The Qorionix integration catalog
Your tools. One security workspace.
Find your apps, see what each connection supports, and know what you need before you start.
94 with setup available 0 on the roadmap
94 integrations
Messaging
Discord
Posts Qorionix alerts into a Discord channel as embeds through an incoming webhook, with a real health check against the webhook's own metadata.
Messaging
Slack
Posts Qorionix alerts into a Slack channel as Block Kit messages with a deep link back into the console.
Cloud platforms
AWS CloudTrail
Console sign-ins, IAM changes and every API call recorded by CloudTrail, pulled from the S3 bucket the trail writes to and parsed into named fields.
Cloud platforms
AWS IAM Identity Center
SAML 2.0 sign-in through AWS IAM Identity Center (formerly AWS SSO). SCIM user provisioning from Qorionix is not available.
Cloud platforms
Amazon GuardDuty
Imports GuardDuty findings — unauthorized API calls, compromised credentials, anomalous network behaviour — from a tenant's own AWS account into the Qorionix SIEM incident queue. Read-only: does not archive, suppress or resolve findings in AWS.
Cloud platforms
Azure Activity Log
Subscription-level control-plane and service health events from Azure Activity Log — who created, modified or deleted which resource, polled every five minutes and parsed into named fields.
Cloud platforms
Google Cloud Audit Logs
Admin activity and data access events from Google Cloud Audit Logs — who changed which IAM binding, compute resource or storage object, polled every five minutes and parsed into named fields.
Cloud platforms
Microsoft Defender for Cloud
Imports Microsoft Defender for Cloud security alerts — compromised VMs, anomalous sign-ins, SQL injection attempts — from a tenant's own Azure subscription into the Qorionix SIEM incident queue. Read-only: does not dismiss or resolve alerts in Azure.
Custom integrations
Signed event webhooks
Deliver every matching platform event to an HTTPS endpoint you run, signed with HMAC-SHA256 so the receiver can prove origin and reject replays. The generic way to feed a SIEM, a ticketing system or an automation runner Qorionix has no connector for.
Custom integrations
Signed webhook
Delivers alerts as HMAC-SHA256-signed JSON to any HTTPS endpoint, for tools Qorionix does not ship a connector for.
Data platforms
MongoDB Atlas
SAML 2.0 federated authentication for a MongoDB Atlas organization.
Email security
Mimecast Email Security
Imports Mimecast Targeted Threat Protection events — blocked and permitted malicious URL clicks, sandboxed attachments, detected impersonation attempts — from a tenant's own Mimecast account into the Qorionix SIEM incident queue. Read-only: does not release or quarantine messages.
Email security
Proofpoint Targeted Attack Protection
Imports Proofpoint TAP threat events — blocked and permitted malicious clicks, cleared and quarantined messages — from a tenant's own Proofpoint account into the Qorionix SIEM incident queue. Read-only: does not quarantine or release messages.
Endpoint security
Bitdefender GravityZone
Imports Bitdefender GravityZone incidents and endpoint inventory from a tenant's own GravityZone console into Qorionix XDR. Read-only: does not isolate endpoints or run remediation tasks.
Endpoint security
CrowdStrike Falcon
Imports the alerts CrowdStrike Falcon raises for your tenant and the devices it protects into the Qorionix XDR incident queue, beside your own sensor and Microsoft Defender. Network containment and other Falcon response actions are not available through this integration yet.
Endpoint security
ESET PROTECT
Imports ESET PROTECT detections and device inventory from a tenant's own ESET PROTECT Cloud or on-premises console into Qorionix XDR. Read-only: does not isolate devices or run cleanup tasks.
Endpoint security
Microsoft Defender for Business
Imports the alerts Microsoft Defender for Business (and Defender for Endpoint) raises for your tenant into the Qorionix incident queue, lists the devices Defender protects beside the hosts running the Qorionix sensor, exports the CVE findings its Threat & Vulnerability Management module has for each device, and carries out isolate, release-from-isolation and antivirus scan through the Defender for Endpoint API — each one through the same approval queue and audit trail as an action on our own sensor. Requires one Entra app registration with Microsoft Graph: SecurityAlert.Read.All; WindowsDefenderATP: Machine.Read.All, Machine.Isolate, Machine.Scan, Vulnerability.Read.All (application permissions, admin consent required).
Endpoint security
SentinelOne Singularity
Imports the threats SentinelOne Singularity detects for your tenant and the agents it protects into the Qorionix XDR incident queue, beside your own sensor and Microsoft Defender. Network isolation and other SentinelOne response actions are not available through this integration yet.
Endpoint security
Sophos Central (Intercept X)
Imports Sophos Central alerts and endpoint inventory from a tenant's own Sophos Central account into Qorionix XDR. Read-only: does not isolate endpoints or clean up threats.
