Integrations
Every place a change happens, and every place its reason is written down.
Nakana is designed to read 147 sources across twelve categories. All read-only. Where you already ship logs to Datadog, Splunk or a SIEM, Nakana reads from there instead of collecting twice.
Nakana is in early access. This is our integration plan, not a list of shipped connectors. Design partners decide what we build first.
Change and incident management 12
Where the reason is written down: change requests, approvals, windows, incidents.
ServiceNowChange requests, CMDB, approvals, windows
Jira Service ManagementChange and incident tickets
Jira SoftwareIssues linked to commits
BMC Helix ITSMChange requests and approvals
FreshserviceChange and release records
Ivanti Neurons for ITSMChange requests
Azure BoardsWork items linked to commits
LinearIssues linked to PRs
PagerDutyIncidents, on-call, change events
OpsgenieIncidents and on-call
incident.ioIncidents and responders
FireHydrantIncidents and change log
Source control 6
The code behind a change, who wrote it and who reviewed it.
GitHubCommits, PRs, reviews, audit log, branch protection
GitLabCommits, MRs, audit events
BitbucketCommits, PRs, audit log
Azure ReposCommits and PRs
GerritChanges and reviews
OpenSSF ScorecardRepository security checks
CI/CD and deployment 14
The run that built and shipped the change.
GitHub ActionsWorkflow runs, workflow edits
GitLab CI/CDPipelines and deployments
JenkinsBuilds and job config changes
CircleCIPipelines and audit log
Azure PipelinesRuns, releases, approvals
BuildkiteBuilds and audit log
Argo CDSyncs, rollbacks, app changes
FluxReconciliations
SpinnakerPipeline executions
HarnessDeployments and audit trail
Octopus DeployReleases and deployments
AWS CodePipelinePipeline executions
Google Cloud DeployReleases and rollouts
Sigstore / cosignSignatures and provenance
Infrastructure as code and config management 12
The declared state a change should match.
Terraform / HCP TerraformPlans, applies, state
OpenTofuPlans, applies, state
PulumiUpdates and stack history
AWS CloudFormationStack events and drift
Azure Bicep / ARMDeployment history
CrossplaneManaged resource events
Ansible Automation PlatformJob runs and inventory
ChefConverge runs
PuppetReports and catalog changes
SaltJob returns
SpaceliftRuns and drift
env0Deployments and drift
Cloud platforms 12
Control-plane changes and the identity that made them.
AWS CloudTrailAPI activity across accounts
AWS ConfigResource configuration history
AWS IAM Identity CenterSign-ins and permission sets
Azure Activity LogResource changes
Microsoft Entra audit logsDirectory and role changes
Azure PolicyCompliance state
Google Cloud Audit LogsAdmin activity
Google Cloud Asset InventoryResource history
Oracle Cloud AuditAPI activity
CloudflareAudit logs, DNS and WAF changes
VercelDeployments and project settings
HerokuReleases and config vars
Kubernetes and containers 12
What changed in the cluster and whether GitOps put it there.
Kubernetes audit logEvery API write
Amazon EKSControl-plane logs
Azure AKSControl-plane logs
Google GKEControl-plane logs
Red Hat OpenShiftAudit log
HelmRelease history
KyvernoPolicy reports
OPA GatekeeperAdmission decisions
RancherCluster and user changes
Amazon ECRImage pushes
HarborImage pushes and audit
JFrog ArtifactoryArtifact events
Servers, kernel and endpoints 16
File, package, service, user and kernel changes on the machine itself.
Linux auditdSyscall and file audit
eBPF collectorProcess, file and network events
FalcoRuntime rule events
TetragonKernel-level events
journald / syslogSystem logs
sudo and PAMPrivilege use
Windows Event LogSecurity, system, PowerShell
SysmonProcess, file, registry
osquery / FleetPackages, users, config state
macOS Endpoint SecurityProcess and file events
CrowdStrike FalconEndpoint telemetry and detections
Microsoft Defender for EndpointDevice events
SentinelOneEndpoint events
Jamf ProDevice and policy changes
Microsoft IntuneDevice config changes
TaniumEndpoint state
Databases and data platforms 12
Schema, grant, role and parameter changes, and who ran them.
PostgreSQL (pgAudit)DDL, grants, roles
MySQL Enterprise AuditDDL and privilege changes
Percona Audit LogDDL and privilege changes
SQL Server AuditSchema and permission changes
Oracle Unified AuditingDDL and privileges
MongoDB auditingSchema, role and user changes
Amazon RDS / AuroraActivity streams, parameter groups
SnowflakeAccess and query history, grants
DatabricksAudit logs, permissions
BigQueryAdmin and data access logs
Amazon RedshiftUser activity, grants
Liquibase / FlywayMigration history
Network and security devices 13
Line-level config diffs and the session that made them.
Cisco IOS / IOS-XE / NX-OSConfig archive, TACACS+ accounting
Cisco ISEPolicy and admin changes
Cisco MerakiChange log
Juniper JunosCommit history
Arista CloudVisionConfig changes
Palo Alto Networks PanoramaConfig audit and commits
Fortinet FortiManager / FortiGatePolicy changes
Check PointPolicy installs and audit
F5 BIG-IPConfig changes
ZscalerAdmin audit log
Oxidized / RANCIDConfig backups
NetBoxIntended state
SolarWinds NCMConfig change reports
Observability, logs and SIEM 11
Use the pipelines you already pay for instead of collecting twice.
DatadogEvents, Audit Trail, Change Tracking, logs
SplunkSearch and HEC
ElasticIndices and Fleet data
New RelicChange tracking and logs
DynatraceEvents and logs
Grafana LokiLogs
Sumo LogicLogs
Google SecOpsEvents
Microsoft SentinelWorkspace tables and incidents
CriblRoute any source to Nakana
OpenTelemetryLogs and events
Identity, HR and privileged access 16
Who the person is, what they normally do, and whether they should have had access.
OktaSystem Log, groups, MFA
Microsoft Entra IDSign-ins, roles, PIM
Google WorkspaceDirectory and admin audit
JumpCloudDirectory and events
Ping IdentitySign-in events
WorkdayTeam, manager, status
BambooHRTeam, manager, leave
HiBobTeam and status
RipplingTeam and status
CyberArkCredential checkouts, sessions
BeyondTrustPrivileged sessions
DelineaSecret checkouts
TeleportSessions and access requests
StrongDMSessions and access
SailPointAccess reviews
ConductorOneAccess requests and reviews
Approvals, flags and secrets 11
The other places a change gets made or approved.
SlackApprovals, ask-the-actor
Microsoft TeamsApprovals, ask-the-actor
Google and Outlook calendarsFreezes and maintenance windows
LaunchDarklyFlag audit log
StatsigGate and experiment changes
UnleashFlag changes
AWS AppConfigConfig deployments
HashiCorp VaultAudit device
AWS Secrets Manager and KMSSecret and key changes
Azure Key VaultSecret and key changes
1PasswordEvents API
Nothing matches. Tell us what you run: [email protected]
Don't see your stack?
Tell us what you run. Anything with an audit log, an API or a syslog feed can be a source.