---
title: "Axis Security"
slug: "axis"
tags: ["Self Service Ingestion"]
updated: 2025-01-26T16:12:02Z
published: 2025-01-26T16:12:02Z
canonical: "docs.hunters.ai/axis"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Axis Security

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Axis Activity Logs |  |  | ✅ | ✅ | axis_activity_logs | NDJSON | S3 |

---

## Overview

![image.png](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image%28134%29.png?sv=2026-02-06&spr=https&st=2026-11-04T16%3A40%3A36Z&se=2026-11-04T17%3A40%3A36Z&sr=c&sp=r&sig=KjciQj0yaLRHnwqcIXrsUQvjm%2FEv3GsUipLSJPzlBe0%3D)[Axis Atmos Cloud](https://docs.axissecurity.com/docs/getting-started) securely connects any user to any business application or resource, via a centrally managed service.

The Axis audit logs contain various actions made by users, such as ZTNA logs, DNS Requests, SWG events, IPSEC Filtering, etc. Onboarding the logs into Hunters allows ingestion of the data, as well as levaraging the data in various detection and investigation use cases.

## Supported data types

### Axis Activity Logs

**Table name:** `axis_activity_logs`

The Axis audit logs contain various actions made by users, such as ZTNA logs, DNS Requests, SWG events, IPSEC Filtering, etc.

## Send data to Hunters

Hunters supports the ingestion of Axis logs via an intermediary AWS S3 bucket.

**To connect Axis logs:**

1. Follow [this guide](https://docs.axissecurity.com/docs/sending-logs-to-syslog) by Axis to export the audit logs via a syslog integration, then to S3.
2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](/v1/docs/connect-data-through-aws-s3).

## Expected format

### Auth log

Logs are expected in NDJSON format.

```json
{"sessionId":"12345abcdeghij6789jhklm","eventId":"a123brt-2e03-44a8-99e5-9876dfghj","timestamp":"2023-10-20T15:15:48.098Z","applicationId":"34567jh-94a2-41ba-b0b9-rtyu8765","applicationName":"abcd-cdn-som.example.com","applicationProtocol":"Http","applicationAddress":"abcd.som.example.com:80","applicationType":"ManagementDefined","operationSystem":"Mac OS X","geoLocation":"LT","userId":"samlp|example-4c4554a3ce134c9e8e1ca07d88b204f7|user@example.com","username":"user@example.com","userDisplayName":"User","groups":["K-OKTA-APP_abcd"],"identityProviderId":"7caf92b6-52ab-4939-a5a9-9b707603cb81","isBlocked":false,"ruleId":"0d502f27-bab2-4e50-82f3-5558aa0770e5","ruleName":"web_abcd-cdn-example.com","eventType":"Connect","eventDescription":"TCP connection established","additionalData":{"actualApplicationAddress":"abcdcdn.som.example.com:80"},"sourceIp":"111.222.333.44","tenantName":"example","time":"2023-10-20T15:15:48.098Z","tenantId":"234fg6-ecea-4b18-9081-12345sdfg"}
```