Schildmark DeutschFrançais Talk to sales
Menu

Integrations

Works with what you already run

31 integrations, each set up by an administrator in the console with a test before saving. Blocks means Schildmark can stop an address there. Data source means it reads events from it.

Firewalls

  • FortiGate
    Blocks addresses in an address group your deny policies use (FortiOS 6.4 or later). Logs by syslog. Docs
    BlocksData source
  • Sophos Firewall
    Blocks addresses in an IP host group your drop rules use. Logs by syslog. Docs
    BlocksData source
  • OPNsense
    Blocks addresses in an alias your block rules use. Logs by syslog. Docs
    BlocksData source
  • pfSense
    Logs by syslog. Blocking is not supported: pfSense has no official API. Docs
    Data source
  • Other firewalls, switches and routers
    Any device that sends syslog to UDP 514; the detection rules read the devices they know. Docs
    Data source

Cloud and edge

  • Amazon Web Services
    Blocks at AWS WAF (layer 7) and AWS Network Firewall (layer 3/4). Reads CloudTrail, GuardDuty, WAF, Inspector and Network Firewall logs. Docs
    BlocksData source
  • Google Cloud
    Blocks in a VPC network with firewall rules Schildmark manages. Reads Cloud Audit Logs and Security Command Center findings from Pub/Sub. Docs
    BlocksData source
  • Microsoft Azure
    Blocks addresses with Schildmark’s own deny rules in one network security group. Docs
    Blocks
  • DigitalOcean
    Blocks addresses with deny rules on the Cloud Firewall you name. Docs
    Blocks
  • Cloudflare
    Blocks or challenges addresses at the edge, and brings firewall and WAF events into the console. Docs
    BlocksData source

Identity and Microsoft 365

  • Microsoft 365 audit logs
    Sign-ins, Exchange, SharePoint and DLP events from the Office 365 Management API. Docs
    Data source
  • Microsoft Entra ID
    Single sign-on to the console; your MFA and access policies apply first. Docs
  • Okta
    Single sign-on to the console. Docs
  • Google Workspace
    Single sign-on to the console. Docs
  • Any OpenID Connect provider
    Single sign-on to the console. Docs

Endpoints and endpoint tools

  • Windows, macOS and Linux
    The Schildmark agent: logs, file integrity, configuration checks, inventory and vulnerable packages; patching with --patching. Docs
    Data source
  • Microsoft Defender for Endpoint
    Defender machines, vulnerabilities and alerts, and Microsoft security incidents. Docs
    Data source
  • Microsoft Intune
    Device compliance and inventory. Docs
    Data source
  • Sophos Central
    Sophos events and alerts, endpoints and outbreaks. Docs
    Data source
  • Suricata network sensor
    Network intrusion alerts from a sensor on your network; mutes are pushed to it. Docs
    Data source

Threat intelligence and vulnerability data

  • AbuseIPDB
    Reputation of addresses in alerts. Docs
    Enrichment
  • VirusTotal
    Reputation of addresses, domains and hashes. Docs
    Enrichment
  • AlienVault OTX
    Indicators from the OTX community. Docs
    Enrichment
  • MISP
    Your own MISP instance. Docs
    Enrichment
  • NVD
    Used to verify vulnerability findings; a key raises the rate limits. Docs
    Enrichment
  • CISA KEV
    Known exploited vulnerabilities go to the top of the investigation. Docs
    Enrichment

Mail, notifications and tickets

  • SMTP e-mail
    Health alerts, scheduled reports, scanner reports, policy notifications and password resets, through your mail server. Docs
    Notifications
  • Webhook
    The same health alerts as JSON, for your chat or on-call tool. Docs
    Notifications
  • Jira
    The analyst’s incidents synchronised to a Jira project every minute. Docs
    Notifications

AI and scanning

  • OpenAI-compatible model endpoint
    For the analyst: Azure OpenAI, vLLM, Ollama, Hugging Face’s router and others, or our hosted analyst. Docs
    Data source
  • External scanner
    Scheduled Nuclei scans of internet-facing hosts you are authorised to scan; private ranges are always refused. Docs
    Data source

Vendor connectors poll every 30 minutes by default. Values are applied by your stack within a minute; secrets are never shown again once saved.

Missing something?

Tell us which firewall, cloud or tool you need. Integrations are available on every plan.

Talk to salessales@schildmark.com