Skip to main content

Endpoint Management

Endpoint management integrations cover EDR, anti-malware and device-protection products — the agents installed on laptops, servers and browsers. They contribute two distinct kinds of data: high-value detections (the vendor's own alerts, already triaged and scored) and raw process, file and network telemetry from the agent. The detections give immediate coverage with modest volume; the raw telemetry is what makes retrospective hunting possible but is usually the largest feed in the environment, so most deployments start with alerts and add telemetry deliberately.

In this section​

  • Bitdefender GravityZone — console events over the Event Push Service API and raw endpoint telemetry from the agent, both delivered to a HEC endpoint.
  • CrowdStrike Falcon — Falcon alerts, streaming detection and audit events, and the host roster, via the CrowdStrike OAuth2 API.
  • Cylance — endpoint protection alerts and device events.
  • SentinelOne EDR — syslog export, API integration and Cloud Funnel telemetry.
  • Seraphic Browser Security — browser-level security events.
  • Sophos EDR — Sophos Central alerts and endpoint events over Sophos's public API.
  • ManageEngine — endpoint and IT operations audit trails over syslog.
  • PaloAlto Cortex XDR — Cortex XDR incidents and alerts via Palo Alto's public API.
  • TrendMicro VisionOne — Trend Vision One Workbench alerts and detection data over Trend's v3.0 API.
  • Symantec Endpoint Protection Manager — SEPM client and server logs exported as syslog by its External Logging feature.

Alerts versus raw telemetry​

Where a vendor offers both an alert stream and a full-telemetry stream, they are normally configured as separate sources so that retention and routing can differ.