Skip to content
LEGIT AIDOCS
Open the console

Data plane

Everything Legit AI reads, grouped by where it comes from, and how each arrives.

Thirty-three kinds of record, from seven kinds of source. Whatever the source, an event ends on the same schema and goes through the same detection.

Data planeEverything the platform reads, on one schema
Windows SecuritySysmonWindows SystemEVTX filesUSB devicesSSH collectorLoginsOpen portsPackagesFile hashesSyslog 514CEFPCAPPCAPNGLive captureRouter readIngest APINDJSONFluent BitVectorCloudTrailAzure MonitorAWS IAMSigned bundlesYour indicatorsKnown-goodCanary tokensMITRE ATT&CKFile scansWindows programsOffice macrosAPKArchivesEndpoints 5Servers over SSH 5Network 6API and shippers 4Cloud 3Threat intelligence 5Scanned files 5
Legit AI

How each arrives

Section titled “How each arrives”
Source How it arrives
Endpoints The Windows agent sends the Security, System and Sysmon logs in batches with its own key; .evtx exports are uploaded from the console.
Servers over SSH The platform connects every 30 seconds with its own key and reads logins, listening ports, installed packages and hashes of critical files. Nothing is installed.
Network Syslog and CEF on port 514; packet captures uploaded or recorded live; a router read with its owner’s login.
API and shippers JSON, NDJSON, syslog or CEF to the ingest API with an API key, from Fluent Bit, Vector or your own scripts.
Cloud CloudTrail and Azure Monitor records through the ingest API; AWS IAM read with an assumed role, which needs access to AWS.
Threat intelligence Signed bundles applied in the console, your own indicators and known-good list, canary tokens, MITRE ATT&CK mappings.
Scanned files Any file or archive uploaded for scanning: Windows programs, Office macros, Android packages.

Read more: Connect data sources, Send events, How Legit AI works.