Connect Your Security Stack
Bring security intelligence together across cloud platforms, identity providers, threat intelligence and security data sources with our 100+ integrations, all within one AI-native SOC.
Integrations
Showing 108 integrations
108 integrations shown
SIEM
SIEM and alert-monitoring platforms used to retrieve alerts, query telemetry and support triage.
Azure Sentinel
Connect Azure Sentinel to ingest security events and support SIEM-led triage.
Google SecOps (Chronicle)
Connect and investigate the alerts and UDM data in Secops using HarkX.
CrowdStrike Next-Gen SIEM (LogScale)
Run CQL investigation queries across Falcon and third-party telemetry.
IBM QRadar
Retrieve alerts and run UDM queries across security telemetry.
Cloud Security
Cloud posture, cloud-security alerts, firewall and cloud-service telemetry.
Microsoft Defender for Cloud
Ingest Azure security alerts and resource posture assessments.
Prowler
Use cloud security posture and compliance findings across AWS, Azure and GCP.
Wiz
Retrieve cloud security alerts, enrich vulnerabilities and discover cloud assets through the Wiz API.
Cloudflare
Discover Cloudflare DNS and CDN assets for security posture and exposure analysis.
Vulnerability Management
Vulnerability, posture and data-security controls.
SentinelOne Vulnerability Management
Enrich assets with known software vulnerabilities (CVEs) using SentinelOne Singularity Vulnerability Management.
Qualys
Retrieve vulnerability management findings and exposure context.
Tenable
Extract and enrich vulnerability-management alerts through the Tenable API.
Identity
Identity providers, identity audit data and account-exposure checks.
Keycloak
Integrate Keycloak identity data to support identity context during security investigations.
Okta
Connect identity-provider context to support identity-centric investigation.
Okta System Log
Collect Okta system events for authentication, administration and identity investigations.
Microsoft Entra ID
Connect Entra ID identity context and security events.
Google Workspace
Connect Google Workspace identity and activity context.
CrowdStrike Falcon Identity Protection
Collect identity-protection events to investigate identity-based threats.
Cloud Platform
Cloud and infrastructure platforms, asset discovery and infrastructure log sources.
AWS
Discover and map AWS cloud assets for security posture management.
Microsoft Azure
Discover and map Azure cloud assets.
Google Cloud Platform
Discover and map GCP cloud assets.
Oracle Cloud Infrastructure (OCI)
Discover and map OCI assets.
DigitalOcean
Discover and map DigitalOcean cloud infrastructure.
Kubernetes
Discover and map Kubernetes cluster assets.
Data Security
Integrations for sensitive data discovery, classification, exposure monitoring and protection.
Proofpoint DSPM
Classify sensitive data stores, assess exposure and access, and help quantify data blast radius.
Matters.AI
Discover and classify sensitive data, monitor data activity and identify exposure risks across cloud, SaaS and endpoint environments.
Cloudflare CASB
Collect cloud access security events for visibility into SaaS usage and policy activity.
Threat Intel
External threat intelligence, reputation, sandbox and attack-surface lookups.
VirusTotal
Analyze URLs and files using VirusTotal threat intelligence.
AbuseIPDB
Check IP address reputation using the AbuseIPDB database.
Tor
Retrieve Tor network intelligence, including exit nodes and relay nodes.
Recorded Future
Ingest threat intelligence alerts and enrich indicators of compromise through the Recorded Future API.
SOCRadar
Retrieve external threat intelligence alerts and enrich indicators of compromise through the SOCRadar API.
Shodan
Look up internet-exposed IP addresses and DNS domains using Shodan intelligence.
ANY.RUN
Submit files and URLs to the ANY.RUN sandbox for malware analysis.
Have I Been Pwned
Check email/account addresses for known breach and paste exposure.
Case Management
Ticketing, incident synchronization and asset-management workflows.
ServiceNow
Mirror HarkX incidents into ServiceNow ITSM and synchronize incident state.
