285+ connectors across the stack you already run.

1Password (Actions)

Run remediation actions on compromised 1Password users

1Password (Secrets)

Reference 1Password items in connectors and actions

1Password Audit Logs

Detect suspicious activity in your 1Password account

Abnormal Actions

Abnormal reports, remediation and lookups in workflows

Abnormal AI

Cloud email security telemetry from Abnormal AI

AbuseIPDB

Check IP reputation against AbuseIPDB from workflows

Adaptive Security

Phishing, training, and admin audit visibility

ADP

Configurable ADP event ingest, HR data removed

AegisAI

Email threat alerts and shadow IT applications

Akamai

CDN/WAF configuration and administrative audit events

Akamai Guardicore Segmentation

Guardicore Centra incidents and management audit log

Akeyless

Reference Akeyless secrets in connectors and actions

Amazon Managed Service for Prometheus

Query AMP metrics with PromQL during investigations

Anthropic Claude Compliance

Audit Claude activity across your Anthropic org

Anvilogic

Ingest Anvilogic alerts and search its data in place

Armis Centrix

Device inventory, alerts, and activities from Armis

Armis VIPR

Vulnerability report hunts and asset risk lookups

AusCERT

Member exposure notifications and leaked credentials

Auth0

Detect identity attacks in Auth0 tenants

Auth0 Directory Sync

Sync Auth0 users, roles, and orgs into inventory

Authenticated Indicator Feed

Sync a token-protected CSV or JSON indicator feed

Autotask PSA

Open Autotask tickets from workflows

AWS Athena

Query your S3 security data lake in place with Athena

AWS Bedrock Model Invocations

Detect prompt injection and abuse in AWS Bedrock

AWS Cloud Actions

Investigate GuardDuty, EC2, IAM; optional containment

AWS CloudTrail

Detect attacks across your AWS environment

AWS CloudWatch Logs (Pull)

Pull tagged CloudWatch log groups from your AWS account

AWS Environment & Cost Intelligence

AWS identities, resources, cost savings, and efficiency

AWS S3 Pull (From My Bucket)

Ingest logs from your S3 bucket

AWS S3 Push (To Artemis Bucket)

Push logs from any pipeline into Artemis

AWS S3 Writer

Write SOAR workflow outputs to your AWS S3 bucket

AWS Secrets Manager

Reference Secrets Manager secrets across Artemis

AWS Security Hub

Inspector CVEs, CSPM controls, and product alerts

AWS Security Lake

Detect and investigate using AWS Security Lake data

AWS SNS Sender

Publish case notifications to your AWS SNS topic

AWS SQS Sender

Send case notifications to your AWS SQS queue

AWS SSM Parameter Store

Reference SSM parameters in connectors and actions

Axiom

Federated APL queries against your Axiom datasets

Axonius

Federated asset enrichment during investigations

Azure Activity Logs

Detect attacks across your Azure subscriptions

Azure Blob Storage

Ingest logs from your Azure Blob Storage containers

Azure Environment & Cost Intelligence

Azure resources, RBAC, cost, and savings

Azure Event Hub

Azure resource diagnostic logs streamed via Event Hub

BambooHR Directory Sync

Enrich detections with BambooHR employee data

BigQuery

Run AI Mode SQL queries against Google BigQuery

Bitbucket Audit Log

Detect threats in your Bitbucket Data Center audit log

Bitbucket Repo Access

Read Bitbucket Cloud repos during investigations

BlinkOps

Trigger BlinkOps workflows from Artemis cases

BlueCat Address Manager

Daily IPAM inventory and transaction history

BlueCat Edge

BlueCat Edge DNS logs, audit trail and inventory

Bolster

Lookalike domains, takedowns and playbook findings

Box

Box audit trail and Shield threat detection alerts

Bucket Log Exporter

Deliver raw logs into a retention-locked bucket you own

Buildkite Audit Logs

Token, secret, pipeline and access changes

Carbon Black Actions

Run remediation actions on Carbon Black Cloud endpoints

Carbon Black Cloud

Detect endpoint threats with Carbon Black Cloud

Cato Networks Response Actions

Block IPv4 addresses and domains

Cato Networks SASE

Stream Cato SASE firewall, threat, CASB & SDP events

ChatGPT Enterprise Compliance

ChatGPT Enterprise audit, sign-ins and chat metadata

Check Point AI Guardrails (Lakera) Logs API

Guard screening logs for LLM apps and agents

Check Point Avanan (Legacy)

