CyberStitch.
Get Started

THE CONNECTOR ECOSYSTEM

Your environment.
Already in the conversation.

Connect to the infrastructure and tools that know your world. Normalize their observations into a shared operational model.

31 connector packages2 built-in integrations

Showing 33 of 33 integrations

Cisco IOS

NETWORK

IOS and Catalyst device health, configuration evidence, and interface activity.

Connector package
Capabilities & access
  • SSH observations, diagnostic show commands, and security baseline audits.
  • Supported security controls and site configuration changes with approval and verification.

Access / format: SSH · SNMP

Juniper Junos

NETWORK

Junos and SRX operational state, configuration audits, and interface telemetry.

Connector package
Capabilities & access
  • Read validated show commands for routing, chassis, VPN, and security evidence.
  • Apply supported, approval-controlled management security settings.

Access / format: SSH · SNMP

Aruba AOS-Switch

NETWORK

AOS-Switch / ProVision inventory, health, configuration, and security posture.

Connector package
Capabilities & access
  • Read SSH show commands, configuration baselines, and structured audits.
  • Collect IF-MIB interface traffic, errors, and operational state over SNMPv2c.

Access / format: SSH · SNMPv2c

Aruba EdgeConnect

NETWORK

Physical and virtual EdgeConnect ECOS appliance health and SD-WAN observations.

Connector package
Capabilities & access
  • Inspect tunnels, IPsec, traffic, licensing, certificates, and management security over SSH.
  • Collect SNMPv2c interface counters and supported baseline evidence.

Access / format: SSH · SNMPv2c

Forcepoint NGFW

SECURITY

NGFW engine health, policy state, routing, cluster status, and interface activity.

Connector package
Capabilities & access
  • Run fixed, read-only SSH diagnostics and security baseline checks.
  • Collect SNMP v1/v2c/v3 interface counters, errors, discards, and link state.

Access / format: SSH · SNMPv1 · SNMPv2c · SNMPv3

Netgate pfSense Plus

SECURITY

pfSense Plus health, firewall and VPN state, sanitized configuration, and interface telemetry.

Connector package
Capabilities & access
  • Read fixed SSH diagnostics and collect SNMP v1/v2c/v3 interface counters.
  • Support guarded service restarts and firmware upgrades with explicit preflight checks and confirmations.

Access / format: SSH · SNMPv1 · SNMPv2c · SNMPv3

Gigamon

NETWORK

Packet broker identity, health, interface observations, and security baseline evidence.

Connector package
Capabilities & access
  • Read supported CLI diagnostics, routes, neighbors, logs, and configuration audits.
  • Collect IF-MIB interface activity through SNMP.

Access / format: SSH · SNMP · Telnet

Windows Admin Center

COMPUTE

Windows server, cluster, and Hyper-V observations through a Windows Admin Center gateway.

Connector package
Capabilities & access
  • Discover registered connections and inspect gateway, server, security, update, and VM health.
  • Read performance, event, certificate, and bounded CIM evidence with fixed PowerShell scripts.

Access / format: HTTPS · WAC gateway

Microsoft Graph · Entra Security

CLOUD & IDENTITY

Entra identity inventory, sign-ins, directory audits, access policy, and identity risk evidence.

Connector package
Capabilities & access
  • Read users, groups, devices, applications, service principals, grants, and role assignments.
  • Inspect Conditional Access, authentication registration, risky identities, and risk detections.

Access / format: Microsoft Graph v1.0 · HTTPS · OAuth 2.0

Microsoft Graph · Defender XDR

SECURITY

Defender incidents, alerts, Secure Score, identity health, and Advanced Hunting evidence.

Connector package
Capabilities & access
  • Read incidents, alerts, score controls, Defender for Identity sensors, and health issues.
  • Run a supplied, bounded KQL query through Graph Advanced Hunting.

Access / format: Microsoft Graph v1.0 · HTTPS · OAuth 2.0 · KQL

Microsoft Graph · Intune

ENDPOINT

Intune managed device inventory, compliance policy, configuration, and detected application evidence.

Connector package
Capabilities & access
  • Read managed devices, compliance policies, and device configuration policies.
  • Inspect detected applications and Windows Autopilot device identities.

Access / format: Microsoft Graph v1.0 · HTTPS · OAuth 2.0

Microsoft Graph · Microsoft 365 Health

CLOUD & IDENTITY

Microsoft 365 service health, active service issues, and Message Center announcements.

Connector package
Capabilities & access
  • Read service health overviews and service incident details.
  • Collect service messages relevant to tenant operations.

Access / format: Microsoft Graph v1.0 · HTTPS · OAuth 2.0

ACAS Security Center

SECURITY

Tenable.sc / ACAS assets, vulnerability findings, scan health, and platform observations.

Connector package
Capabilities & access
  • Model host assets and vulnerability findings from Security Center.
  • Inspect scanners, repositories, feeds, licensing, and security configuration.

Access / format: HTTPS

Security Onion

SECURITY

Zeek and Suricata telemetry, Elasticsearch health, and supported Security Onion operational status.

Connector package
Capabilities & access
  • Read network/security observations and Elasticsearch index, node, and shard health.
  • Use supported SOC API and fixed manager SSH status commands for grid and service evidence.

Access / format: HTTPS · SSH

Trellix ePO

ENDPOINT

ePO platform health, managed endpoint inventory, agent status, and security events.

Connector package
Capabilities & access
  • Collect system, agent, and operational health evidence through the ePO API.
  • Create inventory observations for groups, managed systems, agent handlers, and rogue systems.

Access / format: HTTPS

VMware vSphere

COMPUTE

vCenter and ESXi inventory, host and virtual machine health, datastores, and events.

