Integrations
IronSOC plugs into the SIEM, EDR, identity, cloud, AI, ticketing, and exposure tools modern security teams use. Names below reflect supported targets — verify status with your account team during scoping.
Built and maintained directly.
Supported via documented APIs.
Ingested or emitted via open standards.
Targeted next.
The SIEM loop
Splunk, Elastic, Sentinel, or any OCSF-speaking tool posts its native webhook payload to POST /api/ingest — the adapters understand each vendor's actual format. Live on this site today.
Each alert is normalized, scored against the per-actor baseline the system learns automatically, and routed: auto-close, analyst, auto-contain — with 10% of closes trickled to human audit.
The decision and evidence land where your team works: the alert is closed or escalated in the SIEM with the trace attached, a ticket opens in Jira or ServiceNow, a summary posts to Slack or Teams.
# Point a Splunk alert-action webhook at the live pipeline:
curl -s 'https://ironsoc.com/api/ingest?source=splunk' \
-H 'content-type: application/json' \
-d '{"search_name":"Agent tool-call anomaly","result":{"user":"svc-agent-01","urgency":"high","_raw":"tool=shell.exec after retrieved doc said ignore previous instructions"}}'
# → {"route":"auto_contain","score":0.878,"trace":{...}} · sources: splunk | elastic | sentinel | ocsf | genericHonesty note: the ingest and triage APIs above are live; write-back connectors (closing the alert in your SIEM, opening the ticket) are wired during design-partner onboarding, in the order the table below reflects. Nothing here bills on ingest — your SIEM keeps the data, IronSOC returns decisions.
IronSOC operates above your data layer. We read normalized telemetry and write enrichments and decisions back.
Capture process, file, and host telemetry; orchestrate isolation and policy actions through approval gates.
Identity is the perimeter. We watch sessions, role grants, MFA drift, OAuth grants, and service accounts.
Detect IAM mutations, public exposure, admin events, CI/CD actions, Kubernetes activity, and SaaS integrations.
Treat prompts, retrieved context, tool calls, and agent decisions as first-class telemetry.
Consume firewall, VPN, proxy, and edge logs to correlate exploitation against KEV-listed exposure.
Open evidence-rich cases and route remediation to the right owners with bidirectional state sync.
Notify the right humans, capture analyst decisions inline, and keep the audit trail with the case.
Combine scanner findings with KEV, EPSS, exposure, and asset criticality to drive exploit-aware queues.
Standards
Where a vendor is missing, IronSOC reads and writes the same standards your team already uses. That keeps the ecosystem portable as the market consolidates.
Detections are versioned, reviewed, evaluated against test fixtures, and deployed through CI. Customers can fork, extend, and contribute back without leaving their own change-management process.
Missing yours?
If a system in your stack is not listed, IronSOC either ships an integration on roadmap or partners on a webhook bridge. We tell you which before contracting.
Request an integration