Integrations

1Password

Source

1Password

Manages and secures user credentials, secrets, and vaults for individuals and organizations.

A10 Networks

Source

A10 Networks vThunder

Delivers application load balancing, traffic management, and DDoS protection for enterprise networks.

Amazon

Source

Amazon AWS CloudTrail

Tracks AWS account activity and API usage for auditing, governance, and compliance monitoring.

Source

Amazon AWS CloudWatch

Monitors AWS resources and applications by collecting metrics, logs, and setting alarms.

Destination

Amazon AWS S3

Scalable cloud storage service for storing and retrieving any amount of data via object storage.

Destination

Amazon AWS Security Lake

Centralizes and normalizes security data from AWS and third-party sources for analytics and compliance.

Axoflow

Axoflow AxoRouter

Manages and routes event flow through pipelines, including filtering, parsing, and transformations.

Axoflow AxoSyslog

High-performance, configurable syslog service for collecting, processing, and forwarding log data.

Box, Inc.

Source

Box, Inc. Box

Cloud-based content management and file sharing platform designed for secure collaboration and storage.

Broadcom

Source

Broadcom Edge Secure Web Gateway (Edge SWG)

Secures web traffic through policy enforcement, SSL inspection, and real-time threat protection.

Source

Broadcom NSX

Provides network virtualization, micro-segmentation, and security for software-defined data centers.

Check Point Software

Source

Check Point Software Anti-Bot

Detects and blocks botnet communications and command-and-control traffic to prevent malware infections.

Source

Check Point Software Anti-Malware

Protects endpoints from viruses, ransomware, and other malware using signature and behavior analysis.

Source

Check Point Software Anti-Phishing

Prevents phishing attacks by analyzing email content and links to block credential theft attempts.

Source

Check Point Software Anti-Spam and Email Security

Blocks spam and malicious email content using reputation checks and email filtering techniques.

Source

Check Point Software Quantum

Unified threat prevention platform delivering firewall, VPN, and intrusion prevention capabilities.

Source

Check Point Software CPMI Client

Legacy Check Point management client used to interface with security policies and logs.

Source

Check Point Software cpmidu_update_tool

Utility used to update configuration and database files for Check Point Multi-Domain environments.

Source

Check Point Software Database Tool

Command-line tool to extract, query, or update Check Point configuration and policy databases.

Source

Check Point Software Endpoint Compliance

Checks endpoint status and posture before granting network access, enforcing security policies.

Source

Check Point Software Endpoint Management

Centralized platform for managing endpoint protection, updates, and policy enforcement.

Source

Check Point Software Next-Generation Firewall (NGFW)

Next-generation firewall providing intrusion prevention, application control, and threat protection.

Source

Check Point Software Forensics

Analyzes security incidents on endpoints to uncover attack vectors and malicious activity.

Source

Check Point Software Generic Checkpoint Product

Placeholder integration used for generic or unsupported Check Point log sources.

Source

Check Point Software GO Password Reset

Facilitates secure password reset processes for users across integrated environments.

Source

Check Point Software HTTPS Inspection

Decrypts and inspects HTTPS traffic to detect hidden threats within encrypted web sessions.

Source

Check Point Software Edge Secure Web Gateway (Edge SWG)

Provides configuration profiles for secure mobile access and web filtering on iOS devices.

Source

Check Point Software IPS

Detects and blocks known and unknown exploits, malware, and vulnerabilities in network traffic.

Source

Check Point Software MDS Query Tool

CLI tool for querying multi-domain configurations and policies in Check Point environments.

Source

Check Point Software Media Encryption & Port Protection

Secures USB ports and encrypts removable media to protect sensitive data on endpoints.

Source

Check Point Software Mobile Access

Enables secure remote access to corporate apps and data from mobile devices.

Source

Check Point Software QoS

Implements bandwidth control and traffic prioritization policies for optimized network usage.

Source

Check Point Software Query Database

Accesses and queries internal policy or object databases in Check Point systems.

Source

Check Point Software SmartConsole

Graphical interface for managing Check Point security policies, logs, and monitoring.

Source

Check Point Software SmartUpdate

Tool for updating and managing licenses, software, and hotfixes in Check Point environments.

Source

Check Point Software Syslog Data

Enables export of Check Point logs via syslog to external monitoring and SIEM platforms.

Source

Check Point Software Threat Emulation and Anti-Exploit

Emulates files in a virtual environment to detect and block advanced persistent threats and exploits.

Source

Check Point Software URL Filtering

Controls and logs web access based on URL categories and custom site rules to enforce policy.

