Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Defend connects to other products in the platform to send and receive data. These integrations are built-in — there is no marketplace or plugin to install. Each integration is activated when the relevant product is enabled and properly configured.
RMM Integration
RMM is the primary source of endpoint telemetry and the target for response actions.
Inbound (RMM → Defend):
- Endpoint telemetry — RMM agents running on managed devices push process, network, and file events to Defend using an agent key. This data populates the endpoint event store and is used for detection rule matching and threat hunting.
- Software inventory / CVE match — RMM sends installed software inventory to Defend, which cross-references it against CVE feeds to populate vulnerability records per device.
Outbound (Defend → RMM):
Response actions taken from an incident in Defend are executed by sending commands to RMM:
| Action | What happens |
|---|---|
| Isolate device | Cuts network access to the device while keeping it manageable via RMM |
| Kill process | Terminates a process by PID on the target device |
| Forensics snapshot | Collects running processes, network connections, and open files from the device |
Response actions queue commands that execute on the device's next heartbeat. If the device is offline, the action will not complete until the device reconnects.
Defend agent (EDR)
Defend (EDR) is feature-flagged. When enabled, detection events from the Defend agent flow into the SIEM alert queue as alerts in the main queue. MITRE coverage data from Defend is aggregated in the Defend MITRE map.
EDR configuration (protection level, exclusions) is accessible through the Defend sub-product within the same platform. No separate connection step is needed — the integration is internal.
OnCall Integration
When an incident requires escalation to on-call rotation, the Escalate action in an incident can notify the on-call team. This uses the OnCall product's notification and rotation configuration. Ensure OnCall is configured with the appropriate schedules and contact methods before using this action.
PSA Integration
From an incident's Response panel, you can click Escalate to PSA to create a ticket in your connected PSA system. The ticket is pre-populated with:
- Incident title and severity
- Affected client org
- Link back to the Defend incident
- Current notes summary
PSA connection is configured in the platform's integration settings. Once active, it is available from all incidents.
Compliance evidence and CyberAssure
Defend's Prove → Compliance Evidence page checks SOC 2, HIPAA, PCI, NIST CSF, and CIS controls against Defend telemetry, and shows which controls have evidence and which have gaps. Framework programs, control mappings, assessments, and audits are in CyberAssure, not Defend. See Security reports and compliance evidence in Defend.
Notifications
Real-time alert notifications are available through Settings → Notifications. Supported channels:
- Microsoft Teams (via webhook)
- Slack (via webhook)
Configure one or more channels to receive notifications when critical alerts fire or incident status changes.
FAQ
Do I need to configure the RMM integration, or does it connect automatically? Endpoint telemetry flows automatically from RMM agents once devices are enrolled. The agent key is provisioned during org setup. Response actions (isolate, kill process, forensics) require that the device is online and the RMM agent is reporting.
Why did my isolate-device action not complete? Response actions are queued and run on the device's next heartbeat. If the device is offline or the RMM agent is not running, the action will not execute until connectivity is restored. Check device status in RMM.
Can I send Defend SIEM alerts to a third-party SIEM? Not directly through the built-in integrations. The real-time SSE stream (Alerts → Stream) is available for custom integrations that can consume server-sent events.