Cato Networks Integration for Elastic

Cato Networks is a cloud-native, global SD-WAN provider that delivers a secure, optimized, and agile global network for businesses of all sizes. Cato's cloud-based platform converges multiple network and security functions into a unified solution that includes SD-WAN, network security, cloud security, and secure access service edge (SASE) capabilities.

The Cato Networks integration for Elastic collects Events Feed and Audit Feed from the API and visualizes them in Kibana.

The Cato Networks integration is compatible with graphQL API version v1.

This integration periodically queries the Cato Networks GraphQL API to retrieve logs.

This integration collects log messages of the following type:

• Events Feed: Collects Events Feed logs from the Cato Networks API (endpoint: /api/v1/graphql2).

• Audit Feed: Collects Audit Feed logs from the Cato Networks API (endpoint: /api/v1/graphql2).

Audit data stream: The audit dataset contains administrative and configuration activities from the Cato Management Application (CMA), which manages the broader Cato SASE Cloud Platform.

Integrating Cato Networks with Elastic SIEM provides centralized visibility into both administrative activities and security events through the Audit and Event data streams, enabling efficient monitoring, investigation, and compliance tracking within Kibana dashboards.

The Audit data stream delivers insights into configuration changes, administrative actions, and policy modifications. Dashboards highlight metrics such as Audit by Event Type over Time and Top Admins, helping administrators monitor operational changes, track privileged activity, and support governance requirements.

The Event data stream focuses on security monitoring and threat investigation. Dashboards provide views such as Top Hosts and Events over Time, enabling analysts to detect activity spikes, identify suspicious behavior, and monitor evolving threat patterns across the environment.

Interactive filtering controls allow users to drill down across dimensions such as event type, affected models, geographic location, traffic direction, threat type, and authentication type. This supports streamlined compliance auditing, faster investigations, and a unified operational view across administrative and security data.

To collect data through the Cato Networks API, you need to provide an API Key and Account ID. Authentication is handled using the API Key, which serves as the required credential.

1. Log in to the Cato Management Application.
2. In the navigation menu, click Resources → Admin API Keys.
3. Click New. The Create API Key panel opens.
4. Provide a descriptive name for the API key (for example, "Elastic Integration").
5. Select the appropriate permissions for the API key.
6. Click the button to copy the API Key that is generated by the CMA and save it to a secure location.
7. Note your Cato Networks Account ID, which can be found in the Cato Management Application under Administration → Account → General Info.

This integration supports both Elastic Managed and Agent-based installations.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.

1. In the top search bar in Kibana, search for Integrations.

2. In the search bar, type Cato Networks.

3. Select the Cato Networks integration from the search results.

4. Select Add Cato Networks to add the integration.

5. Enable and configure only the collection methods which you will use.

   • To Collect Cato Networks logs via API, you'll need to:

     • Configure URL (the base URL of the Cato Networks API, for example, https://api.catonetworks.com).
     • Configure Account IDs.
     • Configure API Key.
     • Adjust the integration configuration parameters if required, including the Interval, Preserve original event etc. to enable data collection.

6. Select Save and continue to save the integration.

1. In the top search bar in Kibana, search for Dashboards.
2. In the search bar, type Cato Networks.
3. Select a dashboard for the dataset you are collecting, and verify the dashboard information is populated.

For help with Elastic ingest tools, check Common problems.

• The Cato Networks EventsFeed API enforces rate limiting of 100 requests per minute (approximately 1.66 requests per second). For detailed information, refer to the official documentation.

• The Cato Networks AuditFeed API enforces rate limiting of 5 requests per minute (approximately 0.083 requests per second). For detailed information, refer to the official documentation.

• If you encounter rate limiting errors, consider decreasing the Resource Rate Limit parameter or increasing the Interval value.

• Maximum Pages Per Cycle (max_executions) and rate limiting: this setting does not change how fast requests are sent, so raising it does not increase the request rate. The request rate stays bounded by the API response time (about 43 requests per minute at 1.4 seconds per request) and by Resource Rate Limit (default 1.6 requests per second, below the 100 requests per minute limit). However, Cato Networks applies this limit per query to the whole account, shared across all of its API keys, as described in Understanding Cato API Rate Limiting. Every other consumer of the EventsFeed API on the same account (other Elastic Agents or integration instances, other SIEM connectors, scripts) draws from the same budget. If more than one consumer queries the account, lower Resource Rate Limit on each so that the total stays under 100 requests per minute. Any API error, including rate limiting, makes the input report an error and retry at the next Interval.

