Other sources

One short section per source. Uploads do not appear as configured sources; they appear in the Evidence Store and as upload entries on the Sources page.

Windows event log upload (.evtx, .xml, .csv)

• Source tile Windows Event Logs, or the upload panel inside an investigation. Accepted: .evtx, .xml, .csv. Up to 512 MB per file. Enter the host the logs came from in the Source Hostname field; it is optional and applies to every file in the batch.
• Events are parsed at upload, matched against Sigma rules, and written to the evidence store one row per event. A duplicate (same SHA-256) is refused.
• A file that yields no events is refused with a message that names what it found; for a CSV it lists the columns it saw and the two header layouts it accepts (the Event Viewer GUI export and Get-WinEvent).
• Community Edition allows 5 uploads per investigation across all three upload types.

The CSV date-order rule

An .evtx or XML export records each event's time in ISO 8601. A CSV export from the Event Viewer window writes the Date and Time column in the exporting PC's locale, so 01/09/2026 is 1 September on an Australian, British or French PC and 9 January on a US one. Prefer .evtx or XML.

When you do upload a CSV, CICADA decides the order once for the whole file:

• Any value with a day over 12 in the first position makes the file day-first; a value over 12 in the second position makes it month-first.
• If nothing in the file settles it, the dates are read month-first and the upload carries a warning saying so.
• If the file holds values that can only be day-first and values that can only be month-first, its order cannot be trusted; ambiguous values are read month-first and the upload response records the order as conflicting, with a warning.
• A value that is not a real date in the order it implies (a typo such as 31/02) does not decide the order.

An event whose timestamp cannot be read at all is not stored. CICADA never invents a time. The upload response reports the count, the upload panel shows a skipped (no timestamp) badge next to the file, and the uploads list on the Sources page names it. Of the date-order outcomes only the assumed case gets a badge, dates read as month/day (assumed), with the warning as its tooltip; the conflicting case and the settled day-first or month-first decisions are in the upload response but are not shown on screen.

Log file upload (.log, .txt, .csv)

• Source tile Log Files. Up to 500 MB. Formats detected automatically: Apache access (common and combined), Apache error, Squid, Citrix ADC syslog, Linux auth logs (auth.log, secure) and a generic CSV with timestamp, user, IP, message and level columns.
• A file in which no line matches a supported format is refused and not stored. An explicit log type is checked the same way as auto, and a CSV with only a header row is refused too. Detection matches on the first line that parses, so a file where one line parses and the rest do not is accepted; check the entry count on the badge.
• Lines over 16 KB are skipped and counted, never silently dropped.

PCAP upload

• Source tile PCAP File Analysis. Accepted: .pcap, .pcapng, .cap. Up to 2 GB.
• The upload panel (Upload All & Analyze) stores each file and starts its analysis at once. Analysis produces flows, DNS records, TLS handshakes, extracted indicators and network findings. Link-type aware: Ethernet, 802.11, radiotap, SLL and others.
• A capture with packets but no IP traffic (for example only 802.11 management frames or EAPOL handshakes) completes with zero flows and an explanatory note rather than an error.

Syslog receiver

• Source tile Syslog Server. Fields: Listen Host (default 0.0.0.0), Listen Port (default 1514, range 1 to 65535), Protocol UDP or TCP. Messages in RFC 3164 and RFC 5424 are parsed and stored as evidence.
• The listener binds when the source is saved and is re-bound only if the host, port or protocol changes, so editing a source does not drop messages that arrived meanwhile.
• The sealed appliance's own firewall accepts inbound TCP on ports 443 and 80 only; there is no UDP rule and no rule for 1514. A syslog listener is therefore not reachable from the network on the current image. The form's help text still says to point devices at 1514 or forward 514 to it, and the connection test reports healthy (Listening on UDP 0.0.0.0:1514; 0 message(s) queued) because it only checks that the socket is bound. Do not plan on the receiver until a release opens the port.

DNS, DHCP and web log files

These three read a file by path on the appliance, and saving the source fails unless that path exists. The sealed image opens no SSH and no upload route writes to a path you choose, so on the appliance there is no way to place the file and these three sources cannot be used today. Use the log file upload above for Apache logs.

Varonis

• Enterprise tier. Fields: Base URL, API Key, API Secret. CICADA exchanges the key and secret for a token at /api/authentication/api-keys/token.
• Collects DatAlert alerts and data access events (/api/alert/alert/GetAlerts, /api/datadvantage/events). The connection test reads alerts.

BigID

• Enterprise tier. Fields: Base URL and either an API Token or a Username and Password (exchanged at /api/v1/sessions).
• Collects data catalog assets and scan results (/api/v1/data-catalog, /api/v1/scans). The connection test reads /api/v1/system-health.

Microsoft Purview

Uses the same app registration as the other Microsoft connectors. Fields and permissions are on the Microsoft Entra ID app registration page.

Kali tools sandbox

Enterprise tier (external tool execution). The Sources form labels it Coming Soon. What exists today:

• An adapter that runs security tools as subprocesses with a time limit (default 300 seconds), a memory limit (default 512 MB), a process cap, and credential files that are written with owner-only permissions into a temporary tree and wiped afterwards. The tools it implements are CrackMapExec, NetExec, Snaffler, nmap and SharpHound. The appliance build installs none of them, so the health check reports No Kali tools found on PATH (dry-run mode).
• Fields: Tool, Timeout, Memory Limit, Allowed Networks (CIDR list) and Target Validation. The Tool list offers nmap, nikto, gobuster, enum4linux and smbclient; only nmap is also implemented by the adapter.
• Target validation refuses any IP or CIDR target outside the allowed networks before anything runs. It has three states, and the health message states which one you are in: off (tools will run against any target they are given); on with no networks (no target is refused); or on with networks (Targets outside ... will be refused). A hostname is not checked, because it is resolved only when the tool runs. nmap scan types are limited to a fixed allow list.

Next

• Threat intelligence providers
• Back to the onboarding overview