Config
Platform and ingest health
- Syslog, Splunk HEC, STIX/TAXII, webhooks — CyberDragon augments.
- You do not have to rip the SIEM you already run.
- OIDC/SAML federation when the estate requires it.
Integrations
Augment your SIEM, TI, and identity stack.
Syslog, Splunk HEC, STIX/TAXII, webhooks, SCIM, and native OT protocol capture. Not a rip-and-replace.
Connectors
enterprise, threat intel, OT, and cloud.
API & SDK
REST / GraphQL, PQC auth, partner SDKs.
Intel
TI exchange in the Fusion Center
- STIX/TAXII in and out.
- Same fusion the incident workspace uses.
- Threat Atlas is public context on the same narrative.
Identity federation
OIDC / SAML, SCIM 2.0, instant API-key revocation.
Playbooks
Webhook and SOAR hand-off
- Incident hand-off into ITSM and chat.
- OT writes still cannot skip the Safety Gate.
- API keys with instant revocation.
Integration patterns
Six ways teams wire CyberDragon into an existing stack.
Export formats
Data leaves in formats your tools already read.
| Format | Typical destination | Contents |
|---|---|---|
| STIX 2.1 / TAXII2 | Threat intelligence platforms | Indicators, campaign context, and observed kill-chain sightings. |
| CEF / syslog | SIEM and log pipelines | Normalised detections with tenant, asset, and Purdue-zone fields. |
| Splunk HEC | Splunk indexes | Correlated incidents rather than raw event noise. |
| Signed evidence ZIP | Auditors and regulators | Hash-chained records, Ed25519 signatures, and OPA policy reason codes. |
| Webhooks | ITSM, chat, and automation | Incident lifecycle events with approval and denial transitions. |
FAQ
Frequently asked questions.
Do we have to replace our SIEM?
No. CyberDragon augments it via syslog, Splunk HEC, STIX/TAXII, and webhooks, adding OT semantics and evidence-grade audit.
Which identity providers are supported?
OIDC and SAML federation with SCIM 2.0 provisioning. API keys use a cdag_ prefix and can be revoked instantly.
Is there a partner SDK?
Yes — Python and TypeScript SDKs (cyberdragon-partner-sdk) built against the public REST/GraphQL API and the OpenAPI spec.
Start your 7-day free trial.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.