Legacy Avanan email security events via Smart API

Check Point Harmony Email & Collaboration

Email security events from Check Point Harmony

CISA AIS

Sync CISA Automated Indicator Sharing (AIS) indicators

Cisco Meraki Cloud

Collect Meraki audit, security and network events

ClickHouse

Federated read-only SQL queries against ClickHouse

Cloudflare Actions

Dispatch Cloudflare response actions from Artemis

Cloudflare Logs

Detect Cloudflare config changes and web attacks

Cloudflare WARP / Zero Trust

Detect threats across Cloudflare Zero Trust / WARP

Confluence

Ingest Confluence pages for investigation context

Constellix DNS

DNS zone change history and daily DNS inventory

Coralogix Events

Ingest Coralogix alert events for detection

Cribl Stream

Forward events from your Cribl pipeline to Artemis

CrowdStrike CSPM

Cloud posture and asset inventory from Falcon CSPM

CrowdStrike Falcon

Detect endpoint threats and hunt on Falcon Intelligence

CrowdStrike Falcon Actions

Run remediation actions on CrowdStrike Falcon

CrowdStrike Falcon NG-SIEM (Sending)

Send pipeline events to a Falcon NG-SIEM data connector

CrowdStrike NG-SIEM

Send cases to CrowdStrike and query NG-SIEM data

Cursor Audit Logs

Cursor organization, team, and Origin audit logs

Cursor Origin Repositories

Read-only Origin repository access for AI Mode

Custom MCP

Connect an MCP server to AI Mode and investigations

CyberArk Identity Security Platform Audit

Identity, Privilege Cloud and ITDR audit events

Cyberhaven

Ingest Cyberhaven DLP incidents and context

Cyble

Dark-web exposure alerts and IOC reputation

Cyble ThreatLens (Actions)