Source

Check Point Software Web API

Provides programmatic access to Check Point security management through RESTful API endpoints.

Cisco

Source

Cisco Application Control Engine (ACE)

Provides application-aware load balancing, SSL offload, and traffic control for Cisco networks.

Source

Cisco Access Control System (ACS)

Centralizes network access control with RADIUS and TACACS+ for authentication and authorization.

Source

Cisco Adaptive Security Appliance (ASA)

Provides stateful firewall, VPN support, and advanced threat protection for secure network perimeters.

Source

Cisco Catalyst

Delivers enterprise-grade Ethernet switching with high performance, security, and scalable management.

Source

Cisco Integrated Management Controller (IMC)

Provides out-of-band server management for Cisco UCS, enabling hardware monitoring and configuration.

Source

Cisco Digital Network Architecture (DNA)

Provides software-defined networking, policy automation, and analytics for enterprise infrastructure.

Source

Cisco Duo

Delivers two-factor authentication and secure access controls to protect users and applications.

Source

Cisco Email Security Appliance (ESA)

Protects email systems from spam, phishing, malware, and data loss with advanced threat filtering.

Source

Cisco Firepower

Provides next-gen firewall features including intrusion prevention, app control, and malware protection.

Source

Cisco Firepower Threat Defence (FTD)

Unifies firewall, VPN, and intrusion prevention into a single software for comprehensive threat defense.

Source

Cisco Firewall Services Module (FWSM)

Delivers multi-context, high-performance firewall services integrated into Cisco Catalyst switches.

Source

Cisco Internetwork Operating System

Network operating system for Cisco routers and switches, enabling routing, switching, and security.

Source

Cisco Identity Services Engine (ISE)

Manages network access control and enforces policies with user and device authentication capabilities.

Source

Cisco Meraki MX

Cloud-managed network appliance offering firewall, VPN, SD-WAN, and security in a single platform.

Source

Cisco Secure Firewall

Provides advanced threat protection and policy-based access control.

Source

Cisco Private Internet eXchange (PIX)

Legacy firewall appliance delivering stateful inspection and secure network access control.

Source

Cisco TelePresence Video Communication Server (VCS)

Enables video conferencing control and call routing for Cisco TelePresence systems and endpoints.

Source

Cisco Unified Communications Manager (UCM)

Delivers unified voice, video, messaging, and mobility services in enterprise IP telephony systems.

Source

Cisco HyperFlex (HX, UCSH)

Infrastructure solution combining compute, storage, and networking in a single system.

Source

Cisco Unified Computing System Manager (UCSM)

Centralized management platform for Cisco Unified Computing System (UCS) servers and resources.

Source

Cisco Viptela

Software-defined WAN solution providing secure connectivity, centralized control, and traffic optimization.

Source

Cisco IOS XR

High-performance, modular network operating system for carrier-grade routing and scalability.

Citrix

Source

Citrix NetScaler

Offers application delivery, load balancing, and security features for optimized app performance.

ClickHouse

Destination

ClickHouse

Coda

Source

Coda

All-in-one collaborative document platform combining text, spreadsheets, and integrations into a single workspace.

Confluent

Destination

Confluent

Corelight

Source

Corelight NDR Platform

Provides network detection and response by analyzing traffic for advanced threats and anomalous behavior.

CrowdStrike

Destination

CrowdStrike Falcon LogScale

Cloud-native platform for endpoint detection, threat hunting, and security analytics at scale.

CyberArk

Source

CyberArk Privileged Threat Analytics (PTA)

Analyzes privileged account behavior to detect threats and suspicious activity in real time.

Source

CyberArk Vault

Stores and manages privileged credentials, session recordings, and access control policies securely.

Databricks

Destination

Databricks

Unified analytics platform for data engineering, machine learning, and collaborative data science workflows.

Datadog

Destination

Datadog

Observability platform that provides monitoring for infrastructure, applications, logs, and security events.

DELL

Source

DELL SonicWall

Delivers firewall, VPN, and deep packet inspection to protect networks from cyber threats and intrusions.

Elastic

Destination

Elasticsearch

Distributed search and analytics engine for real-time log analysis, observability, and data indexing.

F5 Networks

Source

F5 Networks BIG-IP

Provides load balancing, traffic management, and application security for optimized service delivery.

Forcepoint

Source

Forcepoint Email Security

Protects email systems from spam, phishing, malware, and data exfiltration using advanced threat defense.

Source

Forcepoint NGFW

Next-gen firewall with deep packet inspection, policy enforcement, and integrated intrusion prevention.

