Cortex XSOAR Integrations

Edge Delta is a new way to do observability. We are the only provider that processes your data as it's created and gives DevOps, platform engineers and SRE teams the freedom to route it anywhere. As a result, customers can make observability costs predictable, surface the most useful insights, and shape your data however they need. Our primary differentiator is our distributed architecture. We are the only observability provider that pushes data processing upstream to the infrastructure level, enabling users to process their logs and metrics as soon as they’re created at the source. Data processing includes: * Shaping, enriching, and filtering data * Creating log analytics * Distilling metrics libraries into the most useful data * Detecting anomalies and triggering alerts We combine our distributed approach with a column-oriented backend to help users store and analyze massive data volumes without impacting performance or cost. By using Edge Delta, customers can reduce observability costs without sacrificing visibility. Additionally, they can surface insights and trigger alerts before data leaves their environment.

Intezer’s Autonomous SOC platform triages alerts 24/7, investigates threats, and auto-remediates incidents for you. "Autonomously" investigate and triage every incident, with Intezer’s platform working like your Tier 1 SOC to escalate only the confirmed, serious threats. Easily integrate your security tools to get immediate value and streamline your existing workflows. Using intelligent automation built for incident responders, Intezer saves your team from time wasted on false positives, repetitive analysis tasks, and too many escalated alerts. What is Intezer? Intezer isn't really a SOAR, sandbox, or MDR platform, but it could replace any of those for your team. Intezer goes beyond automated SOAR playbooks, sandboxing, or manual alert triage to autonomously take action, make smart decisions, and give your team exactly what you need to respond quickly to serious threats. Over the years, we’ve fine-tuned and expanded the capabilities of Intezer’s proprietary code-analysis engine, AI, and algorithms to automate more and more of the time-consuming or repetitive tasks for security teams. Intezer is designed to analyze, reverse engineer, and investigate every alert while "thinking" like an experienced security analyst.

BreachRx is the industry-leading integrated incident reporting and response automation platform trusted by security and technical leaders worldwide. Our platform addresses a critical challenge faced by businesses: mitigating cybersecurity regulatory and incident compliance risks. By leveraging our innovative SaaS solution, teams can streamline collaboration within their organization and optimize bandwidth, all while ensuring strict adherence to global cybersecurity and privacy frameworks. BreachRx empowers organizations to automate their incident response program and conduct cyber tabletop exercises using tailored playbooks that align with the company's specific security operations, compliance requirements, and regulatory reporting obligations—all while safeguarding legal privilege. Additionally, our cutting-edge Cyber RegScout™ feature automates the analysis of cybersecurity, privacy, and data protection regulations, making BreachRx the first to offer comprehensive incident response coverage for the entire enterprise. Strengthen your business's cyber readiness and resilience with our award-winning platform today.

ANY.RUN is a cloud malware sandbox that handles the heavy lifting of malware analysis for SOC and DFIR teams, as well as Threat Intelligence Feeds and Threat Intelligence Lookup. Every day, 400,000 professionals use our platform to investigate incidents and streamline threat analysis. - Real-time results: it takes about 40s from file upload to malware detection. - Interactivity: Unlike many automated turn-key solutions ANY.RUN is fully interactive (you can engage with the VM directly in the browser). This feature helps prevent zero-day exploits and sophisticated malware that evades signature-based detection. - Tailored for malware analysis: There’s built in network analysis tools, debugger, script tracer, and automatic config extraction from memory, among other useful tools. - Cost-savings: For businesses, ANY.RUN is more affordable to run than an on-premises solution because it doesn’t need any setup or maintenance time from your DevOps team. - Efficient onboarding of new hires: ANY.RUN’s intuitive interface means that even Junior SOC analysts can quickly learn to analyze malware and extract IOCs. Learn more at ANY.RUN's website.

Coralogix is the most popular stateful streaming platform, providing engineering teams with real-time insight and long-term trend analysis without relying on storage or indexing. To manage, monitor, alert, and manage your applications, you can import data from any source. Coralogix automatically narrows the data from millions of events to common patterns, allowing for faster troubleshooting and deeper insights. Machine learning algorithms constantly monitor data patterns and flows among system components and trigger dynamic alarms to let you know when a pattern is out of the norm without the need for static thresholds or pre-configurations. Connect any data in any format and view your insights anywhere, including our purpose-built UI and Kibana, Grafana as well as SQL clients and Tableau. You can also use our CLI and full API support. Coralogix has successfully completed the relevant privacy and security compliances by BDO, including SOC 2, PCI and GDPR.

