---
title: "Sending data to Devo"
canonical: "https://docs.devo.com/space/latest/94652410/Sending%20data%20to%20Devo"
format: markdown
---
> Macro (toc)

## What data can I send to Devo?

The Devo platform can ingest any kind of data. Some common [examples](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1328382019) are activity logs of: 

- Endpoints, such as [Windows](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1302691868).
- Network devices, such as [firewalls](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94662975).
- Applications, such as [Microsoft 365](https://devodocs.atlassian.net/wiki/spaces/latest/pages/622952489).
- Cloud infrastructure, such as [CloudTrail](https://devodocs.atlassian.net/wiki/spaces/latest/pages/612859906).

## Why send data to Devo?

- Devo searches your logs faster.
- Devo prevents attackers from modifying logs to hide their work.
- Devo automates incident detection and response.
- Devo ensures compliance with data retention obligations.

## How do I keep it secure?

An attacker can delete all data from a Devo domain if:

- They are the [owner](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763337) of the domain.
- They have *[Manage users](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763681)* permission, which enables changing the owner.
- They have [provisioning](https://docs.devo.com/space/latest/177864705/Provisioning+API) credentials.

An attacker can create misleading data using:

- An X.509 [certificate](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763741).
- An HTTP [token](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658823).
- [Tokens](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1145110536) or [permissions](https://devodocs.atlassian.net/wiki/spaces/LT/pages/673284167) that can create credentials.

Do not issue sensitive accounts and credentials to unauthorized people.

Users may authorize [untrusted entities](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1311703065) to send to Devo.

## How do I send data to Devo?

There are three requirements for sending data:

1. The data must be encrypted.
2. The data must be authorized with an [X.509 signature](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94653692) or [token](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94658823).
3. Events must arrive at Devo with an [associated tag](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

Often, these requirements are automatically met by [tools that Devo provides](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1328382019).  Data sources in the local network which do not meet those requirements can still be used via the [Devo Relay](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96468993).  Data outside the local network can be retrieved with the [Cloud Collector Application](https://devodocs.atlassian.net/wiki/spaces/latest/pages/333905965).


This flow chart is a simple overview of good practices for sending data to Devo:

![ingestion_diagram.png](media://bf79118d-7a01-4e4a-8af3-90056690cf9d)

> Macro (pagetree)