Skip to main content

New Integration

New Integration is the second view of the Integrations page. It presents every integration type as a tile, grouped into categories; clicking a tile opens that type's Add dialog, and saving the dialog creates the integration.

New Integration view showing the integration type catalog grouped into ten category cards

The Catalog​

The catalog is a stack of cards, one per category, each holding the tiles for the types filed under it. Unlike the application template catalog, this view has no search box and the tiles are laid out five to a row. Most carry the service's icon; the five that do not — RESTAPI, Salesforce, Workday, Slack and PagerDuty — show their name alone.

The categories, in the order they appear:

CategoryTypesWhat they connect to
Cloud Storage2Object stores read directly.
AWS Services10AWS accounts, and the queues, streams and buckets inside them.
Office Software (SaaS) and IAM6Microsoft 365, Entra, Google Workspace and Duo tenants.
Cloud Infrastructure (IaaS)1Azure Event Hubs.
Endpoint Management12EDR/XDR and vulnerability-management consoles.
Email Audit and Protection4Email security gateways.
Cloud-based Network Services5Network and SASE platforms, plus two generic HTTP connectors.
Cloud-based Business Softwares4SaaS business applications.
System Notification Export3Outbound destinations for alerts and tickets.
On-Premise IT1A directory server reached through a collector.

The category names overlap the application catalog's but the sets do not match: Cloud Storage, Cloud-based Network Services and System Notification Export exist only here, and System Components exists only there.

The Add Dialog​

Clicking a tile opens a panel over the right of the page titled Add <type>. Every type's dialog has the same two sections and the same footer.

Add AWS S3 Bucket dialog showing the Details and Configurations sections, the Setup CloudFormation and Test Configuration buttons, and the Save button

SectionFields
DetailsName, required and empty — this is what the tile in Existing Integrations will be labelled with, and it cannot be changed afterwards. Description, optional. Configuration method, on the types that have more than one way in. Type, read-only and pre-set to the tile you clicked.
ConfigurationsThe type's own connection fields. Absent entirely on the two types that take none.

A Save button sits in the lower-right corner; the X in the title bar closes the dialog without creating anything. Required fields are marked with a red asterisk after the label.

Configuration method​

Configuration method is a drop-down in Details, above the read-only Type, and it appears on fourteen of the 48 types. It selects how the credential is obtained rather than what the credential is, so changing it changes which fields Configurations shows:

  • Nine of the ten AWS Services types open on EC2 Instance IAM Role. AWS User is the exception: it takes a long-lived key pair rather than assuming a role, so there is nothing to choose.
  • Office365, ResourceWatch, Azure AD Audit and Azure AD Action open on Send Invitation, and in that state ask for nothing but an administrator's Email — the equivalent of the Enable Admin Consent Mode checkbox on the Microsoft application templates.
  • Google Workspace opens on Manual, and asks for the admin address and the service-account key directly.

The remaining 34 types have no such row: there is one way to connect them, and Configurations asks for it.

Some types add an action button above Save, in the body of the dialog rather than the footer strip:

  • Setup CloudFormation (blue) — on all ten AWS Services types. It is the route to creating the IAM role the integration will assume, rather than pasting an access key.
  • Test Configuration (green) — on AWS S3 Bucket and LDAP, and on no other type: those two are the only ones that can prove the connection before it is saved.

Create Plugin Datasource​

Most types end their Configurations section with a Create Plugin Datasource checkbox, unticked. Ticking it makes the save build the pipeline's data source at the same time as the integration, instead of leaving the integration for a pipeline to be pointed at later — which is the shortcut for an integration created here rather than by an application install.

The types that offer it are Google Workspace, Duo, Azure EventHubs, all of Endpoint Management except Palo Alto Cortex and Bitdefender, all of Email Audit and Protection, all of Cloud-based Business Softwares, and LDAP — 22 of the 48. The AWS, Cloud Storage, network-service and notification types have no such checkbox, and neither do the four Microsoft Send Invitation types.

note

Fields below are required unless marked optional. A value shown in italics is a real value the field opens with; a value shown in code is grey placeholder text, which the field does not submit unless you type it. Labels are reproduced exactly as the interface renders them.

Cloud Storage​

Neither type in this category has a Configuration method row or a Create Plugin Datasource checkbox.

