# Events

Ingests security and connectivity events from Cato Networks SASE platform via the EventsFeed GraphQL API.

## Description
This source connector fetches events from the Cato Networks EventsFeed API, which provides large-scale event monitoring capabilities for security, connectivity, and network activity across your Cato SASE deployment.

This connector is built on top of the universal GraphQL input and is pre-configured with Cato Networks specific authentication and endpoint settings.

## Features

- **Automatic Pagination**: Built-in cursor-based pagination support with configurable paths
- **State Management**: Maintains pagination state for incremental data collection

## Prerequisites

1. **Find your Cato Account ID**

The Account ID isn't shown in the Cato Management Application, rather you can find it as a number embedded in the URL. For example, the Account ID is 2634 in the following URL: https://cc.catonetworks.com/#!/account/2634/topology 

2. **Create an API Key**
3. **Enable the events feeds on your account**
- Navigate to System > API Access Management.
- Select **Event Feed Enabled**.
    - After this, your account starts sending events to Cato API server. Wait about 30 minutes for Cato to collect enough events to return data for the API query.

## Configuration

### Settings

| Setting     | Type    | Required  | Description             |
|-------------|---------|-----------|-------------------------|
| Account ID  | string  | Yes       | Cato Account ID         |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Secrets

| Setting   | Type   | Required | Description                                       |
|-----------|--------|----------|---------------------------------------------------|
| API Key   | string | Yes      | The API Key for authentication with Cato Networks |


## Related Articles

- [Cato Networks API Documentation](https://api.catonetworks.com/documentation/)
- [Cato Networks Events Feed API Documentation](https://api.catonetworks.com/documentation/#query-eventsFeed)

## Sample Records

```json
{
  "data": {
    "eventsFeed": {
      "marker": "W3siVG9waWMiOiIxODIiLCJQYXJ0aXRpb24iOjAsIk9mZnNldCI6MzIxNTM4fV0=",
      "fetchedCount": 1,
      "accounts": [
        {
          "id": "123",
          "errorString": "",
          "records": [
            {
              "fieldsMap": {
                "ISP_name": "IP Addresses Are Assigned Statically",
                "account_id": "123",
                "client_version": "8.0.4127",
                "event_count": "1",
                "event_sub_type": "Disconnected",
                "event_type": "Connectivity",
                "event_id": "7r0c7xUYIf",
                "link_type": "Cato",
                "pop_name": "Amsterdam",
                "socket_interface": "WAN1",
                "src_country": "Israel",
                "src_country_code": "IL",
                "src_is_site_or_vpn": "Site",
                "src_isp_ip": "1.2.3.4",
                "src_site": "native-range",
                "time": "1677170467000",
                "tunnel_protocol": "DTLS"
              }
            }
          ]
        }
      ]
    }
  }
}
`