People & HR
BambooHR
Imports employees and departments from your BambooHR account into Qorionix IAM, read-only. BambooHR has no SSO or SCIM of its own; if you'd rather have BambooHR push changes instead, use inbound SCIM 2.0 (Directory sync → SCIM).
People & HR
HiBob
Imports employees and departments from your HiBob (bob) account into Qorionix IAM, read-only. HiBob has no SSO or SCIM of its own; if you'd rather have HiBob push changes instead, use inbound SCIM 2.0 (Directory sync → SCIM).
People & HR
Personio
SAML 2.0 single sign-on for Personio, the HR suite most widely used by German, Austrian and Swiss SMBs.
People & HR
SAP SuccessFactors
Imports employees and departments from your SAP SuccessFactors instance into Qorionix IAM, read-only. For provisioning driven by SuccessFactors instead, use inbound SCIM 2.0 (Directory sync → SCIM) with a compatible integration service.
People & HR
Workday
Imports workers and departments from your Workday HCM instance into Qorionix IAM, read-only, through a Workday custom report (RaaS). For provisioning driven by Workday instead, use inbound SCIM 2.0 (Directory sync → SCIM) with a compatible integration service.
Identity & access
AWS IAM (direct)
Imports IAM users, roles and groups from an AWS account into Qorionix IAM, read-only, so identity visibility covers accounts where AWS IAM is the directory of record rather than an upstream SSO provider. Does not manage IAM: no user, role or policy changes.
Identity & access
Active Directory / LDAP (direct)
Imports users and groups from an on-premises Active Directory or LDAPv3 directory into Qorionix IAM, read-only, over a direct LDAP bind and paged search. For tenants already synchronized to Microsoft Entra ID, the Entra ID directory sync integration is the better path.
Identity & access
Active Directory Federation Services (AD FS)
Sign in to Qorionix with on-premises Active Directory accounts through an AD FS farm acting as the SAML 2.0 identity provider. Directory contents stay on premises; only sign-in assertions cross.
Identity & access
Auth0
Imports users and roles from your Auth0 tenant into Qorionix IAM through the Management API, read-only, with roles standing in for groups. Sign-in with Auth0 as an external SAML or OIDC identity provider is configured on its own screen and appears as a capability of this same row.
Identity & access
Custom OIDC application
Connect any OpenID Connect relying party by pasting its redirect URI. Uses the platform OIDC provider, so discovery, JWKS and token issuance are the same code path every named OIDC template uses.
Identity & access
Custom SAML 2.0 application
Connect a SAML 2.0 application using its entity ID and assertion consumer URL. Standard profile attributes are included; check that their names match the application's requirements before setup.
Identity & access
Custom SCIM 2.0 provisioning target
Planned SCIM 2.0 user provisioning to external applications. Outbound provisioning cannot be configured yet; Qorionix's inbound SCIM service is available separately.
Identity & access
Google Workspace Directory
Reads users, groups and membership from Google Workspace over the Admin SDK Directory API, and suspends or restores accounts when writes are enabled.
Identity & access
JumpCloud
Imports system users and user groups from your JumpCloud organization into Qorionix IAM, read-only. Sign-in with JumpCloud and inbound SCIM provisioning from it are configured on their own screens and appear as capabilities of this same row.
Identity & access
Keycloak
Imports users and groups from one realm of your Keycloak server into Qorionix IAM, read-only. Sign-in with Keycloak and inbound SCIM provisioning from it are configured on their own screens and appear as capabilities of this same row.
Identity & access
Microsoft Entra ID (Microsoft 365)
Imports users from Microsoft Entra ID through Microsoft Graph. By default every sync reads your ENTIRE directory, with incremental delta sync. To pilot against a subset first, set "Only sync accounts in this domain" or "Only sync members of this group" below — either one reads only the matching accounts on every sync (delta sync is not used while a scope is set). Group memberships are applied when a synced user's memberships match a group that already exists in the console. Provider account creation from Qorionix is not available through this integration. Ending a session or disabling an account IS available, but only from a Response containment plan (not from this connector's own settings), and only once the app registration has been granted the Graph application permissions User.RevokeSessions.All and User.EnableDisableAccount.All with admin consent — the same app registration this connector already uses for sync.
Identity & access
Okta
Imports users and groups from your Okta org into Qorionix IAM with incremental sync by lastUpdated, read-only. Sign-in with Okta as an external SAML or OIDC identity provider, inbound SCIM provisioning from Okta, and parsing Okta's system log through a relay are configured on their own screens and appear as capabilities of this same row.
Identity & access
OneLogin
Imports users and groups from your OneLogin account into Qorionix IAM, read-only. Sign-in with OneLogin and inbound SCIM provisioning from it are configured on their own screens and appear as capabilities of this same row.
