Integrations — Connect Your Security Stack

Supported integrations

The tools your team
already uses.

Pre-built connectors for the most common enterprise security stack. Click any category to see what goes in and what comes out.

SIEM & LOG MANAGEMENT

SplunkMicrosoft SentinelIBM QRadarElastic SIEMSumo Logic

What goes in

2.4M

events per day

Raw syslog, CEF, JSON from firewalls, servers, and applications

→

dig8ital agent

SOC / MDR Agent

Correlate, deduplicate, enrich with threat intel, map to MITRE ATT&CK

What comes out

actionable alerts

Prioritised by business impact in AUD. False positive rate: 0.1%

Splunk HEC · POST /services/collector/event

{
  "event": {
    "sourcetype": "syslog",
    "host": "fw-edge-01.corp.local",
    "event": "action=blocked src=10.0.4.22 dst=185.220.101.42 rule=C2-blocklist severity=high"
  }
}

dig8ital normalised

{
  "type": "network_event",
  "severity": "high",
  "action": "blocked",
  "source_ip": "10.0.4.22",
  "dest_ip": "185.220.101.42",
  "rule": "C2-blocklist",
  "business_impact": "A$2.4M"
}

EDR & ENDPOINT

CrowdStrike FalconSentinelOneMicrosoft DefenderCarbon BlackCortex XDR

What goes in

10,847

detections per month

Endpoint telemetry: process execution, file changes, network connections, registry modifications

→

dig8ital agent

SOC / MDR Agent

Auto-triage by severity, correlate with identity and network data, check kill chain stage

What comes out

require human review

Each with full kill chain context, recommended containment, and A$ risk quantification

CrowdStrike Falcon · GET /detects/entities/summaries/GET/v1

{
  "detection_id": "ldt:abc123:456",
  "max_severity_displayname": "Critical",
  "tactic": "Command and Control",
  "device": { "hostname": "WS-0847" },
  "behaviors": [{ "filename": "beacon.exe", "parent_process": "outlook.exe" }]
}

dig8ital normalised

{
  "type": "detection",
  "severity": "critical",
  "tactic": "command_and_control",
  "host": "WS-0847",
  "file": "beacon.exe",
  "parent": "outlook.exe",
  "business_impact": "A$4.2M"
}

FIREWALL & NETWORK

Palo Alto NetworksFortinet FortiGateCisco FirepowerZscalerCheck Point

What goes in

48M

sessions per day

Traffic logs, threat logs, URL filtering, SSL inspection events

→

dig8ital agent

Security Architecture Agent

Identify policy gaps, detect shadow IT, correlate with threat intel feeds

What comes out

policy recommendations

With before/after risk exposure and implementation priority

Palo Alto PAN-OS · GET /api/?type=log&log-type=traffic

{
  "type": "TRAFFIC",
  "subtype": "deny",
  "src": "10.0.4.22",
  "dst": "185.220.101.42",
  "action": "deny",
  "rule": "outbound-c2-block",
  "device_name": "FW-EDGE-01"
}

dig8ital normalised

{
  "type": "network_event",
  "action": "denied",
  "source_ip": "10.0.4.22",
  "dest_ip": "185.220.101.42 (known C2)",
  "rule": "outbound-c2-block",
  "linked_detection": "WS-0847 beacon.exe"
}

VULNERABILITY MANAGEMENT

TenableQualysRapid7 InsightVMNessus

What goes in

347

open vulnerabilities

CVEs with CVSS, VPR scores, affected assets, exploit availability

→

dig8ital agent

Vulnerability Agent

Filter by exploitability + business context. Correlate with attack paths and asset value

What comes out

patch this week

Ranked by A$ risk reduction per hour of remediation effort

Tenable.io · GET /vulns/export/{id}/chunks/{chunk}

{
  "asset": { "hostname": "web-prod-03" },
  "plugin": {
    "name": "PAN-OS RCE (CVE-2024-3400)",
    "vpr_score": 10.0,
    "cvss3_base_score": 10.0
  },
  "severity": "critical",
  "state": "open"
}

dig8ital normalised

{
  "type": "vulnerability",
  "severity": "critical",
  "cve": "CVE-2024-3400",
  "vpr": 10.0,
  "host": "web-prod-03",
  "days_open": 18,
  "exploitable": true,
  "business_impact": "A$1.8M"
}

IDENTITY & ACCESS

Microsoft Entra IDOktaCyberArkSailPointPing Identity

What goes in

2,847

identities monitored

Sign-in logs, MFA events, privilege changes, access reviews, impossible travel

→

dig8ital agent

IAM Governance Agent

Flag stale accounts, orphaned privileges, MFA gaps, impossible travel, SoD violations

