Integrations

We work with what you already have.

Most small and mid-market businesses already run a handful of security and IT tools. Obsidian Ridge does not ask you to rip and replace — we connect to your existing stack, ingest the signals, and have the SOC review them. Below is a complete picture of what we plug into today.

Ask about your stack

Available nowProductized — works on day one.

ConfigurableSet up during onboarding.

Category

Endpoints & devices

Where the Managed EDR agent runs. Light, signed, and deployable across mixed fleets.

Windows 10 / 11

Standard endpoint agent

Windows Server 2016+

Includes Domain Controllers

macOS 12+

Apple Silicon and Intel

Linux (RHEL, Ubuntu, Debian, Amazon Linux)

Server workloads

Microsoft Intune

Agent push via Intune policies

JAMF Pro

Agent push for managed Macs

Kandji

Agent push for Apple fleets

Addigy

Agent push for Apple fleets

Category

Identity providers

Where Managed ITDR watches for the patterns that show up before account takeover.

Microsoft 365 / Entra ID

Full identity threat detection

Google Workspace

Full identity threat detection

Okta

Log forwarding and posture monitoring

Category

Cloud platforms

Cloud workloads ingested into Managed SIEM for unified detection across your stack.

Microsoft Azure

Sentinel logs, Defender for Cloud

Amazon Web Services (AWS)

CloudTrail, GuardDuty, S3 access logs

Google Cloud Platform (GCP)

Cloud Audit Logs, SCC findings

Cloudflare

WAF events, Zero Trust logs

Category

Network & perimeter

Firewall, DNS, and VPN telemetry feeding Managed SIEM correlation.

Fortinet FortiGate

Syslog ingestion

Palo Alto Networks

Syslog and Cortex XDR

SonicWall

Syslog ingestion

Cisco Meraki

Syslog and event API

Cisco Umbrella

DNS security telemetry

Cloudflare WARP / Zero Trust

Activity logs

Category

Security tools you may already run

We don't ask you to rip and replace. Existing security tools become signal sources for the SOC.

Microsoft Defender for Endpoint

Deploy it to the endpoints first, or nothing flows. Then it coexists with our agent.

SentinelOne

Alert ingestion and correlation

CrowdStrike Falcon

Alert ingestion and correlation

Sophos / Sophos MDR

Alert ingestion and correlation

Category

Productivity & SaaS

Audit-relevant SaaS log sources for compliance and threat detection.

Slack

Audit log forwarding

GitHub

Audit log and security event ingestion

Atlassian (Jira, Confluence)

Audit log forwarding

Box, Dropbox, OneDrive

Activity log forwarding

FAQ

Questions about integrations

What does "Available now" vs "Configurable" mean?

Available now means the integration is fully productized and works out of the box on the relevant tier. Configurable means we can connect it during onboarding with light configuration work — typically log forwarding or a scoped service account.

I don't see a tool I use. Can you still ingest it?

Probably yes. The Managed SIEM in the Complete tier accepts standard log formats (Syslog, JSON, Webhook, S3 bucket forwarding). If your tool has any kind of log export, we can usually wire it in. Tell us during the briefing.

Do you need admin access to all of these tools?

We need read-only or scoped admin access to ingest logs and see alerts. For most tools, that means a service account with audit-log read permissions — not a global admin. We document exactly what's needed before deployment.

Will adding integrations slow down our existing tools?

No. Most integrations are log-forwarding (one-way), not in-line traffic inspection. The endpoint agent itself is light — under 50 MB of memory, no kernel hooks, signed by Microsoft.

Don't see your tool?

Most things connect. Tell us what you run.

The Managed SIEM in the Complete tier accepts standard log formats (Syslog, JSON, Webhook, S3 forwarding). If your tool can export logs, we can usually ingest them.

Ask about your stack

We work with what you already have.