Supported Vendors & Integrations

Pipelines, routes, sources, destinations, and the full Knowledge library for Cribl Stream, plus collectors and per-worker-group settings, as code.

Security Monitoring rules, Sensitive Data Scanner (DLP), log pipelines, monitors, SLOs, and RBAC roles via the Datadog API.

Detection rules and index lifecycle via the Kibana + Elasticsearch APIs.

Correlation (detection) rules as code for Exabeam New-Scale SIEM — the one full-CRUD config surface its public API exposes.

Chronicle detection rules, reference lists, data feeds, forwarders, and native dashboards via the SecOps REST API.

Streams, pipelines, index sets, lookup tables, and RBAC for the open-source Graylog stack, with BYOL infrastructure provisioning.

Reference sets, log sources, network hierarchy, tenants, offense closing reasons, and Ariel lookups via the QRadar REST API.

Full Sentinel workspace as code via Azure Resource Manager — analytics rules (scheduled, NRT, Fusion, anomaly/ML, Microsoft-security), automation rules & playbooks, watchlists, hunting queries, threat-intel indicators, workbooks, data connectors, product settings, and repository source controls.

Suricata rules, firewall & analyst access, SOC users, Elastic detections, and index lifecycle as code, with BYOL infrastructure for the full NSM stack.

Field extraction rules, partitions, monitors, dashboards, SAML config, and tokens via the Sumo Logic Management API.

CDB lists, custom rules/decoders, agent groups, and the full RBAC surface for the open-source Wazuh stack, with BYOL cluster provisioning.

Playbook and integration content via the XSOAR REST API.

Escalation policies, services, on-call schedules, event orchestrations, and webhook subscriptions via the PagerDuty REST API v2.

ACLs, roles, business rules, UI/data policies, and system properties over the ServiceNow Table API.

Instance connection profile, severities, container statuses/labels, roles, assets, and custom lists — governed as code, with playbooks intentionally out of scope.

Case templates, custom fields, observable types, users, organisations, and RBAC profiles for the open-source TheHive SOAR, with BYOL infrastructure.

Teams, folders, tags, global resources, credentials, and story settings via the Tines REST API — the story graph itself is intentionally excluded.

Network groups, policy module states & assignments, installation packages, integrations, user accounts, and notification/push-event settings via the GravityZone JSON-RPC API.

Reputation overrides, threat feeds, watchlists, endpoint policies, data forwarders, USB device control, and RBAC access grants via the CBC API.

Threat indicators (IOCs) and hash exceptions via the Cortex XDR public REST API — a deliberately thin, config-only surface.

Full Falcon platform as code — endpoint policies & exclusions, cloud security, Next-Gen SIEM, identity protection, file integrity monitoring, IT automation, firewall, RTR, recon, and platform administration across the Falcon APIs.

Custom reputations (allow/block lists), sensor groups, isolation rules, and sensor policies via the Cybereason REST API.

Endpoint threat response as code — file/network/certificate indicators (IoCs), custom detection rules, machine tags, and device business-criticality (deviceValue) across the Defender and Graph APIs.

Endpoint management as code via Microsoft Graph — ASR & endpoint-security policies, device compliance, Windows update rings & feature/quality profiles, app protection (MAM), proactive remediations & platform scripts, assignment filters, scope tags, and app-config policies.

Exclusions, blocklist/allowlist hashes, STAR custom detection rules, agent policy, and RBAC custom roles via the SentinelOne Management API (v2.1).

Endpoint policies, groups, scanning exclusions, allow/block lists, web control, exploit mitigation, and custom roles via the Sophos Central public APIs.

Suspicious Object Lists, exception lists, response-management scripts, and IAM users via the Trend Vision One REST API.

Custom VQL artifacts, event monitoring, client labels, and GUI users/roles/ACLs for the open-source Velociraptor DFIR platform, with BYOL infrastructure.