Jira
Mirror HarkX incidents into Jira issues and synchronize incident state.
CMDB
Integrations for asset discovery, inventory management and configuration data synchronization.
Snipe-IT
Discover and map assets from the Snipe-IT asset management system.
Trivy
Discover and map assets from Trivy vulnerability-scanning results.
Cloud
Security and infrastructure log sources ingested into HarkX for monitoring and investigation.
AWS CloudTrail
Collect AWS management and data events from S3 through an SQS notification queue.
AWS GuardDuty
Collect GuardDuty findings exported to S3.
AWS VPC Flow Logs
Collect network flow telemetry from AWS VPCs.
AWS Route 53 Resolver Logs
Collect DNS query telemetry from Route 53 Resolver.
AWS WAF
Collect AWS WAF web ACL request logs.
AWS Load Balancer Logs
Collect Elastic Load Balancer access logs.
AWS SQS
Collect raw log lines published as SQS message bodies.
Microsoft Entra ID Logs
Collect Microsoft Entra ID sign-in and audit logs from an Event Hub.
Azure Storage Logs
Collect Azure Storage diagnostic events, including blob, file, queue and table activity.
Azure Network Logs
Collect Azure Firewall, Application Gateway/WAF, NSG and VNet flow logs.
Azure Kubernetes Logs
Collect AKS control-plane diagnostics, including Kubernetes API audit logs.
Azure PostgreSQL Logs
Collect Azure Database for PostgreSQL Flexible Server diagnostics, including connection and authentication events.
Azure Event Hub
Collect Azure Monitor streams such as Activity Log, Key Vault, SQL audit and Defender events.
Google Workspace Logs
Collect Google Workspace audit logs covering admin, login, OAuth, SAML, Drive and device activity.
GitHub Audit Log
Collect GitHub organization audit events.
Databricks Audit Log
Collect Databricks audit events.
Snowflake Audit Log
Collect Snowflake audit events.
Linux auditd
Collect Linux audit events for host activity monitoring.
VMware ESXi
Collect VMware ESXi platform logs for infrastructure monitoring.
SAP Security Audit Log
Collect SAP security audit events for monitoring and investigation.
Cisco Secure Firewall
Collect Cisco Secure Firewall logs.
Upwind
Collect cloud security findings, threat detections and audit events to support cloud threat monitoring and investigation.
Network Security / SASE
Network security and secure-access telemetry delivered through HTTPS JSON log push.
Cloudflare Zero Trust Gateway – HTTP
Collect HTTP gateway activity for web access monitoring and investigation.
Cloudflare Zero Trust Gateway – DNS
Collect DNS gateway activity for domain-level security monitoring.
Cloudflare Zero Trust Gateway – Network
Collect network gateway activity for traffic and security investigations.
Cloudflare WARP Device Posture
Collect WARP device-posture signals to provide endpoint compliance context.
Zscaler Internet Access (ZIA) – Web Logs
Collect ZIA web access logs for browsing and threat investigations.
Zscaler ZIA – Admin Audit
Collect ZIA administrative audit events for change tracking and investigation.
Zscaler ZIA – Endpoint DLP
Collect endpoint DLP events to support data-loss monitoring and investigation.
Zscaler Private Access (ZPA) – User Activity
Collect ZPA user activity for private application access monitoring.
Zscaler ZPA – App Connector Status
Collect application connector status for availability and access troubleshooting.
Cisco ISE
Collect network access-control and authentication events from Cisco ISE.
Aruba ClearPass
Collect access-control and authentication events from Aruba ClearPass.
FreeRADIUS
Collect RADIUS authentication and access events for network access monitoring.
Cisco Catalyst DHCP Snooping
Collect DHCP snooping events to monitor address assignments and suspicious activity.
ISC DHCP (dhcpd)
Collect DHCP server events for address-assignment and network investigations.
ISC Kea DHCP
Collect Kea DHCP server events for address-assignment monitoring.
Ubiquiti UniFi
Collect UniFi network device and controller events for infrastructure monitoring.