What comes out

access risks to remediate

Prioritised by blast radius. Stale admin accounts flagged first

Microsoft Entra ID · GET /auditLogs/signIns

{
  "userPrincipalName": "j.smith@corp.com.au",
  "ipAddress": "203.0.113.42",
  "location": { "city": "Lagos", "countryOrRegion": "NG" },
  "riskLevelDuringSignIn": "high",
  "riskDetail": "impossibleTravel"
}

dig8ital normalised

{
  "type": "identity_event",
  "severity": "high",
  "user": "j.smith@corp.com.au",
  "risk": "impossible_travel",
  "location": "Lagos, NG",
  "action_required": "Block + notify manager"
}

GRC PLATFORMS

ServiceNow GRCRSA ArcherOneTrustLogicGate

What goes in

frameworks tracked

SOCI Act, CPS 234, Essential Eight, Privacy Act, ISO 27001, Cyber Security Act 2024

→

dig8ital agent

Compliance Agent

Map controls across frameworks, collect evidence automatically, flag gaps before auditors do

What comes out

87%

compliance score

Real-time. Board-ready. With gap-to-close timeline and A$ fine exposure

ServiceNow GRC · GET /api/now/table/sn_compliance_policy_exception

{
  "number": "PE0001234",
  "policy": { "display_value": "CPS 234 Information Security" },
  "exception_reason": "Legacy system cannot support MFA",
  "risk_score": 78,
  "expiration_date": "2026-06-30"
}

dig8ital normalised

{
  "type": "compliance_exception",
  "severity": "high",
  "framework": "CPS 234",
  "reason": "Legacy MFA gap",
  "risk_score": 78,
  "fine_exposure": "A$12.5M"
}

CLOUD SECURITY

AWS Security HubAzure DefenderGCP Security Command CenterWizPrisma Cloud

What goes in

1,247

cloud findings

Misconfigurations, toxic combinations, public exposure, unencrypted data, excessive permissions

→

dig8ital agent

Security Architecture Agent

Prioritise by toxic combination + data sensitivity. Filter noise from real exposure

What comes out

critical misconfigs

With affected data volume, PII exposure, and Privacy Act fine risk

Wiz Toxic Combination · POST /graphql

{
  "severity": "CRITICAL",
  "title": "Public S3 + PII + no encryption",
  "resource": {
    "type": "aws_s3_bucket",
    "name": "corp-data-backup-prod",
    "region": "ap-southeast-2"
  },
  "toxicCombinations": ["PUBLIC_ACCESS", "CONTAINS_PII", "NO_ENCRYPTION"]
}

dig8ital normalised

{
  "type": "cloud_misconfiguration",
  "severity": "critical",
  "resource": "s3://corp-data-backup-prod",
  "pii_exposed": true,
  "records_at_risk": 12000,
  "privacy_act_fine": "A$50M max"
}

EMAIL & PHISHING

ProofpointMimecastAbnormal SecurityDefender for Office 365

What goes in

4,200

suspicious emails per week

Phishing URLs, BEC attempts, malware attachments, impersonation attacks

→

dig8ital agent

Security Awareness Agent

Classify by attack type, identify repeat targets, correlate with training scores

What comes out

targeted interventions

Finance at 28% click rate gets BEC simulation + out-of-band wire verification

Proofpoint TAP · GET /v2/siem/clicks/blocked

{
  "classification": "phish",
  "threatUrl": "https://login-m1crosoft[.]com/auth",
  "recipient": "finance@corp.com.au",
  "sender": "ceo@corp-invoices[.]com",
  "subject": "Urgent: Wire Transfer Required",
  "clickResult": "blocked"
}

dig8ital normalised

{
  "type": "phishing_event",
  "severity": "high",
  "classification": "BEC",
  "target_dept": "Finance",
  "action": "blocked",
  "recommended": "BEC simulation + wire verification"
}

TICKETING & WORKFLOW

JiraServiceNow ITSMZendeskPagerDuty

What goes in

open security tickets

Vulnerability patches, incident follow-ups, compliance remediation, access reviews

→

dig8ital agent

GRC Agent

Track SLA compliance, flag overdue items, link tickets to risk register and board report