The event data stream collects events sequentially: each request returns at most 3000 events (a limit of the Cato Networks API that automatically enables pagination when more than 3000 events are present in the API server queue, see Cato API - EventsFeed), and the next request needs the marker from the previous response, so requests cannot be issued in parallel. The maximum sustained collection rate is therefore bounded by:

3000 events / (API response time + processing time)

For example, at about 1.4 seconds per request the integration can collect roughly 2,100 events per second. If your Cato Networks account produces events faster than that, the integration falls behind and the difference between @timestamp and event.ingested keeps growing, without any errors in Fleet or Elasticsearch. Slower API response times, for example during busy periods, lower this ceiling.

• Maximum Pages Per Cycle (max_executions): limits how many pages the integration requests back to back in one cycle (default 1000, up to 3,000,000 events). When the limit is reached, the Elastic Agent logs a warning containing maximum number of CEL executions, and the next cycle starts at the next Interval tick, which is immediately if the cycle took longer than the Interval. A full-Interval pause therefore only happens on the first cycle after the input starts or restarts (for example after a policy change or an Elastic Agent restart), or when cycles are shorter than the Interval. Raising this value does not raise the throughput ceiling described above.
• Processors such as drop_event run after events have been fetched. They reduce the volume indexed in Elasticsearch, but not the number of events fetched per second, so they do not reduce the delay.
• Elasticsearch and Elastic Agent output tuning does not help when the bottleneck is retrieval from the Cato Networks API.

A delay that keeps growing should be addressed promptly: the marker expires after 3 days (see Limitation), after which events that were not yet collected are permanently lost.

• The EventsFeed API operates with a time-based data retrieval mechanism. On the initial API call, no data will be returned as it establishes a baseline marker. Subsequent requests will retrieve events that occurred between the current request and the previous one. Due to this behavior, data ingestion begins only after the first interval has elapsed, so it is expected to have a delay equal to the configured interval before seeing the first events in Elasticsearch.

• The Cato Networks EventsFeed API uses a marker-based pagination with a 3-day expiration period. If the Elastic Agent or Elasticsearch instance experiences downtime exceeding 3 days, the marker becomes invalid and any events generated during this outage will be permanently lost and cannot be recovered.

• The Cato Networks API rate limit quota is shared across all integration instances that use the same API credentials, which can impact data collection when running multiple instances simultaneously.

• The Cato Networks AuditFeed API contains certain fields with inconsistent data types across different events. These type conflicts can cause indexing failures in Elasticsearch, resulting in discrepancies between the document count stored in Elasticsearch and the total number of events returned by the API. Users can observe that not all events from the API response are successfully indexed due to these type mapping conflicts.

For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.

{
    "@timestamp": "2025-11-18T08:47:03.000Z",
    "agent": {
        "ephemeral_id": "99ec3044-a831-42d5-9c9a-c11693f17eba",
        "id": "dc44108a-a4ea-4a4f-a360-c688935ebb4b",
        "name": "elastic-agent-43217",
        "type": "filebeat",
        "version": "8.19.0"
    },
    "cato_networks": {
        "audit": {
            "account_id": "22222",
            "change": {
                "after": {
                    "action": "BLOCK",
                    "enabled": "true",
                    "name": "WAN Traffic",
                    "rule_type": "IPS",
                    "suspicious_action": "MONITOR"
                }
            },
            "model_name": "WAN Traffic",
            "model_type": "Antivirus Rule",
            "module": "Threat Protection Rule"
        }
    },
    "data_stream": {
        "dataset": "cato_networks.audit",
        "namespace": "44561",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "dc44108a-a4ea-4a4f-a360-c688935ebb4b",
        "snapshot": false,
        "version": "8.19.0"
    },
    "event": {
        "action": "created",
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2025-11-18T08:47:10.734Z",
        "dataset": "cato_networks.audit",
        "ingested": "2026-07-03T11:24:10Z",
        "kind": "event",
        "original": "{\"account_id\":\"22222\",\"admin\":\"System User #40276\",\"admin_id\":\"40276\",\"change.After.action\":\"BLOCK\",\"change.After.enabled\":\"true\",\"change.After.name\":\"WAN Traffic\",\"change.After.ruleType\":\"IPS\",\"change.After.suspiciousAction\":\"MONITOR\",\"change_type\":\"CREATED\",\"creation_date\":\"1763455623000\",\"insertion_date\":\"1763455630734\",\"model_name\":\"WAN Traffic\",\"model_type\":\"Antivirus Rule\",\"module\":\"Threat Protection Rule\"}",
        "type": [
            "info",
            "creation"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "user": [
            "40276",
            "System User #40276"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "cato_networks-audit"
    ],
    "user": {
        "id": "40276",
        "name": "System User #40276"
    }
}