1Password Business user & group provisioning as code via the SCIM bridge (SCIM 2.0).

Auth methods, roles & rules, targets, dynamic/rotated secret configs, event forwarders, and K8s auth/gateway access via the Akeyless API — secret values excluded.

Applications, Connections, Roles, Actions, Log Streams, Attack Protection, MFA, and Branding across the Auth0 Management API v2.

Applications, Providers (OAuth2/SAML/Proxy/LDAP), Groups, Flows & Stages, and Policies for the open-source authentik IdP, with BYOL infrastructure.

Password Safe functional accounts via the BeyondInsight / Password Safe REST API.

Groups, Integrations, Administrators, Policies, and account-wide Settings via the Duo Admin API.

Safes, accounts, target platforms, PSM policy, onboarding rules, and directory mappings via the PVWA REST API.

Folders, secret policies, groups, users, and Distributed Engine sites via the Secret Server REST API — never touching secret material itself.

ACL/Sentinel policies, auth methods, secret engine mounts (PKI, Transit), audit devices, namespaces, and identity via the Vault HTTP API.

Directory groups, policies, conditional access, RADIUS servers, and organization settings across the JumpCloud API.

Clients, roles, groups, authentication flows, identity providers, and authorization objects for the open-source Keycloak IAM, with BYOL infrastructure.

Conditional Access, groups, and identity governance across 42 configuration types via Microsoft Graph — reference fields resolve to live groups, apps, users, roles, and service principals from your tenant through searchable pickers, instead of pasted names or GUIDs.

Policies, group rules, and app assignments via the Okta Management API.

Apps (SSO connectors), roles, account & per-app mapping rules, custom privileges, and brands via the OneLogin API.

Sign-on, password, and MFA-device policies, populations, groups, applications, resources, identity providers, and risk policies via the PingOne API.

Sources, identity governance (roles, access profiles, entitlements), SOD policies, and workflows via the SailPoint ISC API.

Roles, GitHub connectors, trusted clusters, Machine ID bots, dynamic database registrations, and discovery config for Teleport infrastructure access / PAM.

Network Lists, Edge DNS zones, Cloudlets policies, and EdgeWorker activations across the Akamai edge-security and delivery APIs.

Basic security, IP reputation, DDoS allow-list, header & traffic rules, rate control, response pages, and parameter/URL protection for Barracuda WAF-as-a-Service.

Internet & WAN firewall rules/sections, application control, TLS inspection, anti-malware file-hash rules, custom applications, and network ranges via the Cato SASE/SSE GraphQL API.

Network objects, service groups, application sites, tags, access-control rules, and NAT rules via the Check Point Management API.

Endpoint identity groups, network device groups, TrustSec SGTs/ACLs, and internal users via the ISE ERS API.

MX firewall rules, NAT, content filtering, site-to-site VPN, group policies, and appliance VLANs via the Meraki Dashboard API.

Access-control policies & rules, network/port/URL objects & groups, and security zones via the Firewall Management Center REST API.

Destination lists, policy identity assignments, networks, sites, and network tunnels via the Umbrella API.

DNS, the WAF/firewall Rulesets engine, Bot Management, Turnstile, zone settings, and Zero Trust Access via the Cloudflare API (v4).

Intel-feed watched domains/IPs/hostnames and named tags — the cleanly writable surfaces of a Darktrace NDR deployment.

HTTP/TCP load balancers, app firewalls (WAF), service & network policies, origin pools, health checks, and malicious-user mitigation via the F5 XC API.

Firewall address objects, IP pools, virtual IPs, security profiles, and user authentication via the FortiManager JSON-RPC API.

Labels, IP Lists, Services, and label-scoped Rulesets for Illumio Core microsegmentation, provisioned via the PCE REST API v2.

Site security/ACL rules, delivery rules, data centers, and origin servers via the Imperva Cloud WAF management API.

