Helm · Powered by Wirespeed by Coalition
Bring the stack you already own.
Helm works with the security tools a company already runs. Search this directory to see whether yours can connect, and how: as a native integration, or by forwarding its logs.
- Detection Sources
- 42
- User Directories
- 09
- Endpoint Management
- 14
- Communication
- 04
- Ticketing
- 08
- Enrichment
- 02
- AI Security
- 05
- Log Forwarding
- 37
108 listed entries. Some tools appear in more than one category.
Connector directory
108 of 108 entries
- Integration
Acronis
Cyber Protect Cloud Alert Manager detections including email threats
- Detection Sources
- Integration
Action1
Patch management endpoints, vulnerabilities, missing updates, and audit activity
- Detection Sources
- Endpoint Management
- Integration
Admin By Request
Endpoint privilege management and privilege-elevation security events
- Detection Sources
- Integration
Agger Labs
Anti-ransomware detection and response
- Detection Sources
- Integration
AWS GuardDuty
CloudTrail and GuardDuty security events
- Detection Sources
- Integration
Check Point Harmony
Unified endpoint and email security
- Detection Sources
- Integration
Cisco Secure Endpoint
Endpoint threat detection and isolation
- Detection Sources
- Integration
CrowdStrike
Endpoint detection, NG-SIEM, and identity security
- Detection Sources
- Endpoint Management
- Integration
Darktrace
AI-powered network detection and response
- Detection Sources
- Integration
Darktrace Email Security
Email threat detection and protection
- Detection Sources
- Integration
Datto EDR
Endpoint alerts with agent inventory
- Detection Sources
- Endpoint Management
- Integration
FortiMail Workspace Security
Email threat scans (formerly Perception Point)
- Detection Sources
- Integration
Google Alert Center
Google Workspace security alerts
- Detection Sources
- Integration
Google SecOps
Google Security Operations SIEM detections
- Detection Sources
- Integration
Google Security Center
Google Cloud security findings
- Detection Sources
- Integration
Halcyon
Anti-ransomware detection and response
- Detection Sources
- Endpoint Management
- Integration
Horizon3 NodeZero
Autonomous pentesting and attack simulation validation
- Detection Sources
- Integration
Jamf Internet Security
Mobile threat events: phishing, malicious apps, and network threats
- Detection Sources
- Integration
Jamf Protect
Mac-focused endpoint security
- Detection Sources
- Integration
Microsoft
Defender for Endpoint, Entra ID Protection, Sentinel, and more
- Detection Sources
- User Directories
- Integration
Mimecast
Email security and threat protection
- Detection Sources
- Integration
Netskope
SSE alerts, web/SaaS/ZTNA/network events, and users
- Detection Sources
- User Directories
- Endpoint Management
- Log Forwarding
- Integration
NinjaOne
RMM/MDM alerts, activity telemetry, and device inventory
- Detection Sources
- Integration
Okta
Identity threat detection
- Detection Sources
- User Directories
- Integration
Palo Alto Networks Cortex
Cortex XDR/XSIAM alert ingestion and endpoint management
- Detection Sources
- Integration
Picus Security
Breach and attack simulation validation
- Detection Sources
- Integration
Proofpoint
Email threat detection and protection
- Detection Sources
- Integration
Orca Security
Cloud security posture and workload protection
- Detection Sources
- Integration
SafeBreach
Breach and attack simulation
- Detection Sources
- Integration
Sandfly
Agentless Linux detection and host telemetry
- Detection Sources
- Endpoint Management
- Integration
SentinelOne
Autonomous endpoint protection platform
- Detection Sources
- Endpoint Management
- Integration
Sophos Central
Intercept X endpoint detections and event telemetry
- Detection Sources
- Integration
Splunk
SIEM detection ingestion
- Detection Sources
- Integration
Sublime Security
Email threat detection and protection
- Detection Sources
- Integration
Tenable Nessus
Deconflict detections from vulnerability scanning
- Detection Sources
- Integration
ThreatLocker
Enforced application and network denies with endpoint inventory
- Detection Sources
- Endpoint Management
- Integration
Tracebit
Cloud-native deception platform alerts
- Detection Sources
- Integration
Thinkst Canary
Honeypot-based intrusion detection
- Detection Sources
- Integration
Upwind
Cloud and workload threat detections
- Detection Sources
- Integration
Vectra
Network detection and response
- Detection Sources
- Integration
Wiz
Cloud security findings and vulnerability ingestion
- Detection Sources
- Integration
Wordfence
WordPress security and firewall
- Detection Sources
- Integration
Cisco Duo
Multi-factor authentication directory
- User Directories
- Integration
Idira (formerly CyberArk)
Privilege Cloud audit events and Identity directory sync
- User Directories
- Integration
Google Workspace
Google directory and sign-in logs
- User Directories
- AI Security
- Integration
JumpCloud
Directory events with user and endpoint sync
- User Directories
- Integration
OneLogin
Directory sync with user suspend and re-enable actions
- User Directories
- Integration
PingOne
PingOne audit activity monitoring
- User Directories
- Integration
Axonius
Device and asset inventory synchronization
- Endpoint Management
- Integration
Fleet
osquery-based device inventory and activity telemetry
- Endpoint Management
- Integration
Jamf Pro
Apple device management
- Endpoint Management
- Integration
Iru
Modern Apple MDM (formerly Kandji)
- Endpoint Management
- Integration
ManageEngine
AD audit and endpoint monitoring
- Endpoint Management
- Integration
Microsoft Intune
Cloud-based endpoint management
- Endpoint Management
- Integration
Email
Email-based user notification