{
    "@timestamp": "2026-03-02T10:43:11.573Z",
    "agent": {
        "ephemeral_id": "35454f56-d452-4d7f-b9f8-5a9e39df533c",
        "id": "e345b805-ff83-41b0-b718-69fff6c02587",
        "name": "elastic-agent-96787",
        "type": "filebeat",
        "version": "8.19.0"
    },
    "cato_networks": {
        "event": {
            "ad_name": "James Smith",
            "app_stack": "TCP, TLS, HTTP(S)",
            "application_id": "http",
            "application_risk": 2,
            "application_type": "System",
            "categories": "Gambling",
            "cato_app": "http",
            "client_class": "unclassified tls",
            "client_version": "5.21.5.8548",
            "congestion_algorithm": "BBR",
            "connection_origin": "Cato Client",
            "device_categories": "PC",
            "device_name": "WORKSTATION-01",
            "device_os_type": "Windows Workstation",
            "device_posture_profile": "Windows managed",
            "device_type": "Workstation",
            "egress_pop_name": "Bucharest",
            "event_count": 1,
            "event_sub_type": "Internet Firewall",
            "event_type": "Security",
            "flow_id": "362862917479975360",
            "internal_id": "250b9bf09f51bff2",
            "internalid": "250b9bf09f51bff2",
            "isp_name": "Cato Networks Inc.",
            "network_rule": "Akira Impossible Travel",
            "os_type": "OS_WINDOWS",
            "public_ip": "81.2.69.144",
            "qos_priority": 10,
            "src_is_site_or_vpn": "SDP User",
            "src_isp_ip": "89.160.20.112",
            "src_site_id": "1000033",
            "src_site_name": "Jane Smith",
            "static_host": false,
            "tcp_acceleration": true,
            "time": "2026-03-02T10:43:11.573Z",
            "tls_inspection": true,
            "traffic_direction": "OUTBOUND",
            "url": "https://shop.example.org/",
            "user_reference_id": "2770852121",
            "visible_device_id": "00-00-5e-00-53-01"
        }
    },
    "client": {
        "ip": "1.128.0.0"
    },
    "data_stream": {
        "dataset": "cato_networks.event",
        "namespace": "86257",
        "type": "logs"
    },
    "destination": {
        "address": "89.160.20.128",
        "geo": {
            "country_iso_code": "US",
            "country_name": "United States"
        },
        "ip": "89.160.20.128",
        "port": 443
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "e345b805-ff83-41b0-b718-69fff6c02587",
        "snapshot": false,
        "version": "8.19.0"
    },
    "event": {
        "action": "prompt",
        "agent_id_status": "verified",
        "category": [
            "network"
        ],
        "dataset": "cato_networks.event",
        "id": "250b9bf09f51bff2",
        "ingested": "2026-07-03T11:25:32Z",
        "kind": "event",
        "original": "{\"ISP_name\":\"Cato Networks Inc.\",\"account_id\":\"12345\",\"account_name\":\"Demo-Mode\",\"action\":\"Prompt\",\"ad_name\":\"James Smith\",\"app_stack\":\"TCP, TLS, HTTP(S)\",\"application_id\":\"http\",\"application_name\":\"HTTP(S)\",\"application_risk\":\"2\",\"application_type\":\"System\",\"categories\":\"Gambling\",\"cato_app\":\"http\",\"client_class\":\"unclassified tls\",\"client_ip\":\"1.128.0.0\",\"client_version\":\"5.21.5.8548\",\"configured_host_name\":\"WORKSTATION-01\",\"congestion_algorithm\":\"BBR\",\"connection_origin\":\"Cato Client\",\"dest_country\":\"United States\",\"dest_country_code\":\"US\",\"dest_ip\":\"89.160.20.128\",\"dest_port\":\"443\",\"device_categories\":\"PC\",\"device_id\":\"000000000000000000000001\",\"device_name\":\"WORKSTATION-01\",\"device_os_type\":\"Windows Workstation\",\"device_posture_profile\":\"Windows