Integrations

Identity provider audit logs, SSO session revocation, and credential access governance.

• 

  Okta

  Ingest Okta System Logs into OCSF 3001 and enable human-approved session revocation and user suspension.

• 

  Microsoft Entra ID

  Ingest sign-in events and directory audit logs via Microsoft Graph and enable human-approved account disable and session revocation.

• 

  Auth0

  Ingest Auth0 tenant logs (logins, failures, admin changes) via the Management API and enable human-approved user blocking and session revocation.

• 

  PingOne

  Ingest PingOne audit activities (sign-ons, MFA, admin changes) and enable human-approved user disable and session revocation.

• 

  1Password

  Events Reporting API ingestion of user sign-in attempts, shared vault item usages, and security audit events into OCSF Class 3001.

Endpoint detection and response (EDR) agents and MDM fleet management containment.

• 

  CrowdStrike Falcon

  Ingest detection alerts into OCSF 4006 and execute automated endpoint network containment.

• 

  SentinelOne

  Stream threat detections with cursor pagination and isolate compromised endpoints in real-time.

• 

  Jamf Pro

  macOS & iOS endpoint inventory synchronization, device compliance telemetry, and automated remote device lock actions.

Multi-cloud audit trails, threat findings and CSPM posture findings.

• 

  AWS CloudTrailCloud ingestion

  Ingest CloudTrail events across AWS accounts for automated threat detection and investigation.

• 

  AWS GuardDuty

  Ingest intelligent threat findings across AWS accounts via STS cross-account IAM role assumption.

• 

  GCP Log Ingestion (OmniMesh)Cloud ingestion

  Stream Google Cloud Audit Logs and VPC Flow Logs into OmniMesh using Cloud Pub/Sub or Cloud Logging API.

• 

  Google Security Command Center (SCC)

  Ingest real-time security findings, misconfiguration alerts, and posture violations into OCSF Class 4006 via Cloud SCC API.

• 

  Microsoft AzureCloud ingestion

  Ingest security events from Azure Activity Log and Microsoft Defender for Cloud.

• 

  Wiz

  Synchronize critical cloud security vulnerabilities, misconfigurations, and compliance findings via GraphQL.

Perimeter WAF, firewall threat feeds, proxy inspection, and dynamic edge IP blocking.

• 

  Cloudflare

  Ingest WAF and firewall security events into OCSF 4001/4006 and block IPs and domains at the edge.

• 

  Palo Alto Networks

  Panorama threat & traffic log ingestion via XML API into OCSF 4006 and automated Dynamic Address Group (DAG) quarantine containment.

• 

  Zscaler ZIA

  Zscaler Internet Access (ZIA) proxy and cloud sandbox alert ingestion into OCSF 4006 with automated URL blocklist containment.

IP reputation intelligence, vulnerability workbenches, scanner noise filtering, and appsec.

• 

  VirusTotal

  Enrich IOCs, suspicious domains, and file hashes with two-tier global threat intelligence analysis.

• 

  AbuseIPDB

  Query IP confidence of abuse scores, report malicious attack vectors, and enforce automated threshold-based blacklists.

• 

  Shodan

  Host profiling, open port scanning, service banner analysis, and detected CVE vulnerability enumeration.

• 

  GreyNoise

  Differentiate between benign internet background noise (RIOT) and targeted malicious actor activity.

• 

  Tenable.io

  Continuous vulnerability management, host CVE assessment, and workbench export telemetry normalized to OCSF 4006.

• 

  Snyk

  Ingest open source dependency vulnerabilities, container security findings, and license risk telemetry via Snyk REST API v3.

Incident response workflow synchronization, ChatOps collaboration, and automated SOAR ticket escalation.

• 

  ServiceNow ITSM

  Bi-directional incident synchronization and SOC SOAR case management ticket routing.

• 

  Slack

  Dispatch interactive Block Kit alert cards with human-in-the-loop remediation buttons and daily executive threat briefings.

• 

  Microsoft Teams

  Post rich Adaptive Cards with interactive approval and dismissal actions directly into Microsoft Teams security channels.

• 

  Atlassian Jira / JSM

  Bi-directional incident tracking, ticket creation with ADF descriptions, and workflow status transitions.

• 

  PagerDuty

  High-urgency on-call escalation, incident triggering with deduplication keys, and automated incident resolution upon containment via Events API v2.

• 

  GitHub Advanced Security

  Ingest Secret Scanning and Dependabot alerts into OCSF 4006 and execute emergency leaked credential revocation.

• 

  Google Workspace & OAuth 2.0

  Automate phishing quarantine in Gmail, generate incident reports in Google Docs/Sheets, and audit third-party OAuth app permissions.

Enterprise SIEM incident synchronization, notable events, log search pipelines, and security analytics.

• 

  Microsoft Sentinel

  Bi-directional incident synchronization, threat analytics, and automated response triage via Azure Security Insights REST API.

• 

  Splunk

  Stream notable events, trigger correlation searches, and dispatch ad-hoc SPL hunting queries via Splunk REST API port 8089.

• 

  Elasticsearch

  Ingest Elastic Security detection engine signals and query security indices using native JSON Query DSL.

• 

  Google SecOps (Chronicle)

  Ingest YARA-L rule detections, retrohunt results, and search UDM entities via Google SecOps Detection API.

• 

  Datadog Cloud SIEM

  Continuous ingestion and status triage for Datadog Cloud SIEM security monitoring signals and threat detections.