Where this collector family fits
SaaS audit collectors bring important business-platform activity into Nova so investigators can see relevant administrative and user changes alongside other security evidence.
- Administrative activity review
- User-change investigation
- Cross-source timeline context
Supported collectors in this family
Nova currently implements 3 collectors in this family. Each entry names the source and the customer outcome it supports.
- Salesforce Audit Logs
- Brings Salesforce Audit Logs activity into Nova for security monitoring, investigation, and audit review.
- ServiceNow Audit Logs
- Brings ServiceNow Audit Logs activity into Nova for security monitoring, investigation, and audit review.
- Slack Audit Logs
- Brings Slack Audit Logs activity into Nova for security monitoring, investigation, and audit review.
How the evidence supports customer work
Nova keeps collected data linked to its source as it is used for asset inventory, cloud security, detection, investigation or Threat Hunting. Collecting data does not by itself prove a threat or authorize a response action.
Source coverage is not assumed to be complete. Nova keeps collection health, freshness, gaps, and partial results visible so teams can judge whether the evidence is suitable for the decision at hand.
Questions to answer during evaluation
- Which named sources are required for the use case, and which are optional context?
- What history, accounts, subscriptions, organizations, projects, or devices are available to the source product?
- What delay, volume, and missing-data conditions are acceptable for the intended decision?
- Which customer team owns source access, data interpretation, and ongoing health review?