Connector package
Capabilities & access
  • Create dynamic inventory observations for hosts and virtual machines.
  • Inspect vCenter identity, compute health, datastore state, and collection status.

Access / format: HTTPS

ServiceNow Table API

DATA

Read selected ServiceNow records into the model using table queries and field mappings.

Connector package
Capabilities & access
  • Collect permitted incident, change, CMDB, alert, or other table records.
  • Choose fields, query filters, and result limits for each collection.

Access / format: HTTPS · JSON

Azure Data Explorer

DATA

KQL query results from Azure Data Explorer, with parameters, timeouts, and result bounds.

Connector package
Capabilities & access
  • Map query rows into CyberStitch observations.
  • Execute parameterized KQL; management commands are rejected.

Access / format: HTTPS · KQL

PostgreSQL Query

DATA

Collect PostgreSQL query results and map rows into operational observations.

Connector package
Capabilities & access
  • Run configured SQL with a connection DSN and timeout.
  • Apply result bounds and map selected columns into the model.

Access / format: PostgreSQL · SQL

Oracle Query

DATA

Collect Oracle Database SQL query results as rows for your operational model.

Connector package
Capabilities & access
  • Connect using the configured database endpoint, service, and credentials.
  • Read query rows with a configured execution timeout.

Access / format: Oracle Database · SQL

HTTP / JSON

GENERIC

Connect JSON APIs and JSON-lines sources with requests and row mappings you define.

Connector package
Capabilities & access
  • Configure URL, method, headers, query parameters, body, and authentication.
  • Select a result path and bounds before mapping rows into observations.

Access / format: HTTP · HTTPS · JSON · NDJSON

SSH Command

GENERIC

Collect output from configured SSH commands, text searches, and login banners.

Connector package
Capabilities & access
  • Run selected commands and map their output into observations.
  • Search permitted paths and inspect the remote login banner.

Access / format: SSH

HTTP Ingress

STREAMING INGRESS

Accept pushed JSON objects, arrays, or NDJSON into a configured CyberStitch feed.

Connector package
Capabilities & access
  • Receive HTTP batches with optional gzip and bearer authentication.
  • Acknowledge requests after the raw data reaches the durable acceptance boundary.

Access / format: HTTP · HTTPS · JSON · NDJSON

gRPC Ingress

STREAMING INGRESS

Accept unary and streamed batches through the CyberStitch IngressService protocol.

Connector package
Capabilities & access
  • Receive Publish and client-streaming PublishStream requests with durable receipts.
  • Configure bearer authentication, TLS, or mutual TLS for the listener.

Access / format: gRPC · TLS · mTLS

Syslog Ingress

STREAMING INGRESS

Receive RFC 3164 and RFC 5424 syslog over UDP, TCP, or TLS.

Connector package
Capabilities & access
  • Parse syslog messages and supported RFC 6587 stream framing.
  • Forward records to the configured durable raw-store boundary.

Access / format: Syslog · UDP · TCP · TLS

Kafka Ingress

STREAMING INGRESS

Consume Kafka topic records through configured consumer groups into CyberStitch feeds.

Connector package
Capabilities & access
  • Read JSON payloads with configurable topic, group, TLS, and SASL settings.
  • Commit offsets after the CyberStitch core acknowledges durable raw acceptance.

Access / format: Kafka · TLS · SASL · JSON

Network Packet Capture

NETWORK

Capture packets or payload-free flow summaries from a TAP, SPAN, or host interface.

Connector package
Capabilities & access
  • Filter capture lanes and query indexed packet/flow records by time and network metadata.
  • Use approved decoder packages for supported reassembled application traffic.

Access / format: AF_PACKET · BPF · Packet capture · Flow records

CyberStitch Mirror

FIRST PARTY

Passively ingest authenticated CyberStitch Mirror UDP records observed on a capture path.

Connector package
Capabilities & access
  • Observe compatible direct, VLAN, GRE/ERSPAN, or VXLAN mirror traffic.
  • Spool and reassemble fragments; only complete authenticated executions enter collection.

Access / format: CyberStitch Mirror UDP · AF_PACKET

CyberStitch Transfer

FIRST PARTY

Pull authorized record exports between CyberStitch instances over an authenticated connection.

Built into CyberStitch
Capabilities & access
  • Exchange capabilities, read bounded exports, and acknowledge transfer progress.
  • Resume collection using checkpoints within the configured peer/export scope.

Access / format: CyberStitch transfer · TCP

Core Analysis

FIRST PARTY

Native model, signal-history, dependency, and observation tools for scoped analysis.

Built into CyberStitch
Capabilities & access
  • Inspect bounded node snapshots, dependency paths, feed schemas, and raw evidence.
  • Use native impact-analysis tools within the selected model and node scope.

Access / format: Native core tools

Package installation, approval, supported platforms, vendor permissions, and version compatibility apply. The customer portal shows the releases available to your organization. Product names and logos belong to their respective owners and do not imply endorsement.

KEEP THE DATA MOVING

Inputs are only
half the picture.

Route selected records to HTTP, Kafka, syslog, cloud storage, and other CyberStitch instances. Data sinks are separate output integrations; the ingress packages above receive data.

Explore data integration ↗
LOOKING FOR SOMETHING ELSE?

Let's look at your systems.

Tell us what you need to connect, the versions you run, and the network boundaries that matter. We'll discuss the appropriate integration path.

Talk to our team ↗

THE WHOLE PICTURE STARTS HERE

Connect your signals.
Know what matters.

Bring your environment. We'll help you see the dependencies,
understand the impact, and find your next move.

Let's talk Read the datasheet