Azure Blob​

  • Storage Account
  • Container
  • Authentication Method (optional) — drop-down, Service Principal
  • Tenant ID
  • Client ID
  • Client Secret

The three credential fields are the ones the Service Principal method needs; Authentication Method is the only drop-down here that changes them.

Add Azure Blob dialog

Google Cloud Storage​

  • Bucket
  • Mode — drop-down, Select a value
  • Prefix (optional)
  • Target Service Account (optional)
  • Secret Account Key (optional) — a multi-line box, sized for a pasted service-account key file

Add Google Cloud Storage dialog

AWS Services​

Every type here carries a blue Setup CloudFormation button, and every one but AWS User opens with Configuration method set to EC2 Instance IAM Role and asks for a Role rather than for keys. The Region / Regions and Role drop-downs are populated from what the platform already knows: Role lists the AWS roles registered on this page, which is the same list the Pre-defined AWs Role parameter offers on the AWS application templates.

AWS API​

  • Account ID
  • Policy Template — drop-down, None
  • Regions — multi-select drop-down, Select Values
  • Role — drop-down, Select a value

The account-level type: where the other nine name one queue, stream, bucket or function, this one registers the account and the role to assume in it. Policy Template is what Setup CloudFormation builds the role from.

Add AWS API dialog

AWS GuardDuty​

  • Regions — multi-select drop-down, Select Values
  • Role — drop-down

Add AWS GuardDuty dialog

AWS EC2 Audit​

  • Regions — multi-select drop-down, Select Values
  • Role — drop-down

The same two fields as AWS GuardDuty; the type is what decides which API is polled.

Add AWS EC2 Audit dialog

AWS Kinesis​

  • Stream Name
  • Region — drop-down
  • Mode — drop-down
  • Role — drop-down

Add AWS Kinesis dialog

AWS Firehose​

  • Stream Name
  • Region — drop-down
  • Role — drop-down

AWS Kinesis without the Mode field.

Add AWS Firehose dialog

AWS Lambda​

  • Function Name
  • Region — drop-down
  • Role — drop-down

Add AWS Lambda dialog

AWS S3 Bucket​

  • Region — drop-down
  • Bucket
  • Mode — drop-down
  • Prefix (optional)
  • Begin (optional)
  • End (optional)
  • Role — drop-down

The longest form in this category, and one of the only two types in the catalog with a green Test Configuration button — here beside Setup CloudFormation. Prefix, Begin and End bound which objects in the bucket are read, the same way the S3 object prefix / begin / end parameters do on the S3 import templates.

Add AWS S3 Bucket dialog

AWS SQS​

  • Region — drop-down
  • URL
  • Mode — drop-down
  • Role — drop-down

Add AWS SQS dialog

AWS S3 w/ SQS​

  • Queue URL
  • Queue ARN
  • Region — drop-down
  • Role — drop-down

The type behind the AWS templates that take an SQS notification queue url — the bucket is discovered from the notifications rather than named, which is why there is no bucket field.

Add AWS S3 w/ SQS dialog

AWS User​

  • Account ID
  • User
  • Access Key
  • Secret Key

The one type in this category with no Configuration method row and no Role field: it is the long-lived-key alternative to the role-assumption types above. It keeps the Setup CloudFormation button all the same.

Add AWS User dialog

Office Software (SaaS) and IAM​

Office365​

Configuration method — drop-down, Send Invitation

  • Email

In the Send Invitation state the whole connection is one address: the platform mails an administrator a consent request rather than taking a client secret. This is the integration-level equivalent of leaving Enable Admin Consent Mode ticked on the Office365 template.

Add Office365 dialog

ResourceWatch​

Configuration method — drop-down, Send Invitation

  • Email

Add ResourceWatch dialog

Azure AD Audit​

Configuration method — drop-down, Send Invitation

  • Email

Add Azure AD Audit dialog

Azure AD Action​

Configuration method — drop-down, Send Invitation

  • Email

The four Microsoft types share one form. Azure AD Action is the only one of them with no application template behind it: where the other three collect audit data, this one is the outbound half, for the response actions an alert action takes against a directory.

Add Azure AD Action dialog

Google Workspace​

Configuration method — drop-down, Manual

  • Admin User Email
  • Secret Account Key — a multi-line box, sized for a pasted service-account key file
  • Create Plugin Datasource (optional) — checkbox, unticked

A dark circular ? button sits below the checkbox — the only type in the catalog with inline help on its dialog.

