Integrations
Will it read our sources and reach our tools?
Log collection and tool integrations
An integration needs to supply the records or actions required for the task. Review the available source, collection method and permissions, then demonstrate the full handover into investigation or response.
How data comes in and goes out
The SIEM agent encrypts logs in transit and holds them through an outage. Agentless systems are read remotely.
SIEM parsers turn different log formats into fields analysts can search and compare. Retaining the raw record helps the team investigate changes in a source format.
DLP events can enter the monitoring record, and a detection can open an incident workflow. The handover keeps the source evidence connected to the response.
Notifications and ticketing bring work to the right team. Response integrations use configured permissions to carry out approved operations and record their results.
Built-in, commercial, open-source or internal feeds can add context to an indicator. Keep the source and age visible so the analyst can judge how much weight to give the match.
Detection reads approved SIEM exports. AI Investigation uses supported findings and alerts to gather permitted evidence and prepare a case, with source and integration requirements established during evaluation.
Supported source types
Each source shows its status, and a silent one raises an alert.
Network
Network devices, firewalls and flow data use standard protocols.
Windows
Windows event logs are filtered at the agent, so only what matters travels.
Databases
Applications that log to a database are read directly.
Files
Log files are read from servers, shares and disks, legacy formats included.
Cloud
Cloud and streaming platforms connect through their APIs.
APIs
Every product has a REST API.
Products
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
