EXPEL WORKBENCH™ INTEGRATIONS
Integrations portfolio
You've invested in the right tech for your environment, and we make it work harder.
Featured integrations
Palo Alto Networks Next Gen Firewall
Next-gen firewall log ingestion & threat correlation
AI / Automation
Anthropic Claude
AI-assisted investigation & analyst workflow support
Cloud
Amazon Elastic Kubernetes Service (EKS)
Kubernetes cluster activity & container runtime signals
AWS GuardDuty
Intelligent threat detection for AWS workloads
FortiCNAPP
Cloud workload protection & posture management
Google Cloud
Cloud audit & activity log ingestion
Google Kubernetes / GKE
Container orchestration activity & runtime signals
Google Workspace Alert Center
Google Workspace security alert aggregation
Microsoft Azure
General Azure platform activity & resource logs
Microsoft Azure Kubernetes Service (AKS)
Kubernetes cluster activity & container runtime signals
Microsoft Azure Monitor log analytics
Azure resource activity & diagnostic log ingestion
Microsoft Defender for Cloud Apps
Cloud app usage & data-loss policy events
Oracle Cloud Infrastructure (OCI)
Cloud audit & activity log ingestion
Orca Security
Agentless cloud posture & vulnerability risk context
Palo Alto Networks Prisma Cloud Compute
Container & cloud workload vulnerability/runtime protection
Palo Alto Networks Strata Logging Service
Centralized firewall & network security log storage
Sumo Logic Cloud Infrastructure Security
Cloud infrastructure security posture & threat detection
Sysdig Secure
Container & cloud runtime threat detection
Email & Productivity
Abnormal AI
AI-based email threat detection & response
Mimecast
Email threat detection & security event logs
Phishing Submission
End-user reported phishing email intake
Proofpoint Insider Threat Management
Insider risk & data-exfiltration activity monitoring
Proofpoint TAP
Targeted phishing & malicious attachment/URL detection
Sublime Security Defend
Detection-as-code email security & threat detection
Endpoint
Arctic Wolf Aurora Endpoint Security
AI-driven endpoint protection & threat prevention
Broadcom Symantec Endpoint Protection
Endpoint antivirus & threat prevention telemetry
Broadcom VMware Carbon Black Cloud
Cloud-native endpoint detection & response telemetry
Broadcom VMware Carbon Black Endpoint
Endpoint detection & response telemetry (legacy CB Response)
Cisco Secure Endpoint
Endpoint detection & response telemetry
Cybereason EDR/XDR
Endpoint detection & response telemetry
DarkTrace Prevent / Detect
AI-driven threat detection & autonomous response actions
Elastic Security
Endpoint detection & response telemetry (Elastic Security)
Sentinel Singularity Hologram
Deception-based lateral movement & credential-theft detection
Symantec SES
Cloud-delivered endpoint protection & detection telemetry
Tanium XEM Core
Real-time endpoint visibility & management telemetry
Trellix Endpoint Security (HX)
Endpoint detection & response telemetry
Trend Micro Apex One
Endpoint protection & detection telemetry
Identity & Access
1Password
Password manager activity & security event logs
Cisco Duo
Multi-factor authentication signals
CrowdStrike Falcon Identity Protection
Identity threat detection via CrowdStrike
CyberArk Identity
Identity & access management authentication events
CyberArk Privileged Access (PAM)
Privileged session & credential vaulting activity
JumpCloud
Cloud directory & device authentication event logs
LastPass
Password manager activity & security event logs
Microsoft Defender for Identity
On-premises identity threat detection & lateral movement alerts
Microsoft Entra ID via Event Hub
Identity sign-in & audit log streaming
Okta Auth0
Identity & authentication event logs
OneLogin
Identity provider — authentication & access event logs
Ping One for Workforce
Workforce identity & authentication event logs
Messaging & Productivity
Slack Enterprise Grid
Team messaging & incident notification delivery
Network
Akamai Guardicore Segmentation
Workload microsegmentation & lateral movement visibility
Arista NDR
Network detection & response telemetry
Broadcom VMware NSX Advanced Load Balancer (formerly AVI Vantage)
Application delivery controller & load balancer traffic logs
Check Point AV, Anti-Bot, and IPS
Antivirus, anti-bot & intrusion prevention log source
Check Point Quantum Network Security
Next-gen firewall log ingestion & threat prevention
Cisco ASA
Firewall & VPN traffic log source
Cisco Firepower
Next-gen firewall & intrusion prevention logs
Cisco Meraki
Cloud-managed network & security appliance logs
Cisco Umbrella
DNS-layer security & web filtering logs
Cloudflare WAF
Web application firewall event logs
Cloudflare Zero Trust Network Access (ZTNA)
Zero-trust network access session & policy logs
Corelight Open NDR
Network detection & response built on open-source Zeek
Darktrace
AI-based network anomaly detection
ExtraHop Reveal(x) 360
Cloud-delivered network detection & response
ExtraHop Reveal(x) Enterprise
On-premises network detection & response
Fastly Next-Gen WAF