- Communication
- Integration
Custom SMTP
Send emails from your own domain
- Communication
- Integration
Microsoft Teams
In-app chat ops experience
- Communication
- Integration
Slack
Direct message users for verification
- Communication
- Integration
ConnectWise PSA
Professional services automation
- Ticketing
- Integration
DFIR IRIS
Digital forensics and incident response case management
- Ticketing
- Integration
Freshservice
IT service management ticketing and case sync
- Ticketing
- Integration
Halo ITSM
IT service management ticketing and case sync
- Ticketing
- Integration
Jira Cloud
Atlassian’s cloud-hosted Jira
- Ticketing
- Integration
Jira Data Center
Self-hosted Jira deployment
- Ticketing
- Integration
Odoo Helpdesk
Odoo Helpdesk ticket management
- Ticketing
- Integration
PagerDuty
Incident management and on-call alerting
- Ticketing
- Integration
IPinfo
IP address geolocation and ASN data
- Enrichment
- Integration
Reversing Labs
File reputation and malware analysis
- Enrichment
- Integration
Anthropic Claude
Compliance API administrative, security, and configuration activity
- AI Security
- Integration
Cursor
Enterprise audit log of administrative, access, and configuration changes
- AI Security
- Integration
Google Cloud Audit Logs
Gemini API key, Service Usage, and Vertex AI audit activity
- AI Security
- Integration
OpenAI Platform
Administrative, configuration, and authentication audit events
- AI Security
- Log forwarding
1Password
Password manager audit and sign-in events
- Log Forwarding
- Log forwarding
3CX
Phone system event, audit, and sign-in logs
- Log Forwarding
- Log forwarding
Barracuda CloudGen Firewall
Firewall activity, threat, and VPN authentication logs
- Log Forwarding
- Log forwarding
Bitwarden
Organization events and user activity
- Log Forwarding
- Log forwarding
Box
Cloud content management events
- Log Forwarding
- Log forwarding
Check Point Firewall (Quantum)
Next-gen firewall and network security events
- Log Forwarding
- Log forwarding
Cisco ASA
Firewall connection, access-list, VPN, and admin logs
- Log Forwarding
- Log forwarding
Cisco Catalyst
Syslog forwarding from Cisco Catalyst network devices
- Log Forwarding
- Log forwarding
Cisco Meraki
Cloud-managed network security
- Log Forwarding
- Log forwarding
Cisco Secure Access
DNS-layer security
- Log Forwarding
- Log forwarding
Cisco Umbrella
DNS-layer security
- Log Forwarding
- Log forwarding
Cloudflare Zero Trust
Access authentication and account audit logs
- Log Forwarding
- Log forwarding
Exium
Network and security syslog events
- Log Forwarding
- Log forwarding
Fortinet FortiAnalyzer
Centralized log and analytics
- Log Forwarding
- Log forwarding
Fortinet FortiGate
Next-gen firewall security events
- Log Forwarding
- Ingestion method
Generic JSON
Webhook-based JSON ingestion
- Log Forwarding
- Ingestion method
Generic Syslog
CEF and standard syslog formats
- Log Forwarding
- Log forwarding
GitHub
Security and audit events from GitHub
- Log Forwarding
- Log forwarding
GitHub Enterprise Cloud
Organization audit events from GitHub Enterprise Cloud
- Log Forwarding
- Log forwarding
HYAS Protect
Adversary infrastructure intelligence
- Log Forwarding
- Log forwarding
Microsoft On-Prem AD
On-premises Active Directory
- Log Forwarding
- Log forwarding
Microsoft Sign-In Logs
Standalone Entra ID sign-in data
- Log Forwarding
- Log forwarding
OpenVPN Access Server
VPN authentication and connection logs
- Log Forwarding
- Log forwarding
Palo Alto Networks NGFW
PAN-OS firewall and security syslog events
- Log Forwarding
- Log forwarding
pfSense / OPNsense
Firewall rule decisions, DHCP leases, and filter DNS syslog
- Log Forwarding
- Log forwarding
ServiceNow
Change request validation for planned maintenance workflows
- Log Forwarding
- Log forwarding
SonicWall
Next-gen firewall security events
- Log Forwarding
- Log forwarding
Sophos Firewall
Firewall, web, IPS, VPN, and admin login syslog events
- Log Forwarding
- Log forwarding
Stairwell
Webhook delivery for Stairwell detection events
- Log Forwarding
- Log forwarding
Ubiquiti UniFi Network
Gateway, switch, and access point syslog events
- Log Forwarding
- Log forwarding
Varonis DatAdvantage
DatAlert CEF syslog for file, email, and directory activity
- Log Forwarding
- Log forwarding
VMware vSphere
vCenter Server events, SSO sign-ins, and ESXi host access
- Log Forwarding
- Log forwarding
WatchGuard Firebox
VPN authentication, traffic, and alarm syslog events
- Log Forwarding
- Log forwarding
Windows Event Logs
Windows event forwarding
- Log Forwarding
- Log forwarding
Zabbix
Infrastructure monitoring alerts
- Log Forwarding
- Log forwarding
Zscaler ZPA
ZPA App Connector syslog forwarding
- Log Forwarding
Before you plan around a connector
Connected does not mean identical.
- Integration
- A named connection documented by Wirespeed for that product, such as pulling detections, syncing users or devices, sending notifications, or opening tickets.
- Log forwarding
- The tool sends its logs in by syslog, webhook, or API. Useful context and detection, without implying response actions inside that tool.
- Ingestion method
- Generic JSON and Generic Syslog are formats, not branded apps. They are a route for tools that are not listed by name.
Capabilities and required permissions vary by tool and licence. Not every connector supports the same automated actions, and integrations marked beta escalate detections to you rather than remediating automatically. Check the setup docs for each tool, or read the official Wirespeed integrations overview (opens in a new tab).
Send us your tool list.
Tell us what you run today. We will tell you what connects, how, and what Helm can do with it.