Integrations
IronSOC plugs into the SIEM, EDR, identity, cloud, AI, ticketing, and exposure tools modern security teams use. Names below reflect supported targets — verify status with your account team during scoping.
Built and maintained directly.
Supported via documented APIs.
Ingested or emitted via open standards.
Targeted next.
IronSOC operates above your data layer. We read normalized telemetry and write enrichments and decisions back.
Capture process, file, and host telemetry; orchestrate isolation and policy actions through approval gates.
Identity is the perimeter. We watch sessions, role grants, MFA drift, OAuth grants, and service accounts.
Detect IAM mutations, public exposure, admin events, CI/CD actions, Kubernetes activity, and SaaS integrations.
Treat prompts, retrieved context, tool calls, and agent decisions as first-class telemetry.
Consume firewall, VPN, proxy, and edge logs to correlate exploitation against KEV-listed exposure.
Open evidence-rich cases and route remediation to the right owners with bidirectional state sync.
Notify the right humans, capture analyst decisions inline, and keep the audit trail with the case.
Combine scanner findings with KEV, EPSS, exposure, and asset criticality to drive exploit-aware queues.
Standards
Where a vendor is missing, IronSOC reads and writes the same standards your team already uses. That keeps the ecosystem portable as the market consolidates.
Detections are versioned, reviewed, evaluated against test fixtures, and deployed through CI. Customers can fork, extend, and contribute back without leaving their own change-management process.
Missing yours?
If a system in your stack is not listed, IronSOC either ships an integration on roadmap or partners on a webhook bridge. We tell you which before contracting.
Request an integration