Integration · SIEMs
Splunk
Reads notable events or a saved search into cases, and can send Kandaro’s findings back to Splunk.
What Kandaro does with it
Kandaro SOC and Splunk.
Where your alerts already land. Kandaro reads them, opens cases and investigates.
- Alerts in
Reads its alerts and groups them into cases with fixed rules.
- Research
Searches it for related activity while it investigates a case. This uses Kandaro Connect.
- Alerts out
Sends new incidents and cases to it.
How it connects
Pick the way that fits.
- Cloud API
Kandaro reads from the vendor’s cloud. Nothing to install.
- Quick push
Your tool sends each alert to a private Kandaro address.
- Kandaro Connect
A small container on your network that only connects out. Adds research and response.
- Vendor API
Kandaro calls the vendor’s API with the access you grant.
What Kandaro needs
What you set up once.
- Splunk Cloud: a token for a role that may run the search.
- Splunk Enterprise: a push from your searches, or Kandaro Connect.
- Findings back: an HTTP Event Collector token.
SIEMs
More tools like this.
Wazuh
Reads every Wazuh alert into cases, and blocks addresses or isolates Linux machines through Wazuh’s own responses.
- Alerts in
- Research
- Respond
- Quick push
- Kandaro Connect
Elastic Security
Reads Elastic Security alerts into cases, and can write Kandaro’s findings to a data stream.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Microsoft Sentinel
Reads Sentinel incidents and alerts into cases, and can write Kandaro’s findings to a Sentinel workspace.
- Alerts in
- Alerts out
- Cloud API
- Vendor API
Connect Splunk to Kandaro SOC.
Request early access to Kandaro SOC, or start a 14-day trial of Kandaro Deception today.
Deception trial: card required · cancel before day 14 and pay nothing