Integrations
Connect once. Every product uses it.
The platform reads from the tools you already run and writes back to the ones your teams work in. No rip and replace.
Categories
What connects, and what it powers.
Each category lists the data that flows in or out and what the products and our analysts do with it. Named connectors and versions are confirmed during scoping.
Identity providers
Sign-ins, sessions, groups and admin changes
- Identity threat detection
- Access review evidence
- Owner mapping
Endpoint (EDR / XDR)
Process, file and network telemetry; isolation actions
- Incident correlation
- Host containment playbooks
Cloud providers
Configuration, audit logs, workloads and identities
- Cloud posture
- Exposure discovery
- Compliance evidence
SIEM and data lakes
Alerts and logs in; incidents and findings out
- Run beside your SIEM
- Forward enriched incidents
API gateways and ingress
Traffic metadata and policy enforcement
- API inventory
- Inline protection
Code and CI/CD
Repositories, pull requests and pipeline results
- IaC and API tests in pipelines
- Fix suggestions in pull requests
Ticketing and ITSM
Two-way ticket sync with status and owners
- Remediation routing
- SLA tracking
Chat and paging
Notifications and approvals
- Incident alerts
- Playbook approvals in chat
SaaS and data stores
Records, sharing settings and activity
- Personal data discovery
- SaaS threat detection
Open API
Not on the list? Build it.
Everything in the console is available through a REST API and webhooks, so you can push findings anywhere.
Example request, not the published schema
Map the platform to your stack.
Tell us what you run today and we'll show you what connects on day one.