Expel has out-of-the-box integrations with many cloud, endpoint, SaaS, network, and SIEM technologies. This article lists direct and indirect integrations currently in progress, as well as completed integrations. Those not listed as direct require either sending logs to one of our supported SIEMs or network technologies. We also include a list of technologies we can use for hunting.
The integrations available specifically for your organization depend on what your organization purchased. For more information about what your organization purchased, talk to the decision makers at your organization.
Note on Early Access: New integrations and features go through a period of Early Access before being made Generally Available. During Early Access, Integrations and Features are exposed to a wide range of customers, and refinements and fixes are made.
Kubernetes |
|
|---|---|
| Vendor technology | Security signal |
| Amazon Elastic Kubernetes Service (EKS) |
|
| Google Kubernetes Engine (GKE) |
|
Cloud Infrastructure |
|
|---|---|
| Vendor technology | Security signal |
| Amazon Web Services (AWS) |
|
| Microsoft Azure |
|
| Google Cloud Platform |
|
| Lacework (Early Access) |
 AWS Workload Events |
| Prisma Cloud Compute |
Audit Events |
Endpoint |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | via SIEM |
|
Cisco AMP |
|
— |
|
CrowdStrike Falcon |
|
— |
|
CyberArk PAM |
— | Splunk |
|
Cybereason |
|
— |
|
CylancePROTECT AV |
|
— |
|
Endgame |
|
— |
|
Microsoft Defender for Endpoint |
|
— |
|
Palo Alto Networks Cortex XDR Pro |
|
— |
|
SentinelOne |
|
— |
|
Symantec Endpoint Protection |
— |
Exabeam Fusion SIEM Splunk Sumo Logic |
|
Tanium Core |
|
— |
|
Trellix HX (formerly FireEye HX) |
|
— |
| VMware Carbon Black EDR | |
— |
| VMware Carbon Black Cloud | |
— |
|
Wazuh |
|
— |
Network |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | via SIEM |
|
Attivo BOTSink |
— |
Splunk Sumo Logic |
|
Check Point - AV, Anti-Bot, and IPS (Early Access) |
— |
|
|
Cisco ASA (Early Access) |
— |
|
|
Cisco Firepower |
— |
Splunk Sumo Logic |
|
Cisco Meraki |
— |
Splunk Sumo Logic |
|
Cisco Umbrella |
|
— |
|
Darktrace |
|
— |
|
ExtraHop (Early Access) |
|
— |
|
Forcepoint W Filter |
— |
Exabeam |
|
Fortinet FortiGate |
— |
|
|
Guardicore (Early Access) |
|
— |
|
iBoss (Early Access) |
— |
Splunk |
|
McAfee IDS (Early Access) |
— |
Exabeam Fusion SIEM |
|
Netskope SWG |
|
— |
|
Palo Alto Firewall |
|
— |
|
Palo Alto Networks Prisma Access |
|
— |
|
ProtectWise |
|
— |
|
Signal Sciences WAF |
|
— |
|
Zscaler1 |
— |
|
1 Requires the Nanolog Streaming Service (NSS), a virtual machine that must be hosted by the customer. Zscaler requires customers to use NSS to transport data from the customer’s Zscaler instance to a SIEM.
SIEM |
Type of support |
|
|---|---|---|
| Vendor Technology | Investigative source* | Detection source** |
|
Azure Log Analytics |
|
— |
|
Datadog (Early Access) |
|
|
|
DEVO |
|
— |
|
Elastic |
|
|
|
Exabeam Fusion XDR |
|
|
|
Exabeam Fusion SIEM |
|
— |
|
IBM QRadar |
|
|
|
IBM QRadar on Cloud (QRoC) |
|
|
|
Microsoft Azure Sentinel |
|
|
|
Securonix (Early Access) |
|
|
|
Sumo Logic Cloud SIEM Enterprise |
|
|
|
Sumo Logic Enterprise |
|
— |
|
Splunk Core |
|
— |
|
Splunk Enterprise Security |
|
|
|
Wazuh |
|
|
* Expel can query this SIEM to get more information to support the investigations of alerts coming from other sources.
** This SIEM generates alerts that Expel can use to add detection value.
UEBA |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | via SIEM |
|
Proofpoint Insider Threat Management (Early Access) |
— |
Sumo Logic |
S
SaaS apps |
Integration type |
|
|---|---|---|
| Vendor Technology | Direct | via SIEM |
|
Box |
|
— |
| CyberArk Identity (Early Access) | |
— |
|
Dropbox |
|
— |
|
Duo |
|
— |
|
GitHub |
|
— |
|
GitLab (Early Access) |
|
— |
|
Google Workspace |
|
— |
| Microsoft Azure AD | |
— |
| Microsoft Defender for Cloud Apps - formerly MCAS (includes Defender for Identity) |
|
— |
| Microsoft Intune (Early Access) | |
— |
| Microsoft Office 365 (includes Azure AD) | |
— |
| Netskope CASB | |
— |
|
Okta |
|
— |
|
OneLogin |
|
— |
| Ping Identity via Exabeam | — | |
| SaaS Security, formerly Prisma SaaS | |
— |
| Salesforce (Early Access) | |
— |
| Slack (Early Access) | |
— |
|
Varonis |
|
— |
| Workday (Early Access) | |
— |
Ticketing and notifications systems |
||
|---|---|---|
| Vendor Technology | Notifications | Ticketing system |
|
Asana |
|
|
|
Jira |
|
|
|
OpsGenie |
|
|
|
PagerDuty |
|
|
|
Request Tracker for Incident Response |
|
|
|
Slack |
|
|
|
ServiceNow |
|
|
|
Splunk On-Call |
|
|
|
Striven |
|
|
|
Teams |
|
|
Hunting |
Availability |
|
|---|---|---|
On-prem infrastructure |
||
|
Vendor Technology |
Yes |
via SIEM |
|
CrowdStrike Falcon (Falcon Data Replicator subscription required) |
|
|
|
Endgame |
|
|
| Microsoft Defender for Endpoint | |
|
|
Palo Alto Networks (Firewall) |
|
|
| SentinelOne | |
|
|
VMware Carbon Black EDR |
|
|
|
VMware Carbon Black Cloud |
|
|
Cloud Infrastructure |
||
|
Vendor Technology |
Yes |
Via SIEM |
|
Amazon Web Services (AWS) |
|
|
| Azure | |
|
SaaS apps |
||
|
Vendor Technology |
Yes |
Via SIEM |
|
Duo |
|
|
|
Google Workspace |
|
|
|
Microsoft Office 365 |
|
|
|
Okta |
|
|
|
OneLogin |
|
|
Comments
0 comments
Please sign in to leave a comment.