud-apps-with-red-canary) | Identity | Retention, Search, Context |
| Microsoft | [Defender for Identity](/doc/docs/integrate-microsoft-defender-for-identity-with-red-canary) | Identity | Retention, Search, Context |
| Microsoft | [Defender for Office 365](/doc/docs/connect-red-canary-to-office-365) | Email | Retention, Search, Context |
| Microsoft | [Entra ID Protection](/doc/docs/integrate-microsoft-graph-with-red-canary) | Identity | Retention, Search, Context |
| Palo Alto Networks | [PAN-OS](/doc/docs/integrate-palo-alto-pan-os-with-red-canary) | Network | Retention, Search, Context |
| Palo Alto Networks | [Threat Prevention](/doc/docs/integrate-palo-alto-networks-threat-prevention-with-red-canary) | Network | Retention, Search, Context |
| Palo Alto Networks | [Wildfire](/doc/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-syslog) | Network | Retention, Search, Context |
| Wiz | [Wiz](/doc/docs/integrate-wiz-with-red-canary) | Cloud | Retention, Search, Context |

In addition to the list of investigated sources above, there are also hundreds of contextual sources (marked as “stored only” in the Zscaler MDR portal). The list of contextual integrations is too long to list, so to check if a product-specific integration is available, log into your Zscaler MDR portal, navigate to the **Integrations** page, and search for the desired source platform. If there is a tile available, the data can be stored in the Security Data Lake.

### Enabling data lake retention on an MDR integration

1. From your Zscaler MDR portal, navigate to **Integrations** and select the integration of interest. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(481).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D)
2. Find **Customize how this data is retained**, and select **Store in the Security Data Lake**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(482).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D)
3. Specify the desired data retention period in days and click **Save**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(483).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A15Z&se=2026-11-09T12%3A54%3A15Z&sr=c&sp=r&sig=lbjybDK5%2FAis9Ya8zeXpgK6nUS964%2Fj25CjAKF62YJA%3D)

## Data Lake-only integrations

For all data lake-only integrations, Zscaler MDR can help with troubleshooting, but cannot guide the setup of the external data source.

For a few external sources, there are dedicated product-specific integrations offered. For other situations where you need a data lake-only integration, we recommend using a generic integration. If a data source can be configured to write logs to an Amazon S3 bucket or securely forward logs to an external syslog server, it can be integrated with the Security Data Lake using a generic integration. If you need help validating if a specific data source is supported, please contact your Zscaler MDR account representative.

### Product-specific integrations

| Provider | Supported Platform | Class of Security Data | Data Lake Use Case |
| --- | --- | --- | --- |
| Cisco | [Cisco Adaptive Security Appliance (ASA)](/doc/docs/integrate-cisco-adaptive-security-appliance-with-the-security-data-lake) | Network | Retention, Search, Context |
| Cisco | [Cisco Firepower Threat Defense (FTD)](/doc/docs/integrate-cisco-firepower-threat-defense-with-the-security-data-lake) | Network | Retention, Search, Context |
| Zscaler | [Zscaler Internet Access (ZIA)](/doc/docs/integrate-zscaler-internet-access-zia-with-red-canary) | Network | Retention, Search, Context |

### Generic integrations

| Ingest Method | Data Format | Example Sources | Data Lake Use Case |
| --- | --- | --- | --- |
| [Amazon S3 (Zscaler MDR managed)](/doc/docs/integrate-your-aws-s3-data-source-with-the-security-data-lake) | Line-delimited JSON (Plain text supported for retention-only) | Cloudflare, Logstash | Retention, Search, Context |
| [Amazon S3 (Self-managed)](/doc/docs/pull-data-from-your-self-managed-amazon-s3-bucket) | Line-delimited JSON (Plain text supported for retention-only) | AWS, Cato Networks, Netskope | Retention, Search, Context |
| [Syslog](/doc/docs/integrate-your-syslog-data-source-with-the-security-data-lake) | RFC 3164 or RFC 5424 | NetScaler WAF, NXLog, PAN-OS, rsyslog, syslog-ng, Zscaler Private Access | Retention, Search, Context |

### Configuring a data lake-only integration

Depending on the data source you are interested in configuring, follow the desired link in the tables above to see setup instructions, prerequisites, available search fields, etc.

## When would I use an MDR integration versus a data lake-only integration?

If you have data you are sending to Zscaler MDR that you would also like to store long-term (e.g.: to comply with data retention policies), enabling data lake storage on your existing MDR integration ensures that you only have to send the data once, and can minimize the setup needed.

## When would I use a data lake-only integration versus an MDR integration?

There are a few instances where a data lake-only integration is a preferred approach:

1. When the data being sent to Zscaler MDR does not contain all the logs you need to store. For example, if you have configured a PAN-OS integration to forward Wildfire alerts for investigation, but you would like to retain additional firewall logs for long-term retention, you can set up a generic syslog integration that forwards the firewall telemetry of interest.
2. When there is not a product-specific MDR integration available. While Zscaler MDR offers hundreds of MDR integrations, there are many more security products our customers use than we can directly support. For many of those products, they can be configured to forward logs via Amazon S3, syslog, or a third-party log collector. For help validating the best integration path for a specific data source, please contact your Zscaler MDR account representative.