Integration with Secure60

Secure60 offers several ways to collect and process your security data. Every method normalises events into one data model, so you can correlate activity across systems no matter how it arrived. Choose the integration that best fits your environment:

Primary Integration Methods

Secure60 Collector

Our comprehensive solution for data collection and transformation. The Secure60 Collector:

• Supports multiple protocols (HTTP/S, Syslog, Kafka, AWS S3, etc.)
• Automatically normalizes data into our Common Information Model
• Includes built-in data masking and privacy features
• Scales to handle high-volume environments

Secure60 Balancer

A high-performance TCP load balancer designed for syslog ingestion. Perfect for:

• Managing long-lived TCP connections
• Distributing load across multiple collectors
• Ensuring high availability in large deployments

Microsoft 365 Connector

A customer-deployed container that collects Microsoft 365 and Microsoft Entra ID (Azure AD) telemetry and forwards it to Secure60. It:

• Collects audit, sign-in and identity-risk data via the Office 365 Management Activity API and Microsoft Graph
• Uses app-only authentication, so your Microsoft credentials stay in your environment
• Normalizes events into our Common Information Model for immediate use in Rules and Entity Analysis

Google Workspace Connector

A customer-deployed container that collects Google Workspace audit and authentication logs and forwards them to Secure60. It:

• Collects login, admin, Drive, OAuth-token, SAML and more via the Google Admin SDK Reports API
• Uses read-only, audit-logs-only access, so your Google credentials stay in your environment
• Surfaces third-party OAuth app grants (the auth_application field) for app governance
• Normalizes events into our Common Information Model for immediate use in Rules and Entity Analysis

External Integrations

Direct integrations with hundreds of applications and services including:

• Cloud platforms (AWS, Azure, GCP)
• Security tools (CrowdStrike, SentinelOne)
• Identity providers (Okta, Azure AD)
• And many more…

Getting Started

1. Review the Secure60 Collector documentation for our recommended integration approach
2. For specific application integrations, check the External Integrations list
3. Need help planning your integration? Contact our team at integrations@secure60.io

Parsing and Transformation Options:

Secure60 platform by design is schemaless, you can send any field names and they will be ingested and securely stored and searchable via the portal UI.

To enable the more advanced security features in the platform (such as Rules and Entity Analysis) we require that data is stored in the Secure60 Common Information Model (CIM). This is a simple schema that stores fields in a common naming strategy so that you can correlate activity across multiple systems and log types.

An example of this would be that if you are sending us an IP address instead of having one system send ip_source:54.7.36.12 and another send source_ip:54.7.36.12 we would parse and transform both of those fields into ip_src_dst:54.7.36.12 which then provides a standard format for referenceing Source IP information.

We offer rich parsing and transformation features within the Secure60 Collector, This includes automated field analysis for common field names which will automatically be converted into Secure60 schema.

We support hundreds of device and log formats including: Syslog, auditd, Windows Events, Cisco Schema, Juniper, AWS, Azure, GCP, Rackcorp, Zeek.

For details on parsing and transformation using the Secure60 Collector see: Secure60 Collector Installation and Configuration

We can also normalise from other standards such as Elastic Common Schema (ECS) and Open Cybersecurity Schema Framework (OCSF) into the Secure60 Schema, Touch base with our team for details on how to do this.

All integration methods

Every method below normalises to the same data model. The Secure60 Collector is the recommended starting point for most sources.

• Secure60 Collector — the recommended ingestion path; parsing, normalisation and masking built in
• Secure60 Win Log Agent — lightweight Windows service that ships event logs
• Secure60 Windows Log Receiver — agentless Windows Event Forwarding, no software on each host
• Microsoft 365 Connector — Microsoft 365 and Entra ID (Azure AD) telemetry
• Google Workspace Connector — Google Workspace audit and authentication logs
• Secure60 Balancer — high-availability TCP load balancing for long-lived syslog connections
• Secure60 Syslog Balancer — distributes syslog across multiple collectors to prevent hot spots
• Secure60 Netflow Processor — network flow (NetFlow) processing alongside the collector
• Secure60 AI Protector — a managed gateway that enforces guardrails for LLM/AI traffic
• Secure60 Log Analyser — automatic log-pattern discovery from your events
• External Integrations — direct integrations with applications, services and devices