Index Definitions & Details

Stellar Cyber organizes data into indices, which helps to speed up your searches.

The following table lists the name of each index in Stellar Cyber, the name of the index in the Interflow data, the type of data collected in that index, and the source of the data.

Stellar Cyber also provides an interactive tool that lets you look up alert types by data source, alert name, event type, or source index.

Index Interflow Name Data Source
Alerts aella-ser-*

Security events from Machine Learning, security analytics and ATH playbooks
Assets aella-assets-* Asset data based on Stellar Cyber analytics

Connectors:

  • Acronis Cyber Protect Cloud

  • Cisco AMP

  • Broadcom SES

  • CrowdStrike

  • Cybereason

  • Deep Instinct

  • LimaCharlie

  • SentinelOne

  • SonicWall Capture Client

  • Sophos Central

  • Thinkst Canary

  • WMware Carbon Black

  • Webroot

AWS Events aella-cloudtrail-*

CloudTrail non-traffic logs

Machine Learning alerts types for this Index 

DP Monitoring aella-dp-monitor

Data Processor health status

Linux Events

 aella-audit-*

Audit data from Linux agents

Audit data from Container sensors

Machine Learning alert types for this index

Connectors:

  • Cisco AMP

  • Google Workspace

  • Prisma Cloud (Palo Alto Networks)

  • SentinelOne

  • SonicWall Capture Client

ML-IDS / Malware Sandbox aella-maltrace-*

Firewall threats from sensors/log forwarders

Maltrace SDS/Sandbox

Machine Learning alert types for this index

Scans aella-scan-*

Machine Learning alert types for this index

Connectors:

  • CyberCNS

  • Nessus

  • Qualys

  • Rapid7

  • SentinelOne

  • SonicWall Capture Client

  • Tenable.io

  • Tenable.sc

Sensor Monitoring aella-ade-*

Sensor statistics from DP Configuration Manager

Machine Learning alert types for this index

Signals aella-signals-* Sensitive events that are not attacks based on analytics or Machine Learning
Syslog aella-syslog-*

Application logs from sensor log forwarder parsers

Machine Learning alert types for this index

Connectors:

  • Acronis Cyber Protect Cloud

  • Akamai

  • Amazon Security Lake

  • AWS Cloudwatch

  • AWS GuardDuty

  • Azure Event Hub

  • Barracuda Email Security

  • BlackBerry Cylance

  • Broadcom SES

  • Broadcom (Bluecoat / Symantec) WSS

  • Box

  • Cato Networks

  • Cisco AMP

  • Cisco Umbrella

  • Cloudflare

  • CrowdStrike

  • Cybereason

  • Cynet

  • Deep Instinct

  • Duo Security

  • ForeScout

  • Generic S3

  • Google Cloud Audit Logs

  • HanDreamnet Security Switch

  • HIBUN

  • Imperva Incapsula

  • Indusface

  • Jamf Protect

  • JumpCloud

  • LastPass

  • LimaCharlie

  • Microsoft Defender for Endpoint

  • Microsoft SQL Server

  • Mimecast

  • MySQL

  • Netskope WSG

  • OneLogin

  • Okta

  • Oracle Cloud Infrastructure (OCI)

  • Prisma Cloud (Palo Alto Networks)

  • Proofpoint On Demand

  • Proofpoint Targeted Attack Protection (TAP)

  • Qualys

  • Salesforce

  • SentinelOne

  • SonicWall Capture Client

  • Sophos Central

  • Symantec Email Security

  • Symantec Cloud Workload Protection

  • Thinkst Canary

  • Trend Micro Apex Central

  • Trend Micro Cloud One Workload Security

  • Trend Micro Vision One

  • VMware Carbon Black

  • VMware Workspace One

  • Webroot

Traffic aella-adr-*

Flow traffic from sensors

Machine Learning alert types for this index

CloudTrail traffic

Firewall traffic logs from sensor log forwarders

DHCP server logs from sensors
Users aella-users-*

User data from analytics

Okta connector
Windows aella-wineventlog-*

Machine Learning alert types for this index

Active Directory connector user data

Microsoft Entra ID (formerly Azure AD) Active Directory user data

Office 365 Active Directory user data

Windows logs from Windows agents

Windows System Security logs