Works with what you already run.
No rip-and-replace. AIDR pulls from your SIEM, EDR, identity, and cloud — and pushes response actions back.
Ungated · browse freely
Pull everything. Push actions back.
Connects to what you already run.
107 connectors · 25 built-in threat intelligence sources · SIEM · Endpoint · Identity · Cloud · Network · Email · Vulnerability · XDR
Abnormal
Alert, User
AbuseIPDB
Threat Intelligence
IP
Akamai App & API Protector
Network
Alert
AlienVault OTX
Threat Intelligence
IP, Malware, URL, Vulnerability
Armis Centrix
Endpoint
Alert, Endpoint
AWS
Cloud
Alert, Dynamic Query, Endpoint, User, Vulnerability
Azure Cloud
Cloud
Alert, Dynamic Query, Endpoint, Vulnerability
Azure Data Explorer
SIEM
Dynamic Query
Barracuda Email Protection
Alert
BeyondTrust EPM
Endpoint
Alert
Bitdefender GravityZone
Endpoint
Alert, Endpoint, Vulnerability
Blocklist.de
Threat Intelligence
IP
Carbon Black Cloud
Endpoint
Alert, Endpoint
Cato Networks
Network
Alert, Dynamic Query, Endpoint, User
Check Point Harmony Email
Alert
Check Point Harmony Endpoint
Endpoint
Alert, Dynamic Query, Endpoint
Check Point Quantum
Network
Alert, Dynamic Query
CINS Army
Threat Intelligence
IP
CIRCL Hashlookup
Threat Intelligence
Malware
CISA KEV
Threat Intelligence
Vulnerability
Cisco Duo
Identity
Alert, User
Cisco ISE
Network
User
Cisco Meraki
Network
Alert, Endpoint
Cisco Secure Endpoint
Endpoint
Alert, Endpoint
Cisco Secure Firewall
Network
Alert, Dynamic Query, Endpoint
Cisco Umbrella
Network
Alert
Claroty xDome
Network
Alert, Endpoint
Cloudflare
Network
Alert, Dynamic Query, Endpoint, User
Code42
Endpoint
Alert, Dynamic Query, Endpoint, User
Corelight
Network
Alert, Dynamic Query
Cribl
SIEM
Dynamic Query
CrowdStrike
Endpoint
Alert, Dynamic Query, Endpoint, User, Vulnerability
CyberArk PAM
Identity
Alert
Cybereason
Endpoint
Alert, Endpoint
Darktrace
Network
Alert, Dynamic Query, Endpoint
Datadog Cloud SIEM
SIEM
Alert, Dynamic Query, Endpoint
DShield / SANS
Threat Intelligence
IP
Elasticsearch
SIEM
Alert, Dynamic Query, Endpoint, Vulnerability
ESET PROTECT
Endpoint
Alert, Endpoint, User
Exabeam
SIEM
Alert, Dynamic Query
ExtraHop
Network
Alert, Dynamic Query, Endpoint, User
eyeCloudXOAR
SIEM
Alert, Dynamic Query
F5 BIG-IP Advanced WAF
Network
Alert
F5 Distributed Cloud
Network
Alert
Feodo Tracker
Threat Intelligence
IP
FireHOL Level 1
Threat Intelligence
IP
Forcepoint DLP
Endpoint
Alert
FortiAnalyzer
SIEM
Alert, Dynamic Query
FortiGate
Network
Alert, Dynamic Query, Endpoint
FortiSIEM
SIEM
Alert
GitHub
Vulnerability
Vulnerabilities
Google Cloud SCC
Cloud
Alert, Endpoint, Vulnerability
Google Security Operations
SIEM
Alert, Dynamic Query
Google Workspace
Identity
Alert, Endpoint, User
Gophish
User
GreyNoise
Threat Intelligence
IP
Hunters
SIEM
Alert
Huntress
Endpoint
Alert, Endpoint
IBM QRadar
SIEM
Alert, Dynamic Query, Endpoint
Imperva Cloud WAF
Network
Alert
Infoblox
Network
Alert, Endpoint
IPinfo
Threat Intelligence
IP
Jamf Pro
Endpoint
Endpoint, User
Jamf Protect
Endpoint
