Connect the tools that already run your environment.

Microsoft Entra ID

Directory, sign-in, MFA, Conditional Access, and identity-risk evidence

Microsoft Intune

Managed-device inventory, compliance, configuration, and remediation state

Google Workspace

Workspace directory, authentication, MFA, admin, and application-access evidence

Okta

SSO, MFA, lifecycle, application-assignment, and sign-in evidence

Cisco Duo

MFA enrollment, authentication, device-trust, and access-policy evidence

JumpCloud

Directory, device, authentication, policy, and access-control context

PingOne

Cloud identity, authentication, MFA, and access-policy evidence

PingFederate

Federated authentication, SSO, token, and policy-decision context

OneLogin

Workforce SSO, MFA, directory, and application-access evidence

Auth0

Customer identity, authentication, MFA, application, and login-event evidence

Imprivata

Healthcare workforce identity, clinical access, authentication, and session context

CyberArk

Privileged account, vault, session, credential, and access-control evidence

BeyondTrust

Privileged access, endpoint privilege, session, and credential-management evidence

SailPoint

Identity governance, entitlement, certification, and lifecycle evidence

Saviynt

Identity governance, entitlement risk, access review, and lifecycle context

CrowdStrike Falcon

Endpoint detections, host telemetry, containment, and response evidence

Cynet 360 AutoXDR

Endpoint/XDR detections, automated containment, remediation, and host context

Microsoft Defender for Endpoint

Endpoint alerts, incidents, device posture, investigation, and response evidence

SentinelOne

Endpoint behavioral detections, storyline context, isolation, and remediation evidence

Sophos Intercept X / XDR

Endpoint detections, XDR investigations, isolation, and response state

VMware Carbon Black Cloud

Endpoint sensor telemetry, process behavior, detections, and response actions

BlackBerry Cylance / CylanceOPTICS

Endpoint prevention, behavioral detection, threat, and response evidence

Broadcom Symantec Endpoint Security

Endpoint protection detections, policy, device, and response context

Check Point Harmony Endpoint

Endpoint prevention, detection, forensics, and remediation evidence

Cisco Secure Endpoint (AMP)

Endpoint telemetry, threat detections, device trajectory, and response context

Cybereason Defense Platform

Endpoint behavioral detections, incident context, and response evidence

Fortinet FortiEDR

Endpoint detection, automated response, device, and forensic evidence

Palo Alto Cortex XDR

Endpoint and XDR analytics, incidents, causality, and response state

Trellix Endpoint Security

Endpoint protection events, detections, policy, and response context

Trend Micro Vision One

Endpoint/XDR telemetry, workbench alerts, threat context, and response evidence

Bitdefender GravityZone EDR/XDR

Endpoint prevention, EDR incidents, risk analytics, and response state

Elastic Security Endpoint

Endpoint telemetry, behavior alerts, investigation, and response evidence

Huntress Managed EDR

Managed endpoint detections, persistent-footprint findings, and remediation context

Malwarebytes Endpoint Detection and Response

Endpoint detections, isolation, remediation, and threat evidence

WithSecure Elements EDR

Endpoint detections, risk events, device posture, and response context

A10 Networks

Network and application-delivery telemetry, security events, and policy context

AWS Network Firewall

Cloud firewall policy, flow, alert, and rule-evaluation evidence

Microsoft Azure Firewall

Cloud firewall policy, threat-intelligence, flow, and rule evidence

Barracuda CloudGen Firewall

Firewall traffic, security events, VPN, and policy state

Cato SASE / Firewall

SASE traffic, threat, access, and network-policy evidence

Check Point Quantum

Firewall, IPS, threat prevention, policy, and network-event evidence

Cisco Secure Firewall (FTD/ASA)

Firewall, intrusion, connection, policy, and remote-access evidence

Cloudflare Network Firewall

Edge network policy, traffic, threat, and filtering evidence

Forcepoint NGFW

Firewall, SD-WAN, IPS, policy, and connection context

Fortinet FortiGate

Firewall, IPS, VPN, traffic, and security-policy evidence

Google Cloud NGFW

Cloud firewall rule, hierarchical-policy, flow, and network evidence

Juniper SRX

Firewall, security-policy, threat, VPN, and session evidence

Cisco Meraki MX

Branch firewall, security-appliance, VPN, client, and network-health evidence

MikroTik RouterOS

Router/firewall rule, interface, connection, and network-event context

OPNsense

Open firewall, IDS/IPS, VPN, rule, and network-event evidence

Palo Alto Networks PAN-OS / Strata

NGFW traffic, threat, URL, policy, and session evidence

Sangfor NGAF

NGAF firewall, threat-detection, policy, and traffic context

SonicWall

Firewall, threat prevention, VPN, policy, and connection evidence

Sophos Firewall

Firewall, IPS, application, web, VPN, and policy evidence

WatchGuard Firebox

Firebox traffic, threat, VPN, policy, and security-service evidence

NordLayer

Private-access, gateway, device, and network-activity evidence

pfSense / Netgate

Firewall rule, interface, VPN, package, and network-event evidence

Zscaler Internet Access

Internet-access policy, web transaction, threat, and user-activity evidence

Microsoft Sentinel

Cloud SIEM alerts, incidents, analytics-rule, investigation, and evidence context