What comes out

SLA breaches this month

With risk exposure per day of delay and escalation path

Jira Security Issue · GET /rest/api/3/issue/SEC-1847

{
  "key": "SEC-1847",
  "fields": {
    "summary": "CVE-2024-3400: Patch PAN-OS",
    "priority": { "name": "Critical" },
    "status": { "name": "In Progress" },
    "duedate": "2026-03-21",
    "labels": ["soci-act", "critical-infra"]
  }
}

dig8ital normalised

{
  "type": "remediation_ticket",
  "severity": "critical",
  "cve": "CVE-2024-3400",
  "status": "in_progress",
  "sla_remaining": "-4 days",
  "daily_risk": "A$100K/day overdue"
}

THREAT INTELLIGENCE

Recorded FutureMISPCrowdStrike TIMandiantVirusTotal

What goes in

active threat actor profiles

IOCs, TTPs, campaign tracking, dark web monitoring, industry-specific threat feeds

→

dig8ital agent

Threat Intel Agent

Correlate external IOCs with internal telemetry. Map actor TTPs to your attack surface

What comes out

threats targeting your sector

With mapped attack paths, affected assets, and recommended countermeasures

Recorded Future API · GET /v2/alert/search

{
  "id": "alert-789",
  "title": "Lockbit 4.0 targeting AU financial services",
  "rule": { "name": "AU Critical Infrastructure" },
  "entities": [{ "type": "IpAddress", "name": "185.220.101.42" }],
  "risk": { "score": 89, "level": "Very High" }
}

dig8ital normalised

{
  "type": "threat_alert",
  "severity": "critical",
  "actor": "Lockbit 4.0",
  "target_sector": "AU financial services",
  "ioc": "185.220.101.42",
  "linked_internal": "WS-0847 beacon"
}

BACKUP & RECOVERY

VeeamCommvaultRubrikCohesityAWS Backup

What goes in

backup policies monitored

Backup success/failure, RPO/RTO compliance, immutability status, air-gap verification

→

dig8ital agent

IR Agent

Verify backup integrity, check ransomware readiness, flag RPO/RTO SLA breaches

What comes out

backup gaps found

Critical systems without immutable backups or with RPO exceeding 4 hours

Veeam REST API · GET /api/v1/backupSessions

{
  "id": "session-456",
  "jobName": "SQL-Prod-Daily",
  "result": "Warning",
  "endTime": "2026-03-25T03:45:00Z",
  "details": "1 of 4 VMs failed: db-payments-01",
  "isRetry": false
}

dig8ital normalised

{
  "type": "backup_event",
  "severity": "high",
  "job": "SQL-Prod-Daily",
  "status": "partial_failure",
  "failed_vm": "db-payments-01",
  "business_impact": "Payment DB unprotected"
}

CUSTOM / BRING YOUR OWN

REST APIGraphQLCSV / JSON ImportSyslogWebhook

Don’t see your tool? Request a connector →

What goes in

Any

data source

OT sensors, custom apps, legacy systems, proprietary formats

→

dig8ital agent

Custom Agent

Schema mapping in days. We build the connector, you bring the credentials

What comes out

Same

normalised output

Same prioritised, quantified, board-ready format as every other connector

Custom Webhook · POST /api/v1/ingest/webhook

{
  "source": "custom-ot-sensor",
  "event_type": "anomaly",
  "device": "plc-manufacturing-04",
  "protocol": "Modbus TCP",
  "baseline_deviation": 3.2
}

dig8ital normalised

{
  "type": "ot_anomaly",
  "severity": "medium",
  "device": "plc-manufacturing-04",
  "protocol": "modbus",
  "deviation": 3.2
}

Your security stack.
Our agents. One API layer.

Three steps from credentials
to insights.

Connect

Normalise

Act

From raw telemetry
to actionable output.

The tools your team
already uses.

Your infrastructure.
Your rules.

Cloud-Hosted

On-Premise

Australian data sovereignty — by design.

Most connectors live
in under a week.

Scoping Call

Configuration

Testing & Validation

Operational

What you bring

What we handle

Typical outcomes

Ready to connect your stack?

Your security stack.Our agents. One API layer.

Three steps from credentialsto insights.

Connect

Normalise

Act

From raw telemetryto actionable output.

The tools your teamalready uses.

Your infrastructure.Your rules.

Cloud-Hosted

On-Premise

Australian data sovereignty — by design.

Most connectors livein under a week.

Scoping Call

Configuration

Testing & Validation

Operational

What you bring

What we handle

Typical outcomes

Ready to connect your stack?

Your security stack.
Our agents. One API layer.

Three steps from credentials
to insights.

From raw telemetry
to actionable output.

The tools your team
already uses.

Your infrastructure.
Your rules.

Most connectors live
in under a week.