Analyze URLs and files with Cyble ThreatLens

Cyera

Surface DSPM findings and DLP incidents from Cyera

Cymulate

Breach-and-attack-simulation assessment results

Darktrace

Raw Darktrace breaches and AI Analyst incidents

Dashlane Audit Logs

Team audit activity from Dashlane

Dashlane Directory Sync

Sync Dashlane members, devices, and password health

Databricks Audit Logs

Detect threats across your Databricks workspaces

Datadog

AI-powered threat hunting over Datadog logs

depthfirst

Application security issues and user inventory

Device42

Look up CMDB assets and owners during investigations

DNSFilter Actions

Dispatch DNSFilter response actions from Artemis cases

DNSFilter Inventory Sync

Sync DNSFilter sites, policies, and roaming clients

DNSFilter Logs

Ingest DNSFilter DNS query and threat-block logs via S3

Doppel Alerts

Lookalike domains, phishing and impersonation alerts

Doppler Activity Logs

Audit changes to the workplace that holds your secrets

Duo Actions

Verify a person with a Duo MFA push from a workflow

Duo Authentication Logs

MFA authentication events from the Duo Admin API

Egencia Travel Sync

Enrich investigations with Egencia travel bookings

Elasticsearch

Connect Artemis to data in Elasticsearch

Email Listener

Inbound mailing-list inbox routed to SOAR workflows

Email Sender

Receive case notifications by email

Exabeam

Federated query + ingest from the Exabeam SIEM

Exterro FTK Central

FTK Central sign-ins and case and evidence activity

Exterro FTK Central Response Actions

Run FTK Central forensic collections from workflows

Feroot Security

Ingest client-side security findings from Feroot

Flashpoint

Ingest Flashpoint Ignite alerts for detection

Forescout

NAC events and device visibility from Forescout

Formal Audit Logs

Every query and command Formal proxied, and by whom

FortiMail / Perception Point Response

Email response through Perception Point and FortiMail

Freshservice Audit Logs

Detect threats in your Freshservice audit log

FS-ISAC Threat Intelligence

FS-ISAC member threat intelligence via TAXII

GCP Cloud Audit Logs

Detect attacks across your Google Cloud environment

GCP Environment & Cost Intelligence

GCP resources, IAM, billing, and savings

GitHub Audit Logs

Detect threats across your GitHub organization

GitHub Repo Access

Let Artemis read your repos during investigations

GitLab Audit Events

Detect threats across your GitLab instance

GitLab Repo Access

Read GitLab repos during AI Mode investigations

Glean

Permission-aware Glean knowledge in AI Mode

Gmail Workspace

Trigger SOAR workflows on inbound Gmail

Google Cloud Storage

Ingest logs from your Cloud Storage buckets

Google Gemini Audit

Gemini for Google Workspace usage audit logs

Google SecOps

Investigate using data in Google SecOps (Chronicle)

Google Sheets

Read a range from a Google Sheet in a workflow

Google Workspace Activity

Detect threats across Google Workspace

Google Workspace Directory Sync

Enrich detections with Google Workspace user context

Gorgias

Helpdesk admin, integration and ticket metadata changes

Grafana

Investigate using data in Grafana

Grip Security

Monitor SaaS risk with Grip alerts and inventory

Halcyon Anti-Ransomware

Detect ransomware activity with Halcyon alerts

HashiCorp Vault

Reference Vault secrets in connectors and SOAR actions

Have I Been Pwned

Breached accounts on your domains from HIBP

HEC Receiver

Send logs to Artemis from any HEC-compatible client

Horizon3 NodeZero

Ingest autonomous pentest results from NodeZero

HPE Aruba EdgeConnect SD-WAN

Orchestrator audit log, alarms and appliance inventory

HTTP Log Receiver

Send logs from any endpoint directly to Artemis

incident.io

Create incident.io incidents for security cases

Infoblox Threat Defense

Detect DNS threats blocked by Infoblox Threat Defense

IONIX

Exposure findings, audit logs, and asset inventory

Iru

Detect threats across your Apple device fleet

Island Browser Actions

Dispatch Island Enterprise Browser response actions

Island Enterprise Browser

Audit user activity in the Island browser

Jamf Pro

Track device security and admin activity in Jamf Pro

Jamf Protect

Ingest Jamf Protect telemetry, unified logs, and Alerts

Jira (Ticketing & Actions)

Create and manage Jira issues from cases and workflows

Jira Directory Sync

Sync Jira identities; query tickets in AI Mode

Joe Sandbox (Actions)

