Expel has out-of-the-box integrations with many cloud, endpoint, SaaS, network, and SIEM technologies. This article lists direct and indirect integrations currently in progress, as well as completed integrations. Those not listed as direct require either sending logs to one of our supported SIEMs or network technologies. We also include a list of technologies we can use for hunting.
Note on Limited Availability: New integrations go through a period of Limited Availability before being made generally available.
In progress |
||
|---|---|---|
| Vendor technology | Version/product type | Target date |
| Cyberark Identity (fka Centrify) | SaaS apps | February 2022 |
| Ping Identity via Sumo Logic | SaaS apps | February 2022 |
Cloud Infrastructure |
|
|---|---|
| Vendor technology | Security signal |
| Amazon Web Services (AWS) |
|
| Microsoft Azure |
|
| Google Cloud Platform |
|
| Lacework (Limited availability) |
 AWS Workload Events |
| Prisma Cloud Compute |
Audit Events |
Endpoint |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | Via SIEM |
|
Check Point - AV, Anti-Bot, SandBlast Agent and IPS (Limited availability) |
— |
Sumo Logic |
|
Cisco AMP |
|
— |
|
CrowdStrike Falcon |
|
— |
|
CyberArk (Limited availability) |
— | Splunk |
|
Cybereason (Limited availability) |
|
— |
|
CylancePROTECT AV |
|
— |
|
Endgame |
|
— |
|
FireEye HX |
|
— |
|
Microsoft Defender for Endpoint |
|
— |
|
Palo Alto Networks Cortex XDR Pro |
|
— |
|
SentinelOne |
|
— |
|
Symantec Endpoint Protection |
— |
Exabeam Data Lake Splunk Sumo Logic |
|
Tanium Core |
|
— |
| VMware Carbon Black EDR | |
— |
| VMware Carbon Black Cloud | |
— |
|
Wazuh (Limited availability) |
|
— |
Network |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | Via SIEM |
|
Active Directory |
— |
Splunk Sumo Logic |
|
Attivo BOTSink |
— |
Splunk Sumo Logic |
|
Cisco ASA (Limited availability) |
— |
Splunk Sumo Logic |
|
Cisco FirePower |
— |
Splunk Sumo Logic |
|
Cisco Meraki |
— |
Splunk Sumo Logic |
|
Cisco Umbrella |
|
— |
|
DarkTrace |
|
— |
|
Forcepoint Web Filter |
— |
Exabeam |
|
Fortinet FortiGate |
— |
|
|
Guardicore (Limited availability) |
|
— |
|
iBoss (Limited availability) |
— |
Splunk |
|
McAfee IDS (Limited availability) |
— |
Exabeam Data Lake |
|
Netskope SWG |
|
— |
|
Palo Alto Firewall |
|
— |
|
Palo Alto Networks Prisma Access |
|
— |
|
ProtectWise |
|
— |
|
Signal Sciences WAF |
|
— |
|
Zscaler1 |
— |
|
1 Requires the Nanolog Streaming Service (NSS), a virtual machine that must be hosted by the customer. Zscaler requires customers to use NSS to transport data from the customer’s Zscaler instance to a SIEM.
SIEM |
Type of support |
|
|---|---|---|
| Vendor Technology | Investigative source* | Detection source** |
|
Azure Log Analytics |
|
— |
|
Datadog (Limited availability) |
|
|
|
DEVO |
|
— |
|
Elastic (Limited availability) |
|
|
|
Exabeam Fusion XDR |
|
|
|
Exabeam Fusion SIEM |
|
— |
|
IBM QRadar |
|
|
|
IBM QRadar on Cloud (QRoC) |
|
|
|
Microsoft Azure Sentinel |
|
|
|
Securonix (Limited availability) |
|
|
|
Sumo Logic Cloud SIEM Enterprise |
|
|
|
Sumo Logic Enterprise |
|
— |
|
Splunk Core |
|
— |
|
Splunk Enterprise Security |
|
|
|
Wazuh |
|
|
* Expel can query this SIEM to get more information to support the investigations of alerts coming from other sources.
** This SIEM generates alerts that Expel can use to add detection value.
UEBA |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | Via SIEM |
|
Netskope CASB (Limited availability) |
|
— |
|
Proofpoint Insider Threat Management (Limited availability) |
— |
Sumo Logic |
|
Varonis |
|
— |
S
SaaS apps |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | Via SIEM |
|
Box |
|
— |
|
Dropbox |
|
— |
|
Duo |
|
— |
|
GitHub |
|
— |
|
G Suite |
|
— |
| Microsoft Azure AD | |
— |
| Microsoft Defender for Cloud Apps - formerly MCAS (includes Defender for Identity) |
|
— |
| Microsoft Office 365 (includes Azure AD) | |
— |
|
Okta |
|
— |
|
OneLogin |
|
— |
| SaaS Security formerly Prisma SaaS | |
— |
Hunting |
Availability |
|
|---|---|---|
On-prem infrastructure |
||
|
Vendor Technology |
Yes |
Via SIEM |
|
CrowdStrike Falcon |
|
|
|
Endgame |
|
|
| Microsoft Defender for Endpoint | |
|
|
Palo Alto Networks (Firewall) |
|
|
| SentinelOne | |
|
|
VMware Carbon Black EDR |
|
|
|
VMware Carbon Black Cloud |
|
|
Cloud Infrastructure |
||
|
Vendor Technology |
Yes |
Via SIEM |
|
Amazon Web Services (AWS) |
|
|
| Azure | |
|
SaaS apps |
||
|
Vendor Technology |
Yes |
Via SIEM |
|
Duo |
|
|
|
G Suite |
|
|
|
Microsoft Office 365 |
|
|
|
Okta |
|
|
|
OneLogin |
|
|
Comments
0 comments
Please sign in to leave a comment.