Integrations

Collect from anything that logs.
Parse what you send.

kymeer collects through its own agent, a syslog collector and API connectors, enriches every indicator, and learns parsers for formats it has never seen from the logs you send.

kymeer agent

Windows, macOS and Linux. Ships over HTTPS with a durable on-disk spool and installs updates only when they are signed.

kymeer collector

Receives syslog over UDP and TCP from network and security devices. Formats are detected per line.

Parser Factory

Groups logs that did not parse by device type and shape. A shape goes live in kymeer's shared parser for that device only after a quality check; otherwise it stays a draft.

CollectionBuilt

Windows endpoints

kymeer agent
CollectionBuilt

macOS endpoints

kymeer agent
CollectionBuilt

Linux endpoints

kymeer agent
CollectionBuilt

Syslog over UDP

kymeer collector
CollectionBuilt

Syslog over TCP

kymeer collector
FormatsBuilt

Syslog RFC 3164

Auto-detected per line
FormatsBuilt

Syslog RFC 5424

Auto-detected per line
FormatsBuilt

JSON

Auto-detected per line
FormatsBuilt

CEF

Auto-detected per line
FormatsBuilt

LEEF

Auto-detected per line
FormatsBuilt

key=value

Auto-detected per line
ConnectorsConnector spec

Fortinet FortiGate

API connector
ConnectorsConnector spec

FortiClient EMS

API connector
ConnectorsConnector spec

FortiEDR

API connector
ConnectorsConnector spec

Microsoft Exchange

API connector
ConnectorsConnector spec

Microsoft 365 mail

API connector
ConnectorsConnector spec

IMAP

API connector
ConnectorsConnector spec

SMTP

API connector
EnrichmentBuilt

AbuseIPDB

Lookup
EnrichmentBuilt

GreyNoise

Lookup
EnrichmentBuilt

VirusTotal

Lookup
EnrichmentBuilt

Tor exit list

Lookup
EnrichmentBuilt

DNSBL

Lookup
EnrichmentBuilt

BGP

Lookup
EnrichmentBuilt

DNS forward/reverse

Lookup
EnrichmentBuilt

WHOIS / RDAP

Lookup
EnrichmentBuilt

GeoLite2 City & ASN

Lookup
Threat feedsBuilt

Spamhaus DROP

Built-in feed
Threat feedsBuilt

Spamhaus EDROP

Built-in feed
Threat feedsBuilt

abuse.ch Feodo

Built-in feed
Threat feedsBuilt

abuse.ch URLhaus

Built-in feed
Threat feedsBuilt

abuse.ch SSLBL

Built-in feed
VulnerabilityBuilt

NVD

Inventory matching
VulnerabilityBuilt

CISA KEV

Inventory matching
VulnerabilityBuilt

EPSS

Inventory matching
VulnerabilityBuilt

OSV

Inventory matching
AI modelsBuilt

Local (Ollama, vLLM, llama.cpp)

Governed provider
AI modelsBuilt

Anthropic

Governed provider
AI modelsBuilt

OpenAI

Governed provider
AI modelsBuilt

OpenRouter

Governed provider
AI modelsBuilt

Unoblox

Governed provider
OT protocolsBuilt

Modbus

Protocol recognition
OT protocolsBuilt

DNP3

Protocol recognition
OT protocolsBuilt

S7comm

Protocol recognition
OT protocolsBuilt

OPC-UA

Protocol recognition
OT protocolsBuilt

IEC 60870-5-104

Protocol recognition
OT protocolsBuilt

IEC 61850

Protocol recognition
OT protocolsBuilt

EtherNet/IP

Protocol recognition
OT protocolsBuilt

PROFINET

Protocol recognition
OT protocolsBuilt

BACnet

Protocol recognition
OT protocolsBuilt

FINS

Protocol recognition
OT protocolsBuilt

SLMP (MELSEC)

Protocol recognition
Any other sourceParser Factory

Firewalls

Parser Factory
Any other sourceParser Factory

Identity providers

Parser Factory
Any other sourceParser Factory

Cloud audit logs

Parser Factory
Any other sourceParser Factory

SaaS audit logs

Parser Factory
Any other sourceParser Factory

Applications

Parser Factory

No named parser is promised for sources marked Parser Factory; the Parser Factory learns one from the logs you send. Ask about a specific source →