Connector deploy, the 5-minute version.

Sometimes you just need data flowing now. This is the short path: pick a source, deploy its connector with auto-provisioned IAM, and watch the first events land — no console, no ticket.

Pick a connector

List what is available for the surface you care about. Each connector reports its typical throughput and ingest latency so you know what you are signing up for.

SHELLlist connectors
$ td connector available --surface=cloud
  NAME                STATUS   EVENTS/S   AVG INGEST
  aws-cloudtrail      stable   ~120k      210ms
  azure-activity      stable   ~85k       240ms
  gcp-audit-log       stable   ~60k       220ms
  okta-system-log     stable   ~12k       140ms
  ... 74 more

Deploy it

Deploy against the source account. With --auto-iam the CLI provisions the read-only role itself; drop the flag and it prints the trust policy for you to apply by hand.

SHELLdeploy
$ td connector deploy aws-cloudtrail --region=us-east-1 --auto-iam
  -> provisioning IAM role td-cloudtrail-reader . ok
  -> subscribing to CloudTrail Lake . ok
  ok  connector cn_3kPqR9 deployed in 12s . HEALTHY

Confirm data flows

Tail the stream to prove it end to end. Within seconds you should see live events with severity coloring.

SHELLtail
$ td events tail --source=cloud.audit --limit=3
  14:21:08Z  MED   ev_8Z anomalous OAuth grant (user=svc-deploy)
  14:21:11Z  LOW   ev_90 console login from new ASN
  ok  events flowing

Where to go next

• Quickstart — the full first-detection walkthrough.
• Integrations — the full connector catalog.