Add Google Workspace dialog

Duo​

  • API Hostname
  • Integration Key
  • Secret Key
  • Create Plugin Datasource (optional) — checkbox, unticked

The three fields the Cisco Duo Admin API template asks for, under shorter labels.

Add Duo dialog

Cloud Infrastructure (IaaS)​

Azure EventHubs​

  • Description (optional) — an editable field, distinct from the Description in Details above it
  • Consumer Group (optional)
  • Container Name (optional)
  • Endpoint
  • Storage Endpoint (optional)
  • Create Plugin Datasource (optional) — checkbox, unticked

The same five settings as the Azure Event Hubs template, reordered: the required Endpoint is fourth here rather than first.

Add Azure EventHubs dialog

Endpoint Management​

Every type here ends with a Create Plugin Datasource checkbox except Palo Alto Cortex and Bitdefender.

Darktrace​

  • URL
  • Public Token
  • Private Token
  • Create Plugin Datasource (optional) — checkbox, unticked

No application template covers Darktrace, so this dialog is the whole platform-side setup.

Add Darktrace dialog

Defender ATP​

  • Client ID
  • Tenant ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

Add Defender ATP dialog

MS Defender​

  • Client ID
  • Tenant ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

Add MS Defender dialog

MS Defender Endpoint​

  • Client ID
  • Tenant ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

Three Defender types, one identical form, three different APIs behind it. The dialogs cannot be told apart on their fields, only on the Type value and the title — so the Name you give an integration is the only thing that will distinguish them in the Existing Integrations list.

Add MS Defender Endpoint dialog

Falcon​

  • Client ID
  • Base URL
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

Base URL is CrowdStrike's per-cloud API host, as on the CrowdStrike Falcon template.

Add Falcon dialog

Qualys​

  • URL
  • Username
  • Password
  • Create Plugin Datasource (optional) — checkbox, unticked

Add Qualys dialog

Sophos​

  • Client ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

Add Sophos dialog

TenableCloud​

  • Access Key
  • Secret Key
  • Create Plugin Datasource (optional) — checkbox, unticked

Another type with no application template behind it.

Add TenableCloud dialog

Palo Alto Cortex​

  • API URL
  • API Key ID
  • Auth Mode — drop-down, Advanced
  • API Key

The PaloAlto Cortex XDR template renders the same setting as a free-text AuthMode field pre-filled with advanced; here it is a proper drop-down. One of the two types in this category with no Create Plugin Datasource checkbox.

Add Palo Alto Cortex dialog

SentinelOne​

  • BaseURL
  • Account IDs (optional) — multi-select drop-down
  • Site IDs (optional) — multi-select drop-down
  • API Token
  • Create Plugin Datasource (optional) — checkbox, unticked

Account IDs and Site IDs narrow collection to part of a console; left unset, it covers the whole one. Neither has an equivalent on the SentinelOne API Integration template, so scoping a template-installed SentinelOne source means editing its integration in Existing Integrations afterwards.

Add SentinelOne dialog

SentinelOne Events​

  • BaseURL
  • Account IDs (optional) — multi-select drop-down
  • Site IDs (optional) — multi-select drop-down
  • API Token
  • Create Plugin Datasource (optional) — checkbox, unticked

Identical to SentinelOne. The pair is the resource dump and the event feed, and one SentinelOne API Integration application creates one of each.

Add SentinelOne Events dialog

Bitdefender​

The same three settings as the Bitdefender EventPush template, which calls them Company ID, Access URL and API Key. No Create Plugin Datasource checkbox.

Add Bitdefender dialog

Email Audit and Protection​

Abnormal Security​

  • Token
  • Create Plugin Datasource (optional) — checkbox, unticked

Add Abnormal Security dialog

Mimecast​

  • Base URL
  • Application ID
  • Application Key
  • Access Key
  • Secret Key
  • Create Plugin Datasource (optional) — checkbox, unticked

The API 1.0 credential set, as on the Mimecast Events (Legacy) template.

Add Mimecast dialog

Mimecast CG​

  • Client ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

Add Mimecast CG dialog

Proofpoint​

  • Principal
  • Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

One type serves both Proofpoint templates. It has no endpoint-URL field, where Proofpoint Essentials and Proofpoint TAP each default one.

