Cybatar Security Hub · Governance · Risk Management · Threat Resilience · Compliance & Audit
Unified enterprise security operations for modern organisations
Security Hub
Client login Open portal
Cybatar / Developers / Event-source onboarding
Developer guide

Event-source onboarding

The event-source registry is the operational starting point for systems that feed Cybatar. A source record identifies where data should come from; actual ingestion still requires a configured collection, transport and normalization path.

Published 2026-08-17Reviewed 2026-08-17

Implementation facts

The event-source model exposes name, source type, vendor, product, status, health status, last-seen time and collector key fields. The current source types include manual, webhook, API, CSV, endpoint, firewall and cloud. The Event Sources interface explicitly names firewalls, endpoint tools, Microsoft 365, Google Workspace, Wazuh, cloud logs and webhooks as source examples.

Recommended implementation workflow

STEP 1

Identify the upstream system and the telemetry required from it.

STEP 2

Choose the source type that best describes the collection method.

STEP 3

Record vendor/product identity and assign an owner for the source.

STEP 4

Configure the actual transport, receiver, webhook, API or file ingestion path required by the source.

STEP 5

Map incoming fields into the relevant normalized event model.

STEP 6

Verify last-seen and health information and test the end-to-end alert or incident path.

Security and claim boundary

A registered source is not evidence that telemetry is actively flowing. Collection health should be validated using real source activity and deployment-specific checks.

Frequently asked questions

What is the difference between registering a source and ingesting events?

Registration creates source context. Ingestion requires a working transport, authentication and mapping path that delivers actual events.

Which source types are available?

The current event-source creation workflow exposes manual, webhook, API, CSV, endpoint, firewall and cloud source types.

Can event-source health be tracked?

The source record includes status, health status and last-seen context, which can be used as part of deployment monitoring.