Detonate files and URLs in Joe Sandbox from workflows

JumpCloud Events

Detect identity attacks in JumpCloud tenants

Knostic Kirin

Security alerts from AI coding assistants and agents

KnowBe4 KMSAT

Security awareness and phishing simulation visibility

LDAP / Active Directory

Look up directory records during investigations

Linear

Create Linear issues from cases and workflows

Log File Collector

Read local text log files via the on-prem agent

LogRhythm

Federated query + ingest from on-prem LogRhythm SIEM

Looker

Detect threats in your Looker environment

Manual Log Upload

Upload a log file from your computer

Material Security

Email threats, DLP, app protection and audit events

Metabase Audit Logs

Monitor admin activity and data access in Metabase

Microsoft 365 Copilot Audit

Audit M365 Copilot, Copilot Studio, and Agent365

Microsoft 365 Response Actions

Remediate mailboxes and triage reported phishing

Microsoft Defender XDR

Detect threats across the Microsoft Defender suite

Microsoft Defender XDR Response Actions

Isolate hosts, collect evidence, update Defender alerts

Microsoft Edge for Business

Browser security events from Edge Reporting Connector

Microsoft Entra Directory Sync

Enrich detections with Entra ID user and group context

Microsoft Entra ID

Detect identity attacks in Microsoft Entra ID

Microsoft Intune Inventory

Enrich detections with Intune device posture

Microsoft O365 Directory Sync

Enrich detections with O365 user and group context

Microsoft O365 Email and Audit Logs

Detect attacks across Microsoft 365 email and apps

Microsoft Purview

Federated content search via Purview eDiscovery

Microsoft Sentinel

Investigate using data in Microsoft Sentinel

Microsoft Teams

Receive Teams case alerts and EI digests

Microsoft Teams Bot

Case cards, answers, and workflows in Teams

Mimecast

Admin audit and threat events from Mimecast

MISP Threat Intelligence

Threat-intel attributes (IOCs) from a MISP instance

monday.com

Call the monday.com API from a workflow

MuleSoft Anypoint Platform

Audit log, Mule application logs and API requests

MySQL

Run bounded read-only SQL against a MySQL database

Nagomi

On-demand asset exposure lookups during investigations

Netskope SSE

Stream Netskope SSE web, CASB, ZTNA & alert events

NetSuite

Collect NetSuite audit and role-permitted ERP data

Nightfall AI Sensitive Data Protection

Nightfall DLP findings via API or HEC webhook

Notifications Webhook

Send case alerts to any webhook endpoint

Notion Audit Logs

Detect threats in your Notion Enterprise workspace

Nozomi Vantage

OT/ICS alerts, vulnerabilities & session flows

Nucleus

Assets and vulnerability findings

Obsidian Security

SaaS threat alerts and activity from Obsidian

Okta (Actions)

Run remediation actions on compromised Okta users

Okta Directory Sync

Enrich detections with Okta user and group context

Okta EventBridge

Detect Okta identity attacks in real time

Onyx Security

Onyx audit logs, runtime alerts and AI activity

OpenAI Platform

Audit logs, usage, costs, and member roster from OpenAI

OpenCTI

OpenCTI lookups and threat Reports for applicable hunts

OpenSourceMalware

Malicious open-source packages and repos

OpenTelemetry (OTLP)

Send logs and metrics from any OTLP source to Artemis

Opsgenie

Page an on-call rotation from workflows

Orca Security

Surface cloud security alerts from Orca Security

PagerDuty

Trigger PagerDuty alerts for security cases

Palo Alto Cortex XDR

Investigate endpoint threats with Cortex XDR

Palo Alto Cortex XSIAM

Pull data and alerts from Palo Alto Cortex XSIAM

Palo Alto Cortex XSOAR

Create Cortex XSOAR incidents for security cases

Palo Alto Networks GlobalProtect VPN

GlobalProtect VPN logins and tunnels from PAN-OS

Palo Alto Networks NGFW

Block malicious IPs on your Palo Alto firewall

Palo Alto Networks WildFire (Actions)

WildFire verdicts and sandbox analysis from workflows

Palo Alto Strata Logging Service

Firewall logs forwarded by Strata Logging Service

Phorion

Detect macOS endpoint threats with Phorion

PingOne Identity

Detect identity attacks across your PingOne tenant

PlanetScale Audit Logs

Organization audit ingestion and federated search

PlanetScale Database

Query selected PlanetScale database tables in place

Proofpoint TAP

Email threat telemetry from Proofpoint TAP

Proofpoint Threat Response (TRAP / Cloud)