managed\",\"device_type\":\"Workstation\",\"domain_name\":\"shop.example.org\",\"egress_pop_name\":\"Bucharest\",\"event_count\":\"1\",\"event_id\":\"250b9bf09f51bff2\",\"event_sub_type\":\"Internet Firewall\",\"event_type\":\"Security\",\"flow_id\":\"362862917479975360\",\"full_path_url\":\"https://shop.example.org/\",\"host_ip\":\"1.128.0.0\",\"host_mac\":\"00:00:5e:00:53:01\",\"http_request_method\":\"GET\",\"internalId\":\"250b9bf09f51bff2\",\"internal_id\":\"250b9bf09f51bff2\",\"ip_protocol\":\"TCP\",\"network_rule\":\"Akira Impossible Travel\",\"os_type\":\"OS_WINDOWS\",\"os_version\":\"11\",\"pop_name\":\"Miami\",\"prompt_action\":\"\",\"public_ip\":\"81.2.69.144\",\"qos_priority\":\"10\",\"request_size\":\"0\",\"rule_id\":\"8512269566766760473\",\"rule_name\":\"Prompt for Risky Categories\",\"server_ip\":\"89.160.20.128\",\"src_country\":\"United States\",\"src_country_code\":\"US\",\"src_ip\":\"1.128.0.0\",\"src_is_site_or_vpn\":\"SDP User\",\"src_isp_ip\":\"89.160.20.112\",\"src_port\":\"59929\",\"src_site_id\":\"1000033\",\"src_site_name\":\"Jane Smith\",\"static_host\":\"false\",\"tcp_acceleration\":\"true\",\"time\":\"1772448191573\",\"time_str\":\"2026-03-02T10:43:11Z\",\"tls_inspection\":\"true\",\"traffic_direction\":\"OUTBOUND\",\"url\":\"https://shop.example.org/\",\"user_agent\":\"Python-urllib/3.10\",\"user_id\":\"1000033\",\"user_name\":\"Jane Smith\",\"user_reference_id\":\"2770852121\",\"visible_device_id\":\"00-00-5e-00-53-01\",\"vpn_user_email\":\"jane.smith@test.example.com\"}",
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "000000000000000000000001",
        "ip": [
            "1.128.0.0"
        ],
        "mac": [
            "00-00-5E-00-53-01"
        ],
        "name": "workstation-01",
        "os": {
            "type": "windows",
            "version": "11"
        }
    },
    "http": {
        "request": {
            "bytes": 0,
            "method": "GET"
        }
    },
    "input": {
        "type": "cel"
    },
    "network": {
        "direction": "outbound",
        "transport": "tcp"
    },
    "observer": {
        "name": "Miami"
    },
    "organization": {
        "id": "12345",
        "name": "Demo-Mode"
    },
    "related": {
        "hosts": [
            "WORKSTATION-01",
            "workstation-01",
            "shop.example.org"
        ],
        "ip": [
            "1.128.0.0",
            "89.160.20.128",
            "81.2.69.144",
            "89.160.20.112"
        ],
        "user": [
            "James Smith",
            "Jane Smith",
            "1000033",
            "jane.smith@test.example.com"
        ]
    },
    "rule": {
        "id": "8512269566766760473",
        "name": "Prompt for Risky Categories"
    },
    "server": {
        "ip": "89.160.20.128"
    },
    "service": {
        "name": "HTTP(S)"
    },
    "source": {
        "address": "1.128.0.0",
        "geo": {
            "country_iso_code": "US",
            "country_name": "United States"
        },
        "ip": "1.128.0.0",
        "port": 59929
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "cato_networks-event"
    ],
    "url": {
        "domain": "shop.example.org",
        "full": "https://shop.example.org/"
    },
    "user": {
        "email": "jane.smith@test.example.com",
        "id": "1000033",
        "name": "Jane Smith"
    },
    "user_agent": {
        "device": {
            "name": "Spider"
        },
        "name": "Python-urllib",
        "original": "Python-urllib/3.10",
        "version": "3.10"
    }
}

This input is used in the integration:

• CEL

This integration uses the following Cato Networks API:

Events Feed: Cato Networks Events Feed API documentation. Audit Feed: Cato Networks Audit Feed API documentation.

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.