Events

Ingests security and connectivity events from Cato Networks SASE platform via the EventsFeed GraphQL API.

Description

This source connector fetches events from the Cato Networks EventsFeed API, which provides large-scale event monitoring capabilities for security, connectivity, and network activity across your Cato SASE deployment.

This connector is built on top of the universal GraphQL input and is pre-configured with Cato Networks specific authentication and endpoint settings.

Features

• Automatic Pagination: Built-in cursor-based pagination support with configurable paths
• State Management: Maintains pagination state for incremental data collection

Prerequisites

1. Find your Cato Account ID

The Account ID isn't shown in the Cato Management Application, rather you can find it as a number embedded in the URL. For example, the Account ID is 2634 in the following URL: https://cc.catonetworks.com/#!/account/2634/topology

2. Create an API Key
3. Enable the events feeds on your account

• Navigate to System > API Access Management.
• Select Event Feed Enabled.
  • After this, your account starts sending events to Cato API server. Wait about 30 minutes for Cato to collect enough events to return data for the API query.

Configuration

Settings

Setting	Type	Required	Description
Account ID	string	Yes	Cato Account ID

Secrets

Setting	Type	Required	Description
API Key	string	Yes	The API Key for authentication with Cato Networks

Related Articles

• Cato Networks API Documentation
• Cato Networks Events Feed API Documentation

Sample Records

{
  "data": {
    "eventsFeed": {
      "marker": "W3siVG9waWMiOiIxODIiLCJQYXJ0aXRpb24iOjAsIk9mZnNldCI6MzIxNTM4fV0=",
      "fetchedCount": 1,
      "accounts": [
        {
          "id": "123",
          "errorString": "",
          "records": [
            {
              "fieldsMap": {
                "ISP_name": "IP Addresses Are Assigned Statically",
                "account_id": "123",
                "client_version": "8.0.4127",
                "event_count": "1",
                "event_sub_type": "Disconnected",
                "event_type": "Connectivity",
                "event_id": "7r0c7xUYIf",
                "link_type": "Cato",
                "pop_name": "Amsterdam",
                "socket_interface": "WAN1",
                "src_country": "Israel",
                "src_country_code": "IL",
                "src_is_site_or_vpn": "Site",
                "src_isp_ip": "1.2.3.4",
                "src_site": "native-range",
                "time": "1677170467000",
                "tunnel_protocol": "DTLS"
              }
            }
          ]
        }
      ]
    }
  }
}
`