Native sources

Six native sources emit events automatically when SIEM is enabled:

• turtini_auth — login attempts, new devices, failed authentications
• turtini_crm — contact and account creates, updates, and deletions
• turtini_contracts — contracts sent, signed, and viewed
• turtini_payments — payment method changes and completions
• turtini_fraud — fraud risk flags from the contact fraud check
• turtini_admin — role changes, member adds/removes, org setting changes

To disable a source:
Security → Integrations → Native Sources → toggle off

Disabling a source stops new events from being collected but does not delete existing events.