PTR/TRAP and Cloud Threat Response incidents

Qualys VMDR

Enrich investigations with vulnerability context

Ransomware.live

Ransomware-group IOCs for IOC matching

Rapid7 InsightVM

Enrich investigations with Rapid7 vulnerability context

Recorded Future

Ingest alerts and hunt with Recorded Future intel

Rippling Directory Sync

Employee directory sync from Rippling

Rippling MDM Inventory

Device inventory and MDM posture from Rippling

Rootly

Security alerts and audit events from Rootly

Salesforce

Salesforce login, EventLogFile, and audit ingest

SAP BTP Audit Logs

SAP BTP platform audit trail

SAP Concur

Enrich investigations with employee travel and expenses

Saviynt Enterprise Identity Cloud Audit Logs

Sign-ins, administrative actions and access changes

Scalefusion MDM

Device inventory and availability from Scalefusion

Scaleway Audit Trail

Scaleway Organization audit events

Scanner.dev

AI-driven federated log queries via Scanner.dev

SentinelOne

Detect endpoint threats with SentinelOne

SentinelOne Actions

Run remediation actions on SentinelOne endpoints

SentinelOne AI SIEM

Ingest firewall and SIEM logs from SentinelOne

ServiceNow ITSM Notifications

Create ServiceNow incidents for security cases

ServiceNow Logs

Ingest ServiceNow platform activity logs

Shopify Audit Logs

Admin and staff audit activity from Shopify

Slack

Surface Artemis signals in your Slack workspace

Slack Audit Logs

Audit Slack auth, file, and admin activity

SmartRecruiters Audit Logs

Sign-ins, admin changes and candidate data access

SmartRecruiters Directory Sync

Sync SmartRecruiters users, roles, and admin status

Snowflake

Connect Artemis to data in Snowflake and audit activity

Splunk

Connect Artemis to data in Splunk

Splunk HEC (Sending)

Configure an HEC sending connection for pipeline events

Splunk SOAR Actions

Read SOAR containers, notes, and evidence in workflows

Spur

Federated IP-context lookups via Spur

Statsig Audit Logs

Feature gate, experiment, key and member changes

StepSecurity

Detect supply-chain attacks on CI/CD runners

Stripe

Detect threats across your Stripe account

Sublime Security

Email security, audit logs and protected mailboxes

Sumo Logic

Connect Artemis to data in Sumo Logic

Swimlane

Trigger Swimlane playbooks from Artemis cases

Sysdig Secure

Runtime detections and platform audit logs

Syslog

Forward syslog data directly to Artemis

Tailscale

Detect threats across your Tailscale network

Tanium

Endpoint platform audit and Threat Response logs

Tenable

Enrich investigations with vulnerability context

Tenable Security Center

Vulnerability findings from on-prem Security Center

Thinkst Canary

Ingest Thinkst Canary deception alerts

ThreatER

Federated threat-intel lookups via ThreatER

ThreatLocker

Investigate ThreatLocker blocks and elevations

Tidal Cyber

Read-only queries of Enterprise defensive posture

Tines

Trigger Tines workflows from Artemis cases

Torq

Trigger Torq workflows from Artemis cases

Trend Micro Vision One

Trend Micro alerts, audit logs and endpoint inventory

Trino

Federated read-only SQL against Trino and Presto

TruffleHog

Exposed secret findings and source locations

Twingate

Detect threats across your Twingate network

Uptycs

Query Uptycs endpoint telemetry on demand

Upwind

Detect runtime threats and risks with Upwind

URLscan

IP, domain, and URL reputation lookups via URLscan

Valence Security

SaaS threat alerts and console audit logs

Vanta

Audit log and compliance test results from Vanta

Varonis

Ingest Varonis data-security alerts

Vector AWS S3 Sink

Forward logs from your Vector pipeline to Artemis

Vectra AI

Raw Vectra detections, scoring, and audits

Veracode

AppSec audit logs and vulnerability findings

Veza Audit Logs

Collect Veza administrative audit events

Veza Directory Sync

Sync identity-provider users and groups from Veza

VirusTotal

IP and domain reputation lookups via VirusTotal

VirusTotal (Actions)

Scan URLs and files with VirusTotal from workflows

watchTowr Platform

Attack surface exposures, activity and inventory

Webhook Receiver

Send events to Artemis from any webhook source

Windows Event Collector

Centralized Windows events via the on-prem agent

Wiz

Surface cloud issues and hunt on Wiz Threat Center

Workato Audit Logs

Detect risky Workato admin and config changes

Workday Directory Sync

Enrich detections with Workday employee data

WorkOS Audit Logs

Detect identity threats in your WorkOS environment

ZeroFox

Ingest ZeroFox external threat alerts for detection

Zoom

Detect threats across your Zoom organization

Zscaler Internet Access

Stream ZIA logs via Cloud NSS or a VM-based NSS feed