Add Proofpoint dialog

Cloud-based Network Services​

Cato Networks​

No configuration. The dialog holds Details only — Name, Description, Type — and then Save; there is no Configurations section at all.

Add Cato Networks dialog

Cloudflare Log Push​

No configuration, the same shape as Cato Networks. Both are push-side integrations: the vendor is configured to send to the platform, so there is nothing for the platform to authenticate outbound.

Add Cloudflare Log Push dialog

  • Base URL
  • Organization
  • Organization ID
  • Group
  • Group ID
  • Client ID
  • Client Secret

Seven required fields, the longest all-required form in the catalog. The name and the ID are asked for separately for both the organisation and the group. This is the InControl cloud API, not the Peplink Router/Firewall Syslog template, which takes syslog from the device instead.

Add Peplink InControl dialog

RESTAPI​

  • Authentication (optional) — drop-down, Basic
  • Method (optional) — drop-down, GET
  • URL
  • Path (optional)
  • Encoding (optional) — drop-down, JSON
  • Timeout (seconds) — 30
  • Skip Verification (optional) — checkbox, unticked
  • Environmental Variables (optional) — a + Add New Variable button that adds rows
  • HTTP Headers (optional) — a + Add New HTTP Headers button that adds rows

The generic HTTP client, for a service with no type of its own. It is the only dialog in the catalog with repeatable rows: Environmental Variables and HTTP Headers each start as a dashed + Add button and grow a row per click. Skip Verification turns off TLS certificate checking.

Add RESTAPI dialog

Prometheus Push​

  • URL
  • Flush Interval (seconds) (optional) — 60
  • Authorization (optional) — drop-down, Basic
  • Username
  • Password

The outbound counterpart to RESTAPI: it pushes the platform's own metrics to a Prometheus endpoint on the interval named here. See Metrics Alerts for what those metrics are.

Add Prometheus Push dialog

Cloud-based Business Softwares​

Every type in this category ends with a Create Plugin Datasource checkbox.

BlackKite​

  • Client ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

No Company ID field, where the BlackKite Findings template has an optional one for narrowing collection to a single monitored company.

Add BlackKite dialog

Okta​

  • Domain
  • Token
  • Create Plugin Datasource (optional) — checkbox, unticked

Add Okta dialog

Salesforce​

  • Base URL
  • Client ID
  • Client Secret
  • Create Plugin Datasource (optional) — checkbox, unticked

The Salesforce Event Monitoring template calls the same three fields API URL, Consumer Key and Consumer Secret.

Add Salesforce dialog

Workday​

  • Host — placeholder wd5-impl-services1.workday.com
  • Tenant
  • Client ID
  • Client Secret
  • Refresh Token
  • Create Plugin Datasource (optional) — checkbox, unticked

Host is the one field in the catalog with an example host as placeholder text: it shows the pod-host shape the Workday Events template describes in prose. Grey placeholder text is not a value — the field is still empty and still required.

Add Workday dialog

System Notification Export​

The three outbound types. None has a Create Plugin Datasource checkbox — there is no data source to create, because these carry alerts and tickets out rather than events in. They are the destinations behind Alerts and Actions and Notifications.

Slack​

  • Token

The smallest dialog in the catalog: a name and a token.

Add Slack dialog

PagerDuty​

  • Events API URL — placeholder https://events.pagerduty.com/v2/enqueue
  • Integration Key

The endpoint is required but opens empty, with PagerDuty's standard Events API v2 URL shown as grey placeholder text — type it in rather than assuming it is already set.

Add PagerDuty dialog

ServiceNow​

  • URL
  • Incident Table
  • Username
  • Password

Incident Table is the ServiceNow table tickets are written to, which is why it is required rather than defaulted — an instance with a customised incident table would otherwise fail silently.

Add ServiceNow dialog

On-Premise IT​

LDAP​

  • Collector — drop-down, Select a value
  • Server IP
  • Server Port — 389
  • Base DN
  • Username
  • Password
  • Create Plugin Datasource (optional) — checkbox, unticked

The only type reached through a collector rather than from the platform, which is what the Collector drop-down selects — it lists the collectors registered under Platform → Administration → Collectors. One of the only two types in the catalog with a green Test Configuration button, which is worth using here: an unreachable directory server or a wrong bind DN is otherwise only visible once the pipeline runs.

The LDAP Connector template asks for the same six values under longer labels, and creates this integration for you.

Add LDAP dialog