Web application firewall & bot management events
Forcepoint Web Filter
Web filtering & URL category enforcement logs
FortiAnalyzer
Fortinet log aggregation & analysis
FortiGate
Next-gen firewall traffic & threat logs
iboss Secure Access Service Edge (SASE)
Secure web gateway & SASE traffic logs
Imperva WAF
Web application firewall event logs
McAfee IDS
Network intrusion detection log source
Netskope Next Gen SWG
Web traffic filtering & threat protection logs
Palo Alto Networks Next Gen Firewall
Next-gen firewall log ingestion & threat correlation
Vectra AI (NDR)
AI-driven network detection & response
Verizon Network Detection and Response
Cloud-delivered network detection & response
Zscaler Secure Internet Access (ZIA)
Secure internet access & web traffic filtering logs
Risk & Vulnerability
Qualys VMDR
Vulnerability scanning & risk detection
Rapid7 InsightVM
Vulnerability scanning & risk detection
Tenable Vulnerability Management
Vulnerability scanning & risk detection
SaaS
Box
File-sharing activity & admin audit logs
Dropbox
File-sharing activity & admin audit logs
GitHub
Repository activity & security alert logs
GitLab
Repository activity & security alert logs
Microsoft Intune
Mobile device & endpoint management compliance data
Netskope Cloud Access Security Broker (CASB)
Cloud app usage & data-loss policy events
Palo Alto Networks SaaS Security
SaaS application security & data-loss policy events
Salesforce Shield
Salesforce platform event monitoring & compliance logging
Varonis SaaS
SaaS data access & exposure risk monitoring
Workday
HR platform activity & security audit logs
Security Ops & SIEM
Cribl
Log/data pipeline routing & transformation
Crowdstrike Data Replicator
Raw endpoint telemetry export from CrowdStrike Falcon
CrowdStrike Logscale
High-volume log ingestion & search platform
CrowdStrike Logscale Collector
Log collection & forwarding agent for LogScale
Datadog
Infrastructure & application observability logs
Devo
Cloud-native SIEM & log analytics
Elasticsearch
Log storage, search & analytics platform
Exabeam Fusion New-Scale SIEM Collector
Log collection agent for Exabeam New-Scale SIEM
Exabeam Fusion SIEM Collector
Log collection agent for Exabeam Fusion SIEM
Google Security Operations (SecOps)
Cloud-native SIEM & SOAR log correlation
IBM QRadar SIEM
SIEM log ingestion & correlated offenses
LogRhythm
SIEM log ingestion & correlated alarms
LogRhythm Collector
Log collection agent for LogRhythm SIEM
Logz.io
Cloud-native log management & observability
Panther Cloud SIEM
Detection-as-code cloud-native SIEM
SentinelOne Singularity Data Lake
Unified security data lake for log storage & analytics
Snowflake
Cloud data warehouse log ingestion & analytics
Splunk Collector
Log collection agent for Splunk
Splunk Core Alerts
Splunk saved-search alert ingestion
Sumo Logic Cloud SIEM
Cloud-native SIEM log ingestion & correlation
Sumo Logic Collector
Log collection agent for Sumo Logic
Ticketing & Notification
ServiceNow ITSM
IT service management ticket creation & workflow
XDR / SIEM
CrowdStrike Falcon Next-Gen SIEM
Next-gen SIEM log ingestion & correlation
Exabeam Advanced Analytics
User & entity behavior analytics
Exabeam Fusion SIEM
Cloud-native SIEM with built-in UEBA
Exabeam Threat Center
Centralized threat detection, investigation & response workspace
Hunters SOC Platform
Cloud-native SOC platform for threat detection & response
IBM QRadar
IBM SIEM log ingestion
Microsoft Azure Sentinel
Cloud-native SIEM log ingestion
Microsoft Defender XDR
Cross-domain detection across Microsoft stack
Palo Alto Networks XSIAM/CXDR
Extended detection & response platform
Securonix Next-Gen SIEM
Cloud-native SIEM with behavior analytics
Not seeing an integration?
New integrations are being added each month, reach out to discuss our capabilities.
Frequently asked questions
No. Expel is API-first, vendor-agnostic, and purpose-built to work with the security technology stack you already have. We connect to your existing EDR, SIEM, identity, cloud, and network tools via API, maximizing the value of your current investments rather than displacing them.
Most customers are fully integrated and operational within days, not months. Expel’s integration team handles the technical setup, and pre-built connectors mean there is no custom development required on your side. You reach full detection coverage quickly without a lengthy professional services engagement.
Expel owns integration maintenance end-to-end. When a vendor releases an API change, schema update, or new telemetry format, Expel’s engineering team updates the connector rather than your team. Customers are notified of material changes through Workbench, and the maintenance burden never lands on your side.
Expel monitors integration health continuously. If a data source goes silent due to a misconfiguration, agent failure, or API issue, Expel alerts your team through Expel Workbench™ and our SOC flags the coverage gap proactively. Integration health is visible in your Workbench dashboard at all times.