Splunk Enterprise

Searchable security events, correlation output, investigation, and timeline evidence

Elastic Security

Security events, detection rules, cases, timelines, and analytics context

IBM QRadar

Offenses, events, flows, correlation, and investigation evidence

FortiSIEM

Security events, incidents, CMDB context, and correlation evidence

Google Security Operations

Normalized security telemetry, detections, entity context, and investigations

LogRhythm SIEM

Security events, alarms, case, and correlation evidence

OpenText ArcSight ESM

Security events, correlation events, cases, and investigation context

Securonix

Behavior analytics, threat detections, incidents, and entity-risk context

Exabeam

Behavior analytics, timelines, cases, and threat-detection evidence

Sumo Logic

Cloud security logs, signals, insights, and investigation context

AlienVault USM

Security events, alarms, asset context, and threat-intelligence evidence

Backblaze Computer Backup

Endpoint backup coverage, last-backup freshness, and restore readiness

Acronis Cyber Protect Cloud

Backup job, protection-plan, endpoint, recovery, and cyber-protection evidence

Afi Backup

Microsoft 365 and Google Workspace backup scope, snapshot, job, and restore context

AvePoint Cloud Backup

Cloud-workload backup, retention, restore, and protection-state evidence

AWS Backup

AWS backup plan, vault, recovery-point, job, and compliance evidence

Microsoft Azure Backup

Azure protected-item, vault, job, recovery-point, and restore evidence

Barracuda Intronis Backup

Managed backup job, device, retention, and recovery evidence

Cohesity DataProtect

Data-protection policy, backup job, snapshot, recovery, and resiliency evidence

Commvault Cloud

Backup workload, job, policy, recovery, and cyber-resilience evidence

Datto BCDR

Appliance backup, snapshot, replication, recovery, and continuity evidence

Dell PowerProtect Data Manager

Enterprise backup asset, policy, job, retention, and recovery context

Druva Data Resiliency Cloud

Cloud backup workload, snapshot, restore, ransomware, and resiliency evidence

Google Cloud Backup and DR

Google Cloud backup plan, appliance, job, recovery-point, and restore context

Microsoft 365 Backup Storage

Microsoft 365 protection scope, backup status, recovery point, and restore context

N-able Cove Data Protection

Managed-device backup, job status, retention, and recovery evidence

NAKIVO Backup & Replication

VM and workload backup, replication, job, recovery, and immutability context

NinjaOne SaaS Backup

SaaS backup scope, job status, retention, and restore evidence

Rubrik Security Cloud

Data-protection SLA, snapshot, backup, recovery, and ransomware-resilience evidence

Unitrends Backup

Backup appliance, job, recovery, replication, and continuity evidence

Veeam Backup & Replication

Backup job, repository, restore point, immutability, and recovery evidence

Veritas NetBackup

Enterprise backup policy, job, media, retention, and recovery evidence

Splunk SOAR

Playbook execution, action result, case, and orchestration evidence

Cortex XSOAR

Playbook, incident, integration command, and response-outcome evidence

IBM Security QRadar SOAR

Case workflow, playbook, task, and response-action evidence

FortiSOAR

Playbook execution, incident workflow, connector action, and result evidence

Microsoft Sentinel Playbooks

Logic Apps playbook invocation, action result, incident, and automation evidence

Tines

Story execution, action, event, and governed-automation result

Swimlane Turbine

Low-code automation workflow, case, task, and action-result evidence

Torq

Security workflow execution, step output, case, and response evidence

Proofpoint Email Protection

Message threat verdicts, campaign, URL/attachment, user, and disposition evidence

Mimecast Email Security

Email threat detections, message tracking, policy, and remediation context

Microsoft Defender for Office 365

Email incidents, Safe Links/Attachments detections, message, and remediation evidence

Abnormal AI

Behavioral email attacks, account-takeover signals, cases, and remediation evidence

Cisco Secure Email Threat Defense

Message threat verdicts, sender/reputation, campaign, and disposition evidence

Check Point Email Security

Email phishing/malware detections, message, policy, and response evidence

Cloudflare Email Security

Email threat detections, impersonation, link, sender, and disposition context

Shodan

External exposure, passive reconnaissance, and internet-facing CAAT context

Tenable.io

Cloud-managed vulnerability findings, assets, severity, and remediation-state evidence