URL Lists, RBAC labels, NPA publishers/private apps and policy groups, DNS/destination profiles, tunnels, and AI Gateway config via the Netskope REST API v2.

Firewall aliases/rules, outbound and 1:1 NAT, DNS Resolver overrides, traffic shaping, and static routes via the OPNsense REST API.

Tags, address/service objects, application groups, security and NAT pre-rules, and security profiles (antivirus, anti-spyware, URL filtering, WildFire) via the PAN-OS REST API.

Firewall aliases and rules, NAT, schedules, gateways, static routes, and DNS Resolver overrides via the pfSense REST API package.

Protected domains, Safe/Blocked sender lists, DLP & encryption features, and SSO policy via the Essentials Interface API.

Resources, Remote Networks, Groups, and Service Accounts for ZTNA via the Twingate GraphQL API.

Triage rules, groups, proxies, Vectra Match sensor/ruleset assignment, and host/account tags via the Vectra Detect REST API.

ZIA + ZPA policy configuration via the Zscaler OneAPI.

Saved queries, enforcement sets, roles, data scopes, and lifecycle settings for Axonius CAASM via its REST API.

Per-repo and org code-security configurations, branch/push protection rulesets, and Dependabot settings via the GitHub REST API.

Scan targets for Greenbone/OpenVAS vulnerability scanning over the Greenbone Management Protocol, with BYOL infrastructure provisioning.

Program structured scopes, policy text, and organization asset inventory via the HackerOne API.

Security/license/operational-risk policies, watches, ignore rules, and Curation policies via the Xray REST API.

Managed URLs, Blocked Sender and Anti-Spoofing Bypass policies, Address Alteration, and Web Security block/allow lists via the Mimecast API 2.0.

VMDR / Policy Compliance — asset groups and scan config via the v2 API.

Scan sites and asset groups via the InsightVM Security Console API (v3).

SLA Domains, Fileset Templates, Managed Volumes, Organizations, and Syslog Configuration via the Rubrik CDM REST API.

Sites, scan tasks/templates, organizations, users, and SSO group mappings via the runZero console REST API.

Project settings, Managed Scans toggles, findings triage, and Detection/Remediation policies via the Semgrep REST API.

Snyk Code (SAST)/Secrets/IaC enablement, SCM integration settings, project attributes, org membership, and webhooks across the Snyk REST and v1 APIs.

Quality gates, quality profiles, webhooks, permission templates, and ALM settings for the open-source SonarQube stack, with BYOL infrastructure.

tenable.io scan and policy configuration via the Tenable VM REST API.

Image/host/function/Kubernetes assurance, container & host runtime, firewall policies, application scopes, and enforcer groups via the Aqua CSP/Enterprise Console API.

Custom alerts, business units, automations, discovery views, and trusted cloud accounts via the Orca REST API.

Custom Compliance Standards, Account Groups, Custom Policies, Alert Rules, and Enterprise Settings via the Prisma Cloud REST API.

Custom Falco rules, notification channels, CSPM posture controls, and vulnerability-management rule bundles via the Sysdig Secure REST API.

CNAPP cloud-security config (service accounts, policies) via the Wiz GraphQL API.

Patch policies, Worklets (custom scripts/required software), and Server Groups via the Automox Console API.

Saved osquery queries for endpoint visibility across your fleet, via the Fleet REST API, with BYOL infrastructure groundwork.

Scripts, computer groups, policies, and macOS configuration profiles via the Jamf Pro and Classic APIs.

Blueprints, tags, custom scripts, and custom profiles for Kandji Apple MDM.

Computer groups, saved questions, packages, and sensors via the Tanium REST v2 API.

Threat feeds for the open-source MISP platform via its REST API, with BYOL infrastructure provisioning.

Data-marking definitions, labels, RBAC groups, case templates, and TAXII ingestion feeds for the open-source OpenCTI platform, with BYOL infrastructure.

Entity watch lists, entity tags, and Fusion file system feeds via the Recorded Future API.