Works with the tools you already run.

SIEM

Where your alerts are raised and your logs are kept.

• Elastic SecurityAlerts in, and the agent searches its logs
• SplunkAlerts sent in
• Microsoft SentinelAlerts and incidents sent in

Deepest with Elastic today: the agent searches its logs during an investigation. The other tools send their alerts in for the agent to work on.

EDR

Endpoint detection and response on your machines.

• Microsoft DefenderAlerts and incidents sent in
• CrowdStrike FalconDetections sent in
• Elastic FleetAgents and log collection, added once you confirm

Identity and access (IAM)

Who your people are, and how they log in to armor360.

• OktaSingle sign-on
• Microsoft Entra IDSingle sign-on
• Any OIDC providerSingle sign-on

Threat intelligence

What is known about the addresses, domains and files in an alert.

• MMISPIndicators matched to your logs
• VirusTotalFile and address reputation
• AOAlienVault OTXIndicator lookups
• AAbuseIPDBAddress reputation

Ticketing (ITSM)

Findings that become work items in the tools your team already uses.

• JiraTickets for findings
• ServiceNowIncidents for findings

Chat and on-call

Telling the right person when something needs them.

• SlackChannel messages
• Microsoft TeamsChannel messages
• PagerDutyOn-call alerts
• EEmailMessages and daily digests

Detection rules

The rules that raise your alerts.

• KibanaDetection rules switched on once a person approves; off needs two administrators

Any other tool

Anything that can send JSON.

• Any tool, by webhookAlerts sent in
• WebhooksFindings sent out