Tenable Nessus

Scanner findings, plugin output, asset context, and file-based vulnerability evidence

Qualys VMDR

Asset inventory, vulnerability detections, prioritization, and remediation evidence

Rapid7 InsightVM

Asset vulnerability findings, risk scores, remediation projects, and validation context

Microsoft Defender for Cloud

Cloud posture, recommendations, attack-path, asset, and exposure evidence

AWS Inspector

AWS workload vulnerability findings, package exposure, severity, and resource context

Google Cloud Security Command Center

Google Cloud findings, misconfiguration, vulnerability, and asset-posture context

CrowdStrike Falcon Spotlight

Endpoint vulnerability inventory, affected hosts, CVE context, and remediation state

Microsoft Defender Vulnerability Management

Endpoint vulnerability findings, software inventory, exposure score, and remediation context

Microsoft Intune remediation

Managed-device remediation assignment, execution, compliance, and result context

NinjaOne RMM

Managed-device inventory, patch state, remote-management, and remediation evidence

PDQ Detect / CODA Footprint

Asset discovery, software inventory, exposure, and attack-surface context

Nmap

Host, port, service, and network-discovery evidence

Nuclei

Template-driven vulnerability findings, target, severity, and scanner evidence

Nikto

Web-server findings, exposed files/configurations, and scan evidence

OpenVAS

Network vulnerability findings, host/service context, severity, and scan evidence

Trivy

Container, filesystem, IaC, SBOM, and SARIF vulnerability evidence

CISA Known Exploited Vulnerabilities

Cataloged known-exploited CVEs for exploitation-priority enrichment

GreyNoise

Internet scanner/noise classification, IP context, and observed exploitation activity

NVD

CVE metadata, CVSS, CWE, references, and vulnerability enrichment

MITRE ATT&CK / STIX

ATT&CK techniques, tactics, software, groups, and STIX relationship context

HHS Health Sector Cybersecurity Coordination Center

HHS healthcare cyber threat briefs, alerts, sector tactics, and adversary context

Health-ISAC

Healthcare community threat intelligence, indicators, alerts, and sector context

OSV

Open-source package vulnerability records, affected versions, and ecosystem enrichment

Claroty xDome

Passive medical-device discovery, identity, clinical context, vulnerability, and exposure evidence

ORDR

Passive connected-device inventory, behavior, communication, vulnerability, and risk context

Applied Epic

Broker account, policy, client, renewal, activity, and book-of-business context

Vertafore AMS360

Agency client, policy, renewal, activity, and account-management context

Vertafore Sagitta

Enterprise agency account, policy, renewal, and book-of-business context

SARIF

Portable analysis findings with rule, location, severity, and tool provenance

CycloneDX SBOM

Software component, dependency, license, vulnerability, and supply-chain evidence

SPDX SBOM

Software package, component, license, relationship, and provenance evidence

Tenable Nessus XML

Portable Nessus scan findings, plugin output, host, port, and severity evidence

Guidewire

Validated cyber evidence for carrier policy, underwriting, claims, and account workflows

Duck Creek

Validated cyber evidence for carrier policy-administration, underwriting, and claims workflows

ServiceNow GRC

Control, risk, issue, evidence, and compliance records for GRC workflows

RSA Archer

Risk, control, finding, assessment, and evidence records for IRM workflows

OneTrust

Risk, control, assessment, compliance, and evidence data for governance workflows

MetricStream

Enterprise risk, control, issue, audit, and compliance evidence

LogicGate

Risk Cloud controls, assessments, issues, and evidence for governance workflows

Hyperproof

Control, requirement, evidence, task, and assurance records for compliance workflows

Optro (formerly AuditBoard)

Audit, risk, control, issue, and evidence data for connected-assurance workflows

IBM OpenPages

Governance, risk, compliance, issue, and control evidence for OpenPages workflows

Workiva

Governance, reporting, audit, risk, and evidence packages for connected-reporting workflows

Diligent HighBond

Audit, risk, control, issue, and assurance evidence for HighBond workflows

Vanta

Control monitoring, test, evidence, compliance, and assurance data for trust workflows

Drata

Control monitoring, evidence, test, compliance, and assurance data for GRC workflows

AM Best

Structured cyber-risk evidence package for insurer financial-strength and rating workflows

S&P Global

Governed cyber-risk evidence package for S&P analytics and ratings workflows

Moody's

Governed cyber-risk evidence package for Moody's analytics, credit, and ratings workflows

Fitch

Governed cyber-risk evidence package for Fitch credit, insurer, and ratings workflows