ISC BIND DNS
Collect BIND DNS server events for DNS monitoring and investigation.
Suricata
Collect Suricata IDS/NSM events for network threat detection and investigation.
Zeek
Collect Zeek network telemetry for protocol-level analysis and investigations.
Fail2ban
Collect authentication-abuse and ban events from Fail2ban for host-security monitoring.
Trend Micro Zero Trust Secure Access (ZTSA)
Collect ZTSA events for secure web and application access monitoring.
Web / Application Security
Web, application gateway, DNS, WAF and network-edge security telemetry.
Cloudflare WAF (Firewall Events)
Collect WAF firewall events to investigate and monitor flagged requests.
Cloudflare HTTP Requests
Collect HTTP request logs for web traffic monitoring and investigation.
Cloudflare Spectrum Events
Collect Spectrum events for monitoring traffic to TCP/UDP applications.
Cloudflare NEL Reports
Collect Network Error Logging reports to investigate client-side network errors.
Cloudflare Network Analytics (Magic Transit / DDoS)
Collect network analytics for traffic visibility and DDoS investigation.
Cloudflare DNS Logs
Collect DNS query activity for domain monitoring and investigation.
Cloudflare Audit Logs
Collect Cloudflare administrative audit events for configuration and change tracking.
Kong Gateway
Collect Kong Gateway logs for API traffic and gateway activity monitoring.
nginx
Collect nginx access and error logs for web traffic and application troubleshooting.
Email / Email Security
Email security and cloud-access data-security telemetry.
Cloudflare Email Security (Area 1)
Collect email security events to support phishing and email-threat investigations.
Postfix
Collect Postfix mail-transfer logs for delivery monitoring and email investigations.
Dovecot
Collect Dovecot mail-access and authentication logs for monitoring and investigation.
Endpoint / EDR
Endpoint detection, response and data-loss-prevention telemetry.
SentinelOne Singularity EDR (Deep Visibility)
Collect Deep Visibility telemetry for endpoint threat hunting and investigation.
CrowdStrike Falcon
Collect Falcon endpoint security events for detection and investigation.
CoSoSys Endpoint Protector
Collect endpoint DLP and device-control events for data-protection monitoring.
Zscaler ZIA via NSS – Web, Admin Audit, Endpoint DLP
Collect ZIA web, administrative audit and endpoint DLP events through NSS.
Trend Micro Apex One (via Apex Central)
Collect Apex One security events through Apex Central.
ManageEngine Endpoint Central
Collect endpoint-management and device activity logs for operational monitoring.
VMware ESXi / vCenter
Collect virtualization platform logs for infrastructure monitoring and investigation.
Network Detection (IDS / NSM)
Network detection and network security monitoring telemetry.
Suricata
Collect Suricata IDS/NSM events for network threat detection and investigation.
Zeek
Collect Zeek network telemetry for protocol-level analysis and investigations.
Firewalls
Firewall and email-threat-prevention logs delivered directly over TLS or through a log forwarder.
Fortinet FortiGate
Collect firewall and security events from FortiGate for network monitoring.
Palo Alto Networks PAN-OS
Collect PAN-OS firewall and threat logs for network security monitoring.
Check Point Firewall
Collect Check Point firewall events for traffic and threat investigation.
Check Point Email Threat Prevention
Collect email threat-prevention events for email security investigations.
Cisco ASA
Collect Cisco ASA firewall events for network security monitoring.
Business Applications
Business application security audit events.
SAP Security Audit Log
Collect SAP security audit events for monitoring and investigation.
A Clear Path Forward
- 01
Create an Account
Sign up for HarkX and get access to your security workspace.
- 02
Connect Your Data Sources
Connect your existing security tools and begin bringing relevant telemetry into HarkX.
- 03
Turn Data Into Insights
Explore security insights and AI-assisted investigations across your connected environment.
Don't See What You're Looking For?
Tell us which integrations you'd like to see in HarkX.