Security connects to other products in the platform to send and receive data. These integrations are built-in — there is no marketplace or plugin to install. Each integration is activated when the relevant product is enabled and properly configured.
RMM Integration
RMM is the primary source of endpoint telemetry and the target for response actions.
Inbound (RMM → Security):
- Endpoint telemetry — RMM agents running on managed devices push process, network, and file events to Security using an agent key. This data populates the endpoint event store and is used for detection rule matching and threat hunting.
- Software inventory / CVE match — RMM sends installed software inventory to Security, which cross-references it against CVE feeds to populate vulnerability records per device.
Outbound (Security → RMM):
Response actions taken from an incident in Security are executed by sending commands to RMM:
| Action | What happens |
|---|---|
| Isolate device | Cuts network access to the device while keeping it manageable via RMM |
| Kill process | Terminates a process by PID on the target device |
| Forensics snapshot | Collects running processes, network connections, and open files from the device |
Response actions queue commands that execute on the device's next heartbeat. If the device is offline, the action will not complete until the device reconnects.
Defend Integration
Defend (EDR) is feature-flagged. When enabled, detection events from Defend flow into Security as alerts in the main queue. MITRE coverage data from Defend is aggregated in the Security MITRE map.
EDR configuration (protection level, exclusions) is accessible through the Defend sub-product within the same platform. No separate connection step is needed — the integration is internal.
OnCall Integration
When an incident requires escalation to on-call rotation, the Escalate action in an incident can notify the on-call team. This uses the OnCall product's notification and rotation configuration. Ensure OnCall is configured with the appropriate schedules and contact methods before using this action.
PSA Integration
From an incident's Response panel, you can click Escalate to PSA to create a ticket in your connected PSA system. The ticket is pre-populated with:
- Incident title and severity
- Affected client org
- Link back to the Security incident
- Current notes summary
PSA connection is configured in the platform's integration settings. Once active, it is available from all incidents.
Compliance Integration
Security and Compliance share the same underlying service. Incidents in Security can be promoted to compliance findings, linking them to specific framework controls. MITRE technique IDs on incidents are automatically mapped to NIST control categories where a mapping exists.
Access compliance data from the Compliance section in the Security navigation. See Reports and Compliance for the full workflow.
Notifications
Real-time alert notifications are available through Settings → Notifications. Supported channels:
- Microsoft Teams (via webhook)
- Slack (via webhook)
Configure one or more channels to receive notifications when critical alerts fire or incident status changes.
FAQ
Do I need to configure the RMM integration, or does it connect automatically? Endpoint telemetry flows automatically from RMM agents once devices are enrolled. The agent key is provisioned during org setup. Response actions (isolate, kill process, forensics) require that the device is online and the RMM agent is reporting.
Why did my isolate-device action not complete? Response actions are queued and run on the device's next heartbeat. If the device is offline or the RMM agent is not running, the action will not execute until connectivity is restored. Check device status in RMM.
Can I send Security alerts to a third-party SIEM? Not directly through the built-in integrations. The real-time SSE stream (Alerts → Stream) is available for custom integrations that can consume server-sent events.