Appearance
Integrations
Every integration is set up by your administrator in the console, under Admin → Integrations. No access to