Integrations

Documentation Index

Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt

Use this file to discover all available pages before exploring further.

This section is a catalog. Pick a source, follow a short setup guide, then validate that:

• logs are ingesting
• dashboards populate (after provisioning)
• alerting can be enabled (built-in or custom)

If you’re brand new, start with the guided checklist: Start here.

---

​

The mental model

Almost every integration follows this pattern:

1. Ingest events (API integration or syslog)
2. Store events in your SIEM datastore (Wazuh Indexer / OpenSearch-backed)
3. (Often) build alerts in Graylog → alerts land in gl-events*
4. CoPilot shows alerts in Incident Management → Alerts → operators open Cases

---

​

First-wave integrations

• Wazuh (endpoints)
• Office 365
• Mimecast
• Huntress
• CrowdStrike

​

Network connectors (syslog)

• Network connectors overview
• Fortinet: FortiGate
• Palo Alto Networks: PAN-OS
• Cisco: ASA