Alert, Endpoint
Kaspersky Endpoint Security
Endpoint
Alert, Endpoint
KnowBe4 PhishER
Alert
Logpresso Sonar
SIEM
Alert
Malware
MalwareBazaar
Threat Intelligence
Malware
ManageEngine Endpoint Central
Endpoint
Alert, Endpoint, Vulnerabilities
ManageEngine Log360
SIEM
Alert
Microsoft Defender
Endpoint
Alert, Dynamic Query, Endpoint, User, Vulnerability
Microsoft Entra ID
Identity
Alert, Dynamic Query, User
Microsoft Sentinel
SIEM
Alert, Dynamic Query, User
Mimecast
Alert, User
MISP
Threat Intelligence
IP, Domain, URL, Malware
Alert, Endpoint
Netskope
Network
Alert, Dynamic Query, Endpoint, User
NetWitness
XDR
Alert, Dynamic Query, Endpoint
NIST NVD
Threat Intelligence
Vulnerability
Okta
Identity
Alert, User
OpenPhish
Threat Intelligence
URL
OpenSearch
SIEM
Alert, Dynamic Query
Orca Security
Cloud
Alert, Dynamic Query, Endpoint, Vulnerability
Osquery
Endpoint
Dynamic Query, Endpoint
Palo Alto Cortex
XDR
Alert, Dynamic Query, Endpoint
Palo Alto Networks Firewall
Network
Alert, Dynamic Query, Endpoint
Panther
SIEM
Alert, Dynamic Query
PhishTank
Threat Intelligence
URL
PingOne
Identity
Alert, User
Prisma Cloud
Cloud
Alert, Dynamic Query, Endpoint
Proofpoint TAP
Alert
Pulsedive
Threat Intelligence
URL
Qualys VMDR
Vulnerability
Endpoint, Vulnerability
Rapid7
SIEM
Alert, Dynamic Query, Endpoint, User
RunReveal
SIEM
Alert, Dynamic Query
Scanner
SIEM
Alert, Dynamic Query
Sekoia
XDR
Alert, Dynamic Query, Endpoint
SentinelOne
Endpoint
Alert, Dynamic Query, Endpoint, User, Vulnerability
Shodan
Threat Intelligence
IP
Silent Push
Threat Intelligence
IP, Domain
SonicWall
Network
Sophos
Endpoint
Alert, Dynamic Query, Endpoint, User
Sophos Firewall
Network
Response
Spamhaus DROP
Threat Intelligence
IP
Splunk
SIEM
Alert, Notable Events, Dynamic Query
Stellar Cyber
XDR
Alert, Dynamic Query, Endpoint
Sublime Security
Alert
Sumo Logic
SIEM
Alert, Dynamic Query, Endpoint, User
Symantec DLP
Endpoint
Alert
Symantec Endpoint Security
Endpoint
Alert, Endpoint
Sysdig
Cloud
Alert, Vulnerabilities
Tanium
Endpoint
Alert, Endpoint
Tenable Security Center
Vulnerability
Endpoint, Vulnerability
Tenable Vulnerability Management
Vulnerability
Endpoint, Vulnerability
TheHive
SIEM
Alert
ThreatDown Nebula
Endpoint
Alert, Endpoint
ThreatFox
Threat Intelligence
IP, Malware, URL
Tor Exit Nodes
Threat Intelligence
IP
Trellix ePO
Endpoint
Alert
Trellix Network Security
Network
Alert
Trend Vision One
XDR
Alert, Endpoint
Upwind
Cloud
Alert, Endpoint, Vulnerability
URLhaus
Threat Intelligence
Malware
Vectra AI
Network
Alert, Endpoint, User
Vega
SIEM
Alert
VirusTotal
Threat Intelligence
IP, Malware, URL
WAPPLES
Network
Alert
Wazuh
SIEM
Alert, Dynamic Query, Endpoint, Vulnerability
Wiz
Cloud
Alert, Endpoint, Vulnerability
Zscaler
Network
Endpoint, User
Zscaler Workflow Automation
Network
Alert
Don’t see your stack?
New connectors ship regularly — tell us what you run and we’ll confirm coverage.
We use analytics cookies to understand how the site is used. Essential cookies keep it working. Read our Cookie Policy.