it can accept logs from osqueryd(which is the default) and then you can use that to create your own logging pipeline and add them to sumologic/streamalert or wherever