Config
Platform and ingest health
- Syslog, Splunk HEC, STIX/TAXII, webhooks and CyberDragon augments.
- You do not have to rip the SIEM you already run.
- OIDC/SAML federation when the estate requires it.
Integrations
Augment your SIEM, TI, and identity stack.
Syslog, Splunk HEC, STIX/TAXII, webhooks, SCIM, and native OT protocol capture. Not a rip-and-replace.
Connectors
enterprise, threat intel, OT, and cloud.
API & SDK
REST / GraphQL, PQC auth, partner SDKs.
Intel
TI exchange in the Fusion Center
- STIX/TAXII in and out.
- Same fusion the incident workspace uses.
- Threat Atlas is public context on the same narrative.
Identity federation
OIDC / SAML, SCIM 2.0, instant API-key revocation.
Playbooks
Webhook and SOAR hand-off
- Incident hand-off into ITSM and chat.
- OT writes still cannot skip the Safety Gate.
- API keys with instant revocation.
Integration patterns
Six ways teams wire CyberDragon into an existing stack.
Export formats
Data leaves in formats your tools already read.
| Format | Typical destination | Contents |
|---|---|---|
| STIX 2.1 / TAXII2 | Threat intelligence platforms | Indicators, campaign context, and observed kill-chain sightings. |
| CEF / syslog | SIEM and log pipelines | Normalised detections with tenant, asset, and Purdue-zone fields. |
| Splunk HEC | Splunk indexes | Correlated incidents rather than raw event noise. |
| Signed evidence ZIP | Auditors and regulators | Hash-chained records, Ed25519 signatures, and OPA policy reason codes. |
| Webhooks | ITSM, chat, and automation | Incident lifecycle events with approval and denial transitions. |
FAQ
Frequently asked questions.
Start your 7-day free trial.
A dedicated CyberDragon tenant on your own traffic and not a slide deck. See kill-chain cyber defense on your network.