Faster access unlocks more revenue. Give your team on-demand access to apps that is faster and easier without frustrating them. Slack allows users to request access to apps. Managers can approve or deny the request from Slack. All of this is auditable. Stop manually catherding approvals. Every time an access is granted, there's a security risk. Indent helps teams to scale security and least-privilege by shifting users from permanent access without slowing things down. Automate spreadsheet-based processes for SOC 2, SOX ISO and HITRUST. Controls and policies are baked directly into the access request workflows. Reduce your license footprint by only providing access when needed, instead of granting permanent access. Indent reduces costs without adding friction to the end user experience. If you want to lead a rapidly growing company to success, you need to take on big risks.

Cyberint is a global threat-intelligence provider that helps its clients prevent cyber threats from extending beyond traditional security perimeters. Argos Edge, our digital risk protection platform, offers organizations a unique combination attack surface monitoring (ASM), advanced threat intelligence, extensive phishing detection, social media and brand abuse monitoring. Argos Edge is a proactive and targeted alerting system that reduces false positives by 99 percent. It allows organizations to immediately take steps to mitigate the most serious threats. They also receive up-to-date proactive information on global, regional and vertical threats that could cause a breach. Cyberint is a global service provider for top brands, including Fortune 500 companies in finance, gaming, media and ecommerce.

Networks change all the time, which can cause problems for IT and security operations. Security gaps can be exploited by attackers, opening up new pathways. Although enterprise security controls such as firewalls, intrusion prevention and vulnerability management are designed to protect your network, it is still possible for hackers to breach it. Monitoring your network for exploitable vulnerabilities, common configuration errors, mismanaged credentials, and legitimate user activity that could expose it to attack is the last line of defense. Despite significant security investments, hackers are still successful. It is difficult to secure your network due to numerous vulnerabilities, overwhelming alerts, and incessant software updates and patches. Security professionals must analyze and interpret large amounts of data in isolation. It is nearly impossible to reduce risk.

SCYTHE is an adversary-emulation platform that serves the cybersecurity consulting and enterprise market. SCYTHE allows Red, Blue, or Purple teams to create and emulate real-world adversarial campaign in just minutes. SCYTHE allows organizations continuously assess their risk exposure and risk posture. SCYTHE goes beyond assessing vulnerabilities. It allows for the evolution from Common Vulnerabilities and Exposures to Tactics Techniques and Procedures (TTPs). Organizations should be aware that they may be breached. They should concentrate on assessing and alerting controls. Campaigns are mapped according to the MITRE ATT&CK framework. This is the industry standard and common language among Cyber Threat Intelligence Blue Teams and Red Teams. Adversaries can use multiple communication channels to reach compromised systems within your environment. SCYTHE allows for the testing of preventive and detective controls on various channels.

Modern enterprises rely on countless partners and third party solutions to enhance online services, improve their operations, grow the business, and serve their customers. Each of these resources, in turn, connects with countless others to create a dynamic and growing ecosystem of assets that are mostly unmonitored. These hyperconnected eco-systems represent a vastly new attack surface, which falls outside the traditional security perimeters and enterprise risk management strategy. IONIX secures and protects enterprises against this new attack vector. IONIX, the only External Attack Surface Management Platform, allows organizations to identify and eliminate risks throughout their digital supply chain. Enterprises gain visibility and control over hidden risks arising from Web, Cloud PKI, DNS vulnerabilities or misconfigurations. Integrates natively or via API with Microsoft Azure Sentinel (including Atlassian JIRA), Splunk, Cortex XSOAR and more.

Active defense solutions based upon advanced deception are becoming more popular because they are low risk to deploy and do not have the false-positive issues that other approaches can cause. Acalvio’s ShadowPlex has been designed to set a standard for APT mitigation, ransomware mitigation, and malware prevention. ShadowPlex centralizes this process. Decoys, or fake hosts (or "honeypots") are hosted in one area and then strategically "projected", across the enterprise network where they appear as local assets. We can also change the complexity of the decoy in real-time to respond to an attacker's engagement. ShadowPlex's unique resource-efficient method allows it to deliver high-scale decoy realism and depth. ShadowPlex automates, simplifies, and streamlines the configuration and deployment deception objects. The system generates and places deception objects by combining pre-defined playbooks and an AI-based recommendation algorithm.

Longbow automates analysis and correlation between issues from Application Security Testing Tools (AST) to CNAPP. This closes the gap between remediation teams and security teams, and provides the best next steps to reduce risk with the least investment. Longbow is at the forefront in automatically analyzing and prioritizing issues and remediation from Application Security Testing Tools (AST) to VM, CNAPP, and more. Our product excels at identifying and addressing root causes of security problems, offering tailored remediation options that can be implemented immediately. This capability is vital in an industry that is flooded with disparate vendor eco-systems and lacks a clear direction to address security concerns. Our product is designed for security, application and DevOps team members to be able to mitigate risks efficiently at scale.

Adopt a proactive approach to cyber threat management from anticipation to response. Designed to enhance cybersecurity through comprehensive threat information, advanced adversary simulators, and strategic cyber risk-management solutions. Improved decision-making and a holistic view of the threat environment will help you respond faster to incidents. Organize and share your cyber threat intelligence to improve and disseminate insights. Access threat data from different sources in a consolidated view. Transform raw data to actionable insights. Share and disseminate actionable insights across teams and tools. Streamline incident responses with powerful case-management capabilities. Create dynamic attack scenarios to ensure accurate, timely and effective response in real-world incidents. Create simple and complex scenarios that are tailored to the needs of different industries. Instant feedback on responses improves team dynamics.

Trusted Email Identity can be used to protect customers and workers from advanced email attacks. Advanced email attacks target a major security flaw that legacy email security measures do not address. Agari gives customers, employees, and partners the confidence to trust in their email. Unique AI with more than 300m daily machine-learning model updates understands the good and protects you from the bad. Global intelligence powered trillions of global emails provides deep insights into behavior and relationships. Global 2000 companies have adopted the email security standards based on years of experience.

Tenable's Cyber Exposure Platform provides all the information, research and data that you need to find weaknesses in your entire attack surface. Tenable's market-leading vulnerability monitoring sensors allow you to see every asset on your attack surface, from cloud environments to operational technologies, containers to containers, remote workers to modern web apps. Tenable's machine learning-powered predictions reduce remediation efforts and allow you to concentrate on the most important risks. Communicating objective measures of risk and aligning business goals to security initiatives will help you drive improvements that reduce the likelihood of a cyber-related event affecting your business. These products include: Tenable.ep Tenable.io Tenable.sc Tenable.ad Tenable.ot - Tenable Lumin

Cylera's cybersecurity solution and analytics solution is easy to deploy and integrate seamlessly into your network, saving you time, money and headaches. Passive integration reduces disruption risk. Full deployment is possible with complete visibility of the cloud and on-prem networks. Integrations with pre-built APIs are available out-of-the box for rapid deployment. Flexible architecture allows multiple sites and teams the ability to collaborate. Cylera is not just another cybersecurity platform. Our platform is purpose-built to handle complex, high-impact environments. It combines contextual awareness with an in-depth understanding of operational workflows. Our AI-driven cybersecurity platform & intelligence platform provides real-time visibility to help solve cybersecurity and information technology problems. Cylera can passively monitor your existing networks. Cylera can integrate with many of the platforms that you use every day.

Our Continuous Threat Detection and Secure Remote Access (SRA), solutions power our platform. It offers a complete range of industrial cybersecurity controls that can be integrated seamlessly with your existing infrastructure. They scale easily and have the lowest total cost of ownership (TCO) in the industry. Our platform offers comprehensive industrial cybersecurity controls that are based on the REVEAL PROTECT DETECT CONNECT framework. No matter where you are in your industrial cybersecurity journey, the features of our platform will enable you to achieve effective industrial cyber security. Claroty Platform can be deployed in multiple industries with different security and operational requirements. Knowing what security needs to be met is the first step to effective industrial cybersecurity. Our platform removes barriers that prevent industrial networks from securely connecting to what allows the rest of the business and allows them to innovate and operate with an acceptable level risk.

RiskIQ PassiveTotal aggregates data across the internet, absorbing intelligence in order to identify threats and attacker infrastructure. It also leverages machine learning to scale threat hunting, response, and mitigation. PassiveTotal gives you context about who is attacking you, their tools, systems, and indicators that compromise outside of the firewall--enterprise or third party. Investigating can be fast and very fast. Over 4,000 OSINT articles, artifacts and documents will help you quickly find answers. RiskIQ's 10+ years of internet mapping gives it the most comprehensive and complete security intelligence. Passive DNS, WHOIS SSL, SSL, hosts and host pair, cookies, exposed service, ports, components, code, and more are all absorbed by RiskIQ. You can see the entire digital attack surface with curated OSINT and your own security intelligence. Take control of your digital presence to combat threats to your company.

ARIA Packet Intelligence, (PI) provides OEMs, service providers, security professionals, and others with a better way of using SmartNIC technology to support two key use cases: advanced packet level network analytics and cyber-threat response, containment, and detection. Network analytics: ARIA PI gives complete visibility to all network traffic and feeds valuable data to packet delivery accounting tools and quality of service systems. This allows companies to provide better service and maximize revenue tied to usage-based billing. Cyber-threat detection and response, as well as containment: ARIAPI also feeds metadata into threat detection tools, allowing for complete visibility of all network traffic, east-west data flows, and more. This increases the effectiveness of existing security tools such as SIEMs or IDS/IPS tools and gives security teams a better method to detect, respond, contain and remediate even the most advanced cyber-threats.

Recorded Future is the largest provider of enterprise security intelligence in the world. Recorded Future provides timely, accurate, and practical intelligence by combining pervasive and persistent automated data collection and analysis with human analysis. Recorded Future gives organizations the visibility they need in a world of increasing chaos and uncertainty. It helps them identify and detect threats faster, take proactive action to disrupt adversaries, and protect their people and systems so that business can continue with confidence. Recorded Future has been trusted by over 1,000 businesses and government agencies around the globe. Recorded Future Security Intelligence Platform provides superior security intelligence that disrupts adversaries on a large scale. It combines analytics and human expertise to combine a wide range of open source, dark net, technical, and original research.

CrossLink's first users are greeted with the words "Know more" when they open it. This ethos powers CrossLink. How can we help everyone, whether they are an investigator, a SOC analyst, or an incident responder, tell better stories about their data? Search results from six verticals of actor-centric and network data quickly provide key information that can easily be assembled and shared within an organization. CrossLink was created by an experienced team of analysts with decades of experience in investigating a wide range of threats. Data verticals include a vast array of information about actors, communications, historical Internet registration records and IP reputation. Passive DNS telemetry is also available to jump-start investigations into incidents and actors. CrossLink allows users to create alerts, lightweight management functions and shareable case folders.

Security and connectivity to OT networks has become a business requirement. It requires a shift of security mindset. SCADAfence platform, a non-intrusive continuous monitoring solution, was specifically designed to provide the required visibility for organizations adopting advanced Industrial IoT technology. SCADAfence automatically detects assets and their roles within the network and provides visibility into their behavior. It detects anomalies that could compromise security, safety, and reliability using a variety of algorithms and mechanisms. SCADAfence was built with the unique ability to detect and protect 100% network traffic in any architecture, including large-scale manufacturing networks.

Are you tired of performing high-level malware analysis? Do you feel tired of high-level malware analysis? Instead of focusing on one technology, try to use multiple technologies such as hybrid analysis, instrumentation and hooking, hardware virtualization, machine learning / artificial intelligence, and machine learning / emulation. You can see the difference in our reports. Deeply analyze URLs for phishing, drive-by downloads, scams and more. Joe Sandbox uses an advanced AI-based algorithm that includes template matching, perptual havehing, ORB feature detector, and more to detect malicious use of legit brands. To enhance the detection capabilities, you can add your logos and templates. Live Interaction allows you to interact with the sandbox directly from your browser. Click through complex malware installers or phishing campaigns. You can test your software against backdoors, information loss, and exploits (SAST or DAST).

Cortex Xpanse constantly monitors the internet for assets to ensure that your security operations team is not exposed blind spots. Get an outside-in view on your attack surface. Identify and attribute all internet-connected assets, discover sanctioned or unsanctioned assets and monitor for changes. By detecting and preventing breaches, you can ensure compliance and ensure compliance. By identifying potential misconfigurations, you can reduce third-party risk. Avoid inheriting M&A security problems. Xpanse keeps a global inventory of all internet-facing assets. It is accurate, current, and constantly updated. This allows you to identify, evaluate, and mitigate attack surface risk. You can also flag potentially dangerous communications, assess supplier risk, and assess the security of acquired businesses. Before a breach occurs, catch misconfigurations and exposures.

Phosphorus provides the backbone to secure the rapidly expanding and often unmonitored enterprise IoT ecosystem. Phosphorus provides visibility down to the firmware version and device model, giving you complete, detailed visibility into all embedded devices in your network. Phosphorus's unique capabilities allow you to update all your IoT devices with the latest firmware and rotate credentials with a click. Phosphorus's scanner is not like traditional scanners which search for vulnerabilities and require expensive Spanports. It detects all IP-enabled devices on your network with a light touch, without "knocking over" them. Our solutions provide enterprise protection. Audit IoT inventories. Conform to industry regulations and compliance requirements. Automate key tasks such as policy enforcement and patching updates, all at a fraction the cost.

Learn what a digital protection solution is, how it can help prepare you by identifying who is targeting you and what they are after. Mandiant offers a comprehensive digital risk protection solution, either as a standalone self-managed SaaS product or as a comprehensive service. Both options provide security professionals with visibility outside their organization and the ability to identify high risk attack vectors, malicious orchestration on the dark and deep web, and attack campaign on the open web. Mandiant’s digital risk solution provides contextual information about threat actors, their tactics, techniques and procedures, to create a more secure cyber-threat profile. Map your attack surface, and monitor deep and dark web activities to gain visibility into the risk factors that impact the extended enterprise and supply chains. Identify unknown or unmanaged internet-facing assets that are vulnerable before threat actors do.