Integrations
Works with the tools you already run.
Kandaro SOC connects to your SIEM, XDR and EDR, identity provider and firewalls, and to the places your team works: alert channels, ticketing and lookups. Only tools that work today are listed here.
SIEMs
Where your alerts already land. Kandaro reads them, opens cases and investigates.
Wazuh
Reads every Wazuh alert into cases, and blocks addresses or isolates Linux machines through Wazuh’s own responses.
- Alerts in
- Research
- Respond
- Quick push
- Kandaro Connect
Splunk
Reads notable events or a saved search into cases, and can send Kandaro’s findings back to Splunk.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Elastic Security
Reads Elastic Security alerts into cases, and can write Kandaro’s findings to a data stream.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Microsoft Sentinel
Reads Sentinel incidents and alerts into cases, and can write Kandaro’s findings to a Sentinel workspace.
- Alerts in
- Alerts out
- Cloud API
- Vendor API
Google Security Operations
Reads detections from Google Security Operations into cases.
- Alerts in
- Cloud API
IBM QRadar
Reads QRadar offenses into cases.
- Alerts in
- Research
- Cloud API
- Kandaro Connect
OpenSearch
Reads alerts from OpenSearch monitors into cases.
- Alerts in
- Research
- Quick push
- Kandaro Connect
Any tool (JSON)
Anything that can send JSON over HTTPS becomes an alert source, in Kandaro’s simple format.
- Alerts in
- Quick push
XDR and EDR
Your endpoint tools. Kandaro reads their incidents and can isolate a machine once you approve.
Microsoft Defender XDR
Reads Defender incidents into cases, and isolates a machine or blocks an address on your machines once you approve.
- Alerts in
- Respond
- Cloud API
- Vendor API
CrowdStrike Falcon
Contains a machine once you approve, and lifts containment again with one click.
- Respond
- Vendor API
SentinelOne
Disconnects a machine from the network once you approve, and reconnects it with one click.
- Respond
- Vendor API
Identity
Your sign-in provider. Kandaro can disable a hijacked account once you approve.
Firewalls and edge
Block an attacker’s address at the edge, on your approval, and lift it again by itself.
Cloudflare
Blocks an attacker’s address at Cloudflare for a set time, and lifts it again by itself.
- Respond
- Vendor API
Palo Alto Networks
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
Fortinet FortiGate
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
Check Point
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
Sophos Firewall
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
OPNsense
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
pfSense
Blocks an attacker’s address through your Kandaro block list, which the firewall pulls by itself.
- Respond
- Block list feed
Alert channels
Where people hear about a case: chat, paging, email, webhooks and your SIEM.
Slack
Posts new incidents and cases in the Slack channel you choose.
- Alerts out
- Vendor API
Microsoft Teams
Posts new incidents and cases in a Teams channel.
- Alerts out
- Vendor API
PagerDuty
Pages your on-call person for serious cases, and resolves the page when the case closes.
- Alerts out
- Vendor API
Email
Incident and case alerts by email, to up to 10 addresses.
- Alerts out
- Vendor API
Webhooks
Signed JSON to your own endpoint, for any tool that takes webhooks.
- Alerts out
- Vendor API
Ticketing
Cases become tickets, and status and comments stay in step both ways.
Jira
Opens a Jira issue for a case, and keeps status and comments in step both ways.
- Tickets
- Vendor API
ServiceNow
Opens a ServiceNow incident for a case, and keeps status and comments in step both ways.
- Tickets
- Vendor API
TheHive
Opens a TheHive case for each Kandaro case, and keeps status and comments in step both ways.
- Tickets
- Vendor API
Research and lookups
Reputation and context for the addresses, domains and files in a case.
AbuseIPDB
How often an address has been reported for abuse. Can also share addresses that touched your decoys, if you turn it on.
- Lookups
- Vendor API
VirusTotal
What security vendors say about a file hash, domain or address.
- Lookups
- Vendor API
GreyNoise
Whether an address is a known internet scanner or a targeted attacker.
- Lookups
- Vendor API
Shodan
What an internet address exposes: open ports and services.
- Lookups
- Vendor API
URLhaus
Whether a link or domain is known to spread malware.
- Lookups
- Vendor API
urlscan.io
Earlier scans of a link or domain. Kandaro only searches; it never starts a scan on its own.
- Lookups
- Vendor API
MISP
Matches against your MISP events, and can share decoy-seen addresses back if you turn it on.
- Lookups
- Vendor API
OpenCTI
Matches against your OpenCTI knowledge, and can share decoy-seen addresses back if you turn it on.
- Lookups
- Vendor API
Registration data (RDAP)
Who an address or domain is registered to.
- Lookups
- Vendor API
abuse.ch block lists
Known botnet servers and malicious certificates, checked inside Kandaro.
- Lookups
- Built in
How it connects
Three ways to connect, plus a block list.
Pick the way that fits each tool. Alert channels, ticketing, lookups and response use each vendor’s own API, with only the access you grant.
Cloud API
Kandaro reads from the vendor’s cloud. Nothing to install.
Quick push
Your tool sends each alert to a private Kandaro address.
Kandaro Connect
A small container on your network that only connects out. Adds research and response.
Block list feed
Your firewall pulls Kandaro’s block list every few minutes. Kandaro never logs in to it.
The AI never closes a case and never acts on its own: every action waits for a person to approve it.
Missing a tool?
If it sends JSON, it already works.
Anything that can send JSON over HTTPS becomes an alert source through Any tool (JSON). For anything else, tell us which tool you need.
Connect your tools to Kandaro SOC.
Request early access to Kandaro SOC, or start a 14-day trial of Kandaro Deception today.
Deception trial: card required · cancel before day 14 and pay nothing