Source

Forcepoint Web Security

Provides web traffic filtering, malware protection, and data loss prevention for secure internet access.

Fortinet

Source

Fortinet FortiGate

Enterprise firewall platform offering threat protection, VPN, and traffic filtering for secure networking.

Source

Fortinet FortiMail

Secures inbound and outbound email with spam filtering, malware protection, and advanced threat detection.

Source

Fortinet FortiWeb

Web application firewall protecting websites from attacks like XSS, SQL injection, and bot threats.

Fortra

Source

Fortra Powertech SIEM Agent for IBM i

Monitors IBM i system activity and forwards security events for centralized analysis in SIEM platforms.

Generic

Destination

Generic /dev/null

Blackhole destination for testing or discarding events without storing them.

Source

Generic Syslog (autodetect and classify)

Source, Destination

Generic Syslog

Standard protocol for system logs. Our source automatically detects, parses, and classifies incoming syslog events without pre-configuration.

Source

Generic Webhook

Receives data via HTTP POST requests for flexible event-driven integration.

Google

Source

Google Workspace Admin

Captures administrative events and configuration changes across the Google Workspace environment.

Source

Google Workspace Alert

Generates security and compliance alerts for suspicious user activity within Google Workspace services.

Destination

Google Pub/Sub

Asynchronous messaging service for ingesting and distributing event data between services and applications.

Grafana

Destination

Grafana Loki

Scalable log aggregation system optimized for storing and querying logs by labels using Grafana.

HAProxy

Source

HAProxy

High-performance TCP/HTTP load balancer and reverse proxy for increasing reliability and scalability.

Hewlett Packard Enterprise

Source

Hewlett Packard Enterprise Aruba Networks

Enterprise-grade networking gear for wireless, wired, and security management across distributed networks.

Imperva

Source

Imperva Incapsula

Cloud-based WAF, DDoS protection, and bot mitigation service for securing web applications and APIs.

Source

Imperva SecureSphere

Provides on-prem web application, database, and file security with granular activity monitoring.

Infoblox

Source

Infoblox NIOS

Delivers secure DNS, DHCP, and IPAM (DDI) services with centralized network control and automation.

Internet Systems Consortium

Source

Internet Systems Consortium DHCPd

Ivanti

Source

Ivanti Connect Secure

Provides dynamic IP address assignment and network configuration for DHCP-enabled devices.

Juniper Networks

Source

Juniper Networks Junos OS

Junos OS is the network operating system for Juniper physical and virtual networking and security products.

Kafka

Destination

Kafka Apache Kafka

Distributed event streaming platform used for building real-time data pipelines and stream processing.

Kaspersky

Source

Kaspersky Endpoint Security

Protects endpoints from malware, ransomware, and intrusions with antivirus, firewall, and threat detection.

Microsoft

Destination

Microsoft Azure Blob Storage

Cloud-based object storage optimized for unstructured data like backups, logs, and media files.

Source

Microsoft Azure Event Hubs

Big data streaming platform to ingest and process events.

Destination

Microsoft Azure Monitor

Collects and analyzes telemetry from applications and infrastructure to monitor performance and usage.

Source

Microsoft Cloud App Security (MCAS)

Monitors cloud app usage, detects anomalies, and enforces security policies across SaaS services.

Source

Microsoft GitHub

Provides audit and event data for code repositories, development workflows, and security scans.

Source

Microsoft Office 365

Generates user activity and audit logs from Exchange, SharePoint, Teams, and other Office 365 services.

Destination

Microsoft Sentinel

Cloud-native SIEM and SOAR platform for collecting, analyzing, and responding to security threats.

Source

Microsoft Windows

Event logs from core services like security, system, DNS, and DHCP for operational and forensic analysis.

Source

Microsoft Windows Events

Collects Windows Event Log data via WEC for centralized log analysis and monitoring.

MikroTik

Source

MikroTik RouterOS

Router operating system providing firewall, bandwidth management, routing, and hotspot functionality.

NetFlow Logic

Source

NetFlow Logic Optimizer

Aggregates and transforms flow data (NetFlow, IPFIX) into actionable security and performance insights.

Netgate

Source

Netgate pfSense

Open-source firewall and router platform with VPN, traffic shaping, and intrusion detection capabilities.

Netmotion

Source

Netmotion

Provides secure, optimized remote access with performance monitoring for mobile and distributed workforces.

NETSCOUT

Source

NETSCOUT Arbor Edge Defense (AED)

Edge-based DDoS protection and threat mitigation system to block attacks before they enter the network.

Source

NETSCOUT Pravail (APS)

Monitors and mitigates advanced persistent threats and malware with inline packet inspection.

Okta

Source

Okta Auth0

Identity-as-a-Service platform offering authentication and authorization for apps and APIs.

OpenObserve

Destination

OpenObserve

High-performance log analytics platform supporting structured log ingestion, search, and visualization.

OpenSearch

Destination

OpenSearch

Open-source search and analytics suite for log ingestion, indexing, dashboards, and alerting.

OpenTelemetry

Source

OpenTelemetry (OTLP)

Collects observability data like traces, metrics, and logs from applications using the OTLP protocol.

OpenText

Source

OpenText ArcSight

SIEM platform for collecting, correlating, and analyzing security event data across IT environments.

Source

OpenText Self Service Password Reset (SSPR)

Allows users to securely reset their own passwords without IT assistance, reducing helpdesk load.

Palo Alto Networks

Source

Palo Alto Networks Cortex XSOAR

Security orchestration, automation, and response platform for threat detection and incident management.

Source

Palo Alto Networks PAN-OS

Firewall operating system delivering network security features including traffic control and threat prevention.

Progress

Source

Progress Flowmon ADS

Detects network anomalies and threats through flow-based behavior analysis and machine learning.

Riverbed

Source

Riverbed SteelConnect

Software-defined WAN solution for centralized network management and secure cloud connectivity.

Source

Riverbed SteelHead

WAN optimization appliance that accelerates application performance and reduces bandwidth usage.

RSA

Source

RSA Authentication Manager

Manages two-factor authentication using RSA SecurID tokens for secure access to enterprise resources.

SecureAuth

Source

SecureAuth Identity Platform

Delivers identity and access management with adaptive authentication and single sign-on capabilities.

Skyhigh Security

Source

Skyhigh Security Secure Web Gateway

Inspects and filters web traffic to protect against malware, enforce policies, and prevent data loss.

Slack

Source

Slack

Collaboration platform that captures workspace messages, file uploads, and user activity for auditing.

Snowflake

Destination

Snowflake

Cloud data platform for storing, querying, and analyzing large-scale structured and semi-structured data.

Splunk

Destination

Splunk

Ingests, indexes, and visualizes data for monitoring, analysis, and alerting.

Source

Splunk (as source)

Receive data from Splunk.

Splunk Universal Forwarder

Agent that collects and forwards logs from remote systems to a central Splunk instance.

Sumo Logic

Destination

Sumo Logic

Cloud-native platform for log management, metrics analysis, and security analytics.

Superna

Source

Superna Eyeglass

Manages and automates data protection, DR, and reporting for PowerScale environments.

Thales

Source

Thales Vormetric Data Security Platform

Provides data encryption, key management, and access controls across cloud and on-premise environments.

Trellix

Source

Trellix Central Management System (CMS)

Centralized policy and configuration management platform for Trellix security products.

Source

Trellix ePolicy Orchestrator (EPO)

Manages endpoint security policies and threat responses across distributed environments.

Source

Trellix Email Threat Prevention (ETP)

Analyzes and filters email traffic to block phishing, malware, and targeted email-based threats.

Source

Trellix Endpoint Security (HX)

Detects and responds to advanced threats on endpoints using behavior-based analysis and threat intel.

Source

Trellix MPS

Appliance for detecting and blocking advanced threats through inline malware inspection.

Trend Micro

Source

Trend Micro Deep Security Agent

Provides anti-malware, intrusion prevention, and log inspection for cloud and on-prem servers.

Ubiquiti

Source

Ubiquiti Unifi

Manages network devices including routers, switches, and access points with centralized control.

Varonis

Source

Varonis DatAdvantage

Monitors data access and permissions to detect insider threats and automate compliance reporting.

Vectra AI

Source

Vectra AI X-Series

Detects and investigates cyberattacks across cloud, data center, and enterprise networks using AI.

VMware

Source

VMware ESXi

Bare-metal hypervisor that enables server virtualization and resource allocation for virtual machines.

Source

VMware vCenter

Centralized management platform for VMware vSphere environments and virtual infrastructure control.

Wiz

Source

Wiz

Cloud security platform offering visibility into misconfigurations, vulnerabilities, and compliance risks.

Zscaler

Source

Zscaler Internet Access

Cloud-based secure internet gateway that inspects traffic for threats and enforces policies.

Source

Zscaler ZScaler Private Access

Provides secure remote access to internal apps without exposing them to the public internet.