Identity & access
PingOne
Imports users and groups from a PingOne environment into Qorionix IAM, read-only. Sign-in with PingOne (or PingFederate in front of it) and inbound SCIM provisioning are configured on their own screens and appear as capabilities of this same row. PingFederate fronting a directory other than PingOne is out of scope for this connector.
Log source
HTTP Event Collector (Splunk-compatible)
A token-authenticated HTTP endpoint in the Splunk HEC shape. Anything that can POST JSON or raw lines with a token header can send logs: Splunk forwarders, Fluent Bit, Vector, the Docker splunk log driver and most SaaS log exporters.
Log source
Linux auditd
Authentication, privilege and process audit records from the Linux audit daemon, forwarded over syslog and parsed with the auditd parser.
Log source
Syslog (any firewall, switch or server)
Almost every firewall, switch, router, NAS and Linux server can send syslog. Events arrive over TLS or TCP, are parsed and stored as OCSF, and are searchable at once.
Log source
Wazuh
Imports a customer's own Wazuh deployment — agent inventory from the Wazuh Manager API and rule-engine alerts from the Wazuh Indexer — into the Qorionix SIEM incident queue. Read-only: does not change agent configuration, rules or manager state.
Log source
Windows servers and PCs
Sign-ins, privilege use and process starts from Windows machines running the Qorionix sensor, parsed from the Security event log into named fields (logon, account change, process creation).
Mcp
MCP server (bring your own)
Point Sentinel-Q at an MCP server you already run and its tools become available to the assistant without waiting for a connector. External tools are namespaced, their descriptions are quoted to the model as data, every call is checked against your own permissions, and a tool declared as changing something needs a human approval on every plan.
Device management
Jamf Pro
Imports macOS and iOS device inventory from a tenant's own Jamf Pro server into the XDR asset inventory, resolving or creating an asset by hostname for devices Jamf manages that have no Qorionix sensor. Read-only: does not change device configuration or policies.
Device management
Microsoft Intune
Imports managed device inventory and compliance state from a tenant's own Microsoft Intune tenant into the XDR asset inventory, resolving or creating an asset by hostname for devices Intune manages that have no Qorionix sensor. Read-only: does not change device configuration, policies or compliance state.
Network access
Cisco ASA / FTD
Connection, NAT, VPN and authentication events from an ASA or Firepower Threat Defense firewall, parsed with the Cisco ASA parser into named fields.
Network access
Cloudflare Zero Trust
OpenID Connect login method for Cloudflare Zero Trust (Access), making Qorionix the identity source for every Access application and WARP enrolment.
Network access
Fortinet FortiGate
Traffic, UTM, VPN and event logs from a FortiGate, parsed with the Fortinet parser into named fields.
Network access
Palo Alto Networks PAN-OS
Traffic, threat, system and GlobalProtect logs from a PAN-OS firewall, parsed with the PAN-OS CSV parser into named fields.
Monitoring
Datadog
SAML 2.0 single sign-on for a Datadog organization, EU or US site.
Monitoring
Grafana Cloud
OpenID Connect single sign-on for a Grafana Cloud stack using Grafana's Generic OAuth provider.
Incident response
Atlassian Opsgenie
Creates and closes Opsgenie alerts through the Alerts API v2, with stable deduplication by alias so a repeating condition is one alert, the same behaviour as the PagerDuty connector.
Incident response
PagerDuty
Triggers and auto-resolves PagerDuty incidents through Events API v2, with stable deduplication so a repeating condition is one incident.
Productivity
Box
SAML 2.0 single sign-on for a Box Business or Enterprise account.
Productivity
Dropbox Business
SAML 2.0 single sign-on for a Dropbox Business team.
Productivity
Google Workspace
SAML 2.0 single sign-on for Google Workspace, letting Qorionix act as the third-party IdP for Gmail, Drive and the Admin console.
Productivity
Microsoft 365 unified audit log
Sign-ins, mailbox rules, file sharing and admin changes from the Microsoft 365 unified audit log (Exchange, SharePoint, OneDrive, Teams and Entra ID workloads), polled every five minutes and parsed into named fields. The single most valuable source for most offices.
Productivity
Nextcloud
OpenID Connect and SAML 2.0 single sign-on for a self-hosted or managed Nextcloud instance — the most common EU-sovereign alternative to Google Workspace and Microsoft 365 file sharing.
Productivity
Notion
SAML 2.0 single sign-on for a Notion Enterprise workspace. SCIM user provisioning from Qorionix is not available.
Productivity
Salesforce
SAML 2.0 single sign-on for Salesforce Sales Cloud, Service Cloud, and Experience Cloud organizations. SCIM user provisioning from Qorionix is not available.
Productivity
Zoom
SAML 2.0 single sign-on for a Zoom business or enterprise account.
Source control
GitHub Enterprise Cloud
SAML 2.0 single sign-on for a GitHub organization on Enterprise Cloud. SCIM user provisioning from Qorionix is not available.
Source control
GitLab.com
SAML 2.0 group single sign-on for a GitLab.com top-level group on Premium or Ultimate. SCIM user provisioning from Qorionix is not available.
Threat intel
AbuseIPDB
Looks up IP address abuse confidence scores against AbuseIPDB during an investigation, with an in-memory cache and a conservative call rate.
Threat intel
AlienVault OTX
Indicators from the pulses your OTX account subscribes to, pulled on a schedule and matched against events and alerts.
Threat intel
Botvrij.eu
File fingerprints from incidents handled by EU CSIRTs, matched against process and file events from the sensor.
Threat intel
DigitalSide Threat-Intel
Malware URLs and domains from the DigitalSide archive, matched against DNS and HTTP events.
Threat intel
MISP (your own server)
Attributes from a MISP instance you or your ISAC run, pulled through the REST search endpoint and matched against events and alerts.
Threat intel
PhishTank
Human-verified phishing pages, matched against URLs seen in email security, proxy and DNS events.
Threat intel
Spamhaus DROP
Hijacked and criminal-controlled network ranges that should never be routed or peered, matched against connection events.
Threat intel
VirusTotal
Looks up file hashes, IPs, domains and URLs against VirusTotal during an investigation, with an in-memory cache and a conservative call rate so the free tier's limits are respected.
Threat intel
abuse.ch (URLhaus, ThreatFox, Feodo Tracker)
Malware distribution URLs, command-and-control indicators and banking-trojan C2 addresses from the abuse.ch projects, pulled on a schedule with no account needed.
Service management
Atlassian Cloud (Jira, Confluence)
SAML 2.0 single sign-on for Jira Software, Jira Service Management, and Confluence Cloud through Atlassian Guard. SCIM user provisioning from Qorionix is not available.
Service management
Zendesk
SAML 2.0 single sign-on for a Zendesk Support instance.
Vulnerability
Qualys VMDR
Imports vulnerability detections per host from Qualys VMDR into the XDR vulnerability findings table, resolving or creating an asset by hostname for hosts Qualys finds that have no Qorionix sensor.
Vulnerability
Rapid7 InsightVM
Imports vulnerability findings per asset from Rapid7 InsightVM into the XDR vulnerability findings table, resolving or creating an asset by hostname for hosts InsightVM finds that have no Qorionix sensor.
Vulnerability
Tenable Vulnerability Management
Imports open vulnerability findings per asset from Tenable.io scans into the XDR vulnerability findings table, resolving or creating an asset by hostname for hosts Tenable finds that have no Qorionix sensor.
Messaging
Google Chat
Posts Qorionix alerts into a Google Chat space as cards through an incoming webhook.
Messaging
Microsoft Teams
Posts Qorionix alerts into a Teams channel as Adaptive Cards through a Workflows or Office 365 connector webhook.
Log source
OpenTelemetry collector (OTLP/HTTP)
Point the log exporter of an OpenTelemetry collector you already run at Qorionix.
Network access
MikroTik RouterOS
Remote logging from RouterOS routers and switches, stored and searchable as generic syslog.
Network access
Sophos Firewall
Syslog from a Sophos Firewall (XG / XGS), stored and searchable as generic syslog.
Network access
Ubiquiti UniFi
Remote syslog from a UniFi gateway, switches and access points, stored and searchable as generic syslog.
Network access
pfSense / OPNsense
Remote syslog from pfSense or OPNsense firewalls, stored and searchable as generic syslog.
Productivity
Airtable
SAML sign-in to Airtable using the unique Entity ID and ACS URL for your identity-provider configuration.
Productivity
Asana
SAML single sign-on for an Asana organization with email identity and preconfigured service-provider endpoints.
Productivity
Canva Enterprise
SAML sign-in for a Canva Enterprise team with preconfigured email and profile attribute mappings.
Productivity
Figma
SAML sign-in for a Figma organization, with email identity and preconfigured profile attributes.
Productivity
Miro
SAML sign-in for Miro with profile names and organization-specific or regional endpoints.
Service management
Freshservice
Creates a Freshservice ticket per alert with severity mapped to priority and the fields rendered as a table in the ticket description.
Service management
Jira Cloud
Creates a Jira issue per alert with an Atlassian Document Format description, severity labels and project priority mapping.
Service management
Linear
SAML sign-in for a Linear workspace with email-based identity and mapped display names.
Service management
ServiceNow
Opens a ServiceNow incident per alert with impact and urgency derived from severity and a correlation ID so repeats update rather than duplicate.
Available means a configuration path exists. Beta capabilities have stated limitations. Planned capabilities cannot be configured yet. Open a profile to review each capability before connecting.