Integrations, labelled by what they do today

REST API with OpenAPI docs

Token-authenticated API with interactive docs. Everything the console does goes through it, so your own tools can too.

Note: Interactive documentation is served by the platform at /api/docs.

Agent ingest endpoint

Collectors and any sender post batches of events with an agent key. Rate limits are set per collector.

Webhook receiver

Secret-protected endpoints for anything that can send JSON over HTTP, including alerts from other security tools.

WebSocket live feed

Pushes new alerts and status changes to the console in real time.

Note: Interactive documentation is served by the platform at /api/docs.

Outbound alert webhook

Push created alerts to an endpoint you configure.

Elastic

Real-time streaming with Point-in-Time and search_after.

Note: No automated test in this repository. Needs an Elastic deployment.

Splunk

Search and notable events through the REST API.

Note: No automated test. Needs Splunk URL and token.

Wazuh

Alert retrieval; also available as a response provider.

Note: No automated test for ingestion. Needs a Wazuh deployment.

IBM QRadar

Offense and event retrieval, offense closing.

Note: Small connector; no automated test.

Microsoft Sentinel

Incident and alert retrieval. KQL queries not yet implemented.

Note: KQL queries are explicitly not yet implemented.

Windows event collector

PowerShell forwarder for Windows event logs.

Note: Not exercised by automated tests.

Linux agent

Agent for Linux telemetry.

Note: Not exercised by automated tests.

CrowdStrike and SentinelOne detections

Inbound detection retrieval is not implemented. CrowdStrike containment exists as an opt-in response provider.

Note: Host isolation and process tree in this module report "not yet implemented". CrowdStrike containment exists only as an opt-in response provider.

Firewall webhook

Generic response provider that calls a firewall automation endpoint you control.

Note: Tested with mocked transports. Not validated against live third-party systems in this review. Simulated actions must never be described as live remediation.

Palo Alto and Fortinet native connectors

The current module is a demo stub. Not offered as an integration.

Note: The module is a demo stub. Use the firewall webhook response provider instead.

Microsoft Defender, Entra ID, Okta

Opt-in live response providers. Simulate mode by default.

Note: Tested with mocked transports. Not validated against live third-party systems in this review. Simulated actions must never be described as live remediation.

CrowdStrike (containment)

Opt-in live response provider.

Note: Tested with mocked transports. Not validated against live third-party systems in this review. Simulated actions must never be described as live remediation.

VirusTotal, AbuseIPDB, Shodan, OTX

Indicator enrichment. Each needs your own API key.

Note: Each provider needs its own API key.

TheHive

Push and sync cases. First provider being validated.

Note: Tested against mocked HTTP. TheHive is the provider being validated first; the others are optional.

ServiceNow, Jira, GLPI, Zammad

Optional providers using the same sync layer.

Note: Tested against mocked HTTP. TheHive is the provider being validated first; the others are optional.

Email (SMTP)

HTML email through your own SMTP server, with notification policy and templates.

Note: Needs your SMTP details or Teams webhook URL.

Microsoft Teams

Adaptive cards to a Teams incoming webhook.

Note: Needs your SMTP details or Teams webhook URL.

LLM providers: Groq, Gemini, Mistral, OpenAI, Ollama

Five providers in a six-step fallback chain that ends in built-in rules. Local models keep data on your infrastructure.

Note: Needs the operator to supply provider keys or a local model. Fallback results are marked and never auto-close alerts.

MCP server and gateway

23 tools for external MCP clients and a 38-tool gateway in four risk tiers.

Note: Needs a token and a reachable ThirdEYE API. No automated test for this server in the repository.

Machine learning models

Isolation Forest anomaly model and semantic embeddings. See the note for what is wired in today.

Note: Scikit-learn is optional and the model is not yet connected to the live alert path in this release. Live anomaly scoring today uses the statistical baselines below.

CISA KEV and FIRST EPSS

Exploitation evidence for CVEs, added to the risk score with a visible explanation.

Note: Needs outbound internet access. A failed lookup is left blank, never guessed.

External attack surface (passive)

Passive recon with Shodan and HTTP-header checks.

Note: Needs a Shodan key for full results.

Prometheus and Grafana

Scrapeable metrics and a ready Grafana dashboard.

Note: Needs your Prometheus and Grafana.

PostgreSQL, with local fallback

PostgreSQL primary with automatic local fallback and sync-back.

Note: Mirror and recovery sync are covered by tests. The mirror runs on an interval, so the newest writes before a total primary loss may not be in the copy.

Neo4j attack graph

Optional graph backend for entity relationships.

Note: Needs a Neo4j instance. The platform runs without it.

Webhook receiver and event API

Anything that can send JSON over HTTP, with a secret-protected endpoint.

Outbound alert forwarding

Push created alerts to a webhook endpoint you configure.