Skip to main content

​
How integrations show in Protect

At Settings → Integrations (URL /settings/connections) you’ll see a card per integration: Integrations page showing Azure AD, CrowdStrike, Duo, Jamf, Lansweeper with CONNECTED status, feature icons, and last-synced timestamps Each card shows:

​
Feature icons explained

The icons after “Features provided” tell you what this integration contributes to Protect’s data model: A CrowdStrike card with all four icons confirms it’ll feed device inventory, Vitals, software, and mobile data. A Duo card with only the person icon confirms it’s identity-only.

​
Core principles

Every integration uses read-only API credentials, so the sync itself can’t push changes, delete data, or modify configuration in your connected tools. Protect itself is read-only — Actions can trigger outbound automations only with your explicit approval. Even if a token were compromised, the blast radius is limited to reading what the tool already exposes.

​
The 100+ integration catalogue

Protect supports 100+ integrations across:

EDR / Endpoint Security

CrowdStrike Falcon, Microsoft Defender ATP, SentinelOne, Cortex XDR (Extended Detection and Response), Carbon Black, Sophos, Cylance, Bitdefender, McAfee, Trend Micro, plus 30+ more

MDM

Microsoft Intune, JAMF Pro, MaaS360, Workspace ONE, Kandji, MobileIron

Identity & Directory

Microsoft Entra ID, OnPrem AD, Okta, OneLogin, JumpCloud, Google Workspace, Duo

Vulnerability Management

Qualys VM, Rapid7, Tenable.io / Nessus, Edgescan

Network / Web Security

ZScaler, Cisco Umbrella, Cloudflare Zero Trust, Netskope, DNS Filter, Meraki, SonicWall

Patch / Config Management

SCCM (Config Manager), Tanium, Microsoft Intune, ManageEngine Patch, Syxsense

ITSM

ServiceNow, Halo Service Desk, Freshservice, Datto Autotask PSA (Professional Services Automation)

Network Scanning

Lansweeper, PDQ Inventory, Device42, SolarWinds

Cloud Infrastructure

Azure (IaaS, Entra), AWS EC2 / Systems Manager, Google (Devices & Users), Microsoft 365, Dropbox

DLP / Backup

Druva, McAfee MVISION

Privileged Access

CyberArk, BeyondTrust, Admin By Request

Specialised

Darktrace, Heimdal, Huntress, Illumio, KnowBe4, ThreatLocker, and more
For step-by-step setup of any individual integration, see the Connection Guides tab — every supported integration has its own guide with screenshots.

​
Connecting an integration

Each integration has its own connection flow, but the high-level shape is consistent:
1

Open the integration card

Settings → Integrations → click the integration → Connect (or Modify if reconnecting).
2

Provide read-only credentials

Each integration has a specific authentication model:
  • OAuth (Entra ID, Microsoft Intune, Microsoft Defender ATP, Microsoft 365) — Global Admin consent flow
  • API Key (CrowdStrike, Qualys, ZScaler) — generate in the vendor console, paste into Protect
  • Basic Auth (some on-prem tools) — username + password
  • PowerShell Relay (on-prem AD, SCCM, on-prem Lansweeper) — see PowerShell Relay
Refer to the integration-specific Connection Guide for the exact steps.
3

(Optional) configure

Some integrations expose configuration — e.g. which Vitals checks to compute. See Vitals Configuration.
4

Wait for initial sync

First sync pulls the full inventory and can take 15-60 minutes for large datasets. Watch the “Last synced” timestamp on the card.
5

Validate via X-Ray

Open any known device → X-Ray → confirm the new integration is reporting expected fields.

​
Multi-tenancy

See dedicated page → Many vendors support multiple tenants (Azure AD with multiple directories, CrowdStrike with multiple instances, ServiceNow per-customer). Protect supports connecting multiple tenants of the same integration, with cross-mapping or strict isolation between them.

​
Health & troubleshooting

​
Integration states

​
Last-synced thresholds

  • < 1 hour: normal
  • 1-3 hours: monitor — slow API or rate limited
  • 3-24 hours: investigate — check Connection card’s detail view
  • > 24 hours: alert — credentials may have expired or API permissions changed
Protect surfaces stale integrations in two places:
  • Dashboard → Integration Control panel highlights cards with stale data
  • Device Explorer → integration row shows the same “Now / 13h” pattern at-a-glance

​
Common failure modes

The vendor’s password rotation policy hit. Generate a new key in their console, paste into the Modify dialog.
The service account used for the integration was modified in a role change. Restore the read scopes documented in the Connection Guide.
The scheduled task on the relay server stopped running. RDP in, verify the task and underlying script. See PowerShell Relay troubleshooting.
Heavy vendor API load is throttling Protect. Usually self-resolves; if persistent, contact support for sync-cadence tuning.

​
AWS / IP Whitelist info

Some on-prem integrations need to reach Protect’s cloud over outbound HTTPS. The AWS Account / IP Whitelist Info link at the top of Settings → Integrations shows the egress IP ranges and account identifiers to whitelist on your firewall.

​
Custom integration requests

Need an integration we don’t yet support? Open a request via your account manager or support — you’ll be asked for:
  • Vendor name and product
  • Public API documentation URL
  • Sample API responses (or a temporary sandbox account)
  • Read-only credentials for testing
Typical turnaround for new integrations: 2-4 weeks to a beta, plus a customer testing phase.

​
Cross-references

Settings → Integrations

The admin page

PowerShell Relay

On-prem connectivity

Multi-tenancy

Multiple tenants per integration

Connection Guides

Step-by-step per vendor

X-Ray

Validate what’s coming in

Vitals

What checks each integration exposes