The EventProcessor and Unified Security Stack ecosystem can connect with external systems to enhance data and make response workflows more efficient.

Threat Intelligence (TI) Platforms

Enrich your events with context from worldwide threat feeds.

1. ThreatWinds: Native integration via the feeds analysis plugin. It automatically matches events against ThreatWinds' malicious IP and domain lists.

2. Custom TI Feeds: While the feeds plugin is proprietary, yet the architecture is open. You can build your own analysis plugins with the go-sdk to retrieve indicators from platforms like MISP or OpenCTI.

Data Enrichment

• Geolocation: The geolocation parsing plugin adds city, country, and coordinates to events by using IP addresses.

• Asset Discovery: Connects to Unified Security Stack's asset management to link internal IPs with designated departments and criticality levels.

Notifications

Automating alerts and system messages.

• Email: Connected through SMTP to broadcast critical alerts.

• Internal Stats: The stats plugin monitors processing metrics and performance indicators.

Custom Integrations

Since the architecture is gRPC-based, any external system can be integrated by building a Notification Plugin. This is how you would link to:

• Ticket management systems (JIRA, ServiceNow).

• Communication platforms (Slack, Teams, Discord).

• Custom internal APIs.