Integrations
Ten certified connectors, and an API for the rest
Certified connectors run on governed credentials with versioned actions. This page lists exactly which ones, and what each does. Every connector is called from your installation, so it needs a network path to that product.
Certified
Certified connectors
Configured once per organization, with credentials stored encrypted on your installation and actions your workflows can call.
Splunk
SIEMSplunk
HEC ingestion, search enrichment, and notable-event updates.
Certified connector
CrowdStrike Falcon
EDRCrowdStrike
Detections, host lookup, and containment actions.
Certified connector
Microsoft Defender XDR
EDRMicrosoft
Incidents, alerts, evidence, and machine response actions.
Certified connector
Microsoft Sentinel
SIEMMicrosoft
Incidents, entities, comments, and ownership and status actions.
Certified connector
AWS GuardDuty
CloudAmazon
Multi-account findings ingestion with archive, unarchive, and enrichment.
Certified connector
ServiceNow
ITSMServiceNow
Incidents, tasks, and changes, with field mapping in both directions.
Certified connector
Jira
ITSMAtlassian
Issues, comments, transitions, dynamic fields, and linking in both directions.
Certified connector
Slack
CommunicationSlack
Messages, channel management, interactive approvals, and scoped bot permissions.
Certified connector
Palo Alto Networks
Network securityPalo Alto Networks
Panorama and Strata alert context, plus IP and domain response actions.
Certified connector
MISP
Threat intelligenceMISP Project
Event and attribute ingestion, IOC search, publishing, and TLP-aware sharing.
Certified connector
Enrichment
Enrichment providers
Run observables through the services you already pay for or operate. Cortex and IntelOwl can run on your own network; hosted services such as VirusTotal need outbound access.
Cortex
EnrichmentStrangeBee
Runs your Cortex analyzers against IP, domain, URL, and hash observables.
Enrichment provider
IntelOwl
EnrichmentIntelOwl Project
Sends IP, domain, URL, and hash observables to an IntelOwl instance you operate.
Enrichment provider
VirusTotal
EnrichmentGoogle
Reputation for IP, domain, URL, and hash observables.
Enrichment provider
Recorded Future
EnrichmentRecorded Future
Risk context for IP, domain, URL, and hash observables from your subscription.
Enrichment provider
Intezer
EnrichmentIntezer
Hash analysis from your Intezer account.
Enrichment provider
Everything else
The API and webhooks
For tools that are not on this page, send alerts and update cases through the REST API, and react to CaseBender events with webhooks.
REST API and webhooks
ExtensionCaseBender
Create and update alerts, cases, and observables from tools that are not on this list.
Extension point
The in-app integration catalog lists more names than this page. A name in that catalog is not a certified connector, and classic connectors do not use governed credentials.
API referenceQuestions
Integration questions
What does certified mean here?
The connector is maintained in the product, uses governed credentials, and exposes versioned actions that workflows can call.
Does every integration sync both ways?
No. Each card says what that connector does. Some, like Jira and ServiceNow, map fields in both directions; others ingest or act only.
Do connectors work on an air-gapped install?
Only when the installation can reach that product. A connector to a system on your own network, such as an internal Splunk or MISP, can work in isolation. A connector or enrichment service on the public internet needs a path to it.
Our tool is not listed. What now?
Use the REST API and webhooks, or tell us which tool it is when you request a demo.
Check it against your stack
Bring your list of tools to a demo and we will say plainly which ones connect today.