INTEGRATIONS

Connect once.
Defend everything.

200+ pre-built integrations across cloud, identity, endpoint, network, and email — plus an open API for whatever you've built yourself.

THE DIRECTORY

Every surface, already covered.

VIEW ALL 200+
{{ cat.label }}{{ cat.count }}
{{ name }}
HOW IT CONNECTS

Telemetry in. Graph out. Minutes, not weeks.

No parsers to write, no schema to maintain. Authorize a source and it normalizes into the same entity graph everything else lives in.

01 / CONNECTOAUTH

Authorize the source

OAuth, API key, or role assumption — pick a connector and grant read access. No agents to roll out.

02 / NORMALIZEOCSF

Mapped to one schema

Every event is normalized to a common model and resolved to the entities it touches — host, identity, asset.

03 / CORRELATELIVE

Live in the graph

The moment data lands it's correlated against every other surface — detections light up across sources, not within one.

BUILD YOUR OWN

An open API for everything else.

REST and streaming APIs, signed webhooks, and a typed SDK. If it emits telemetry, threatDefendr can watch it — and act on it.

Streaming ingest & bulk REST endpoints
Signed webhooks for response automation
Typed SDKs for Python, Go, and TypeScript
Read API docs
connect.sh
# add a connector
POST /v2/connectors
{ "type": "okta", "stream": "system_log" }
→ 200 · ingesting in 4s
# subscribe to detections
td.events.stream({ surface: "identity" })
.on("detection", isolateHost)
// INTEGRATIONS

Connect once.
Defend everything.

200+ pre-built integrations across cloud, identity, endpoint, network, and email — plus an open API for whatever you've built yourself.

// THE DIRECTORY

Every surface, already covered.

VIEW ALL 200+
{{ cat.label }}{{ cat.count }}
{{ name }}
// HOW IT CONNECTS

Telemetry in. Graph out. Minutes, not weeks.

No parsers to write, no schema to maintain. Authorize a source and it normalizes into the same entity graph everything else lives in.

01 / CONNECTOAUTH

Authorize the source

OAuth, API key, or role assumption — pick a connector and grant read access. No agents to roll out.

02 / NORMALIZEOCSF

Mapped to one schema

Every event is normalized to a common model and resolved to the entities it touches — host, identity, asset.

03 / CORRELATELIVE

Live in the graph

The moment data lands it's correlated against every other surface — detections light up across sources, not within one.

// BUILD YOUR OWN

An open API for everything else.

REST and streaming APIs, signed webhooks, and a typed SDK. If it emits telemetry, threatDefendr can watch it — and act on it.

Streaming ingest & bulk REST endpoints
Signed webhooks for response automation
Typed SDKs for Python, Go, and TypeScript
Read API docs
connect.sh
# add a connector
POST /v2/connectors
{ "type": "okta", "stream": "system_log" }
→ 200 · ingesting in 4s
# subscribe to detections
td.events.stream({ surface: "identity" })
.on("detection", isolateHost)