The tools you already run, in one dashboard.
Managed SOC + SIEM connects to more than 100 security, cloud, identity and SaaS tools through their own APIs, plus syslog from any network device and agents on your servers and workstations. The list below is a sample of what connects today; new integrations are added regularly, so if you do not see a tool, ask.
Three ways data gets in.
API Integrations
We connect to the tool's own API with read-only credentials you provide. Nothing is installed on your side. Covers cloud platforms, identity providers, email security, endpoint security and SaaS tools.
Syslog
Any firewall, switch, VPN, appliance or server that can send syslog points at your SIEM. Built-in parsers cover the major network and security vendors, with custom parsing available.
Endpoint Agents
Lightweight agents on Windows and Linux servers and workstations send security logs, file changes and process activity, and give our analysts a way to respond on the machine once an action is approved.
What connects, by category
Examples of integrations available today. New ones are added regularly; ask us about any tool not shown here.
116 integrations across 10 categories
Identity and Access
17Sign-ins, privilege changes and password vault activity.
- Microsoft Entra ID
- Okta
- Duo
Endpoint Security
21Alerts and telemetry from the endpoint tools you already pay for, correlated with everything else.
- CrowdStrike Falcon
- SentinelOne
- Microsoft Defender
Email Security
11Phishing, impersonation and message-trace data.
- Proofpoint
- Proofpoint Essentials
- Mimecast
Cloud Platforms
11Audit logs, security findings and network flow from your cloud accounts.
- AWS CloudTrail
- Amazon GuardDuty
- AWS Security Hub
Network and Web Security
23Firewalls, web application firewalls, zero trust and network detection.
- Palo Alto Prisma Access
- Cisco Meraki
- Cisco Umbrella
SaaS and Productivity
07User activity and admin changes in the apps your business runs on.
- Microsoft 365
- Google Workspace
- Salesforce
Vulnerability Management
06Findings from your scanners, ranked by real-world exploitation.
- Clone Systems scanning
- Qualys VMDR
- Rapid7 InsightVM
DevOps and Code
04Audit trails from your source and project tools.
- GitHub
- GitLab
- Atlassian audit log
Network Devices via Syslog
16Built-in parsing for the major vendors; any syslog source is accepted.
- Palo Alto
- Fortinet
- Cisco ASA
Anything Else
A generic webhook receiver accepts data from tools without a dedicated integration, and custom sources can be onboarded during setup.
Not seeing your tool?
This page is a sample, not the full catalog, and new integrations are added regularly. Tell us what you run during the scoping call and we will confirm what connects and how.
More on Managed SOC + SIEM.
See your tools in one dashboard.
Walk through your environment with a specialist and get a scoped plan to connect what you already run.
- 100+ integrations and growing
- Syslog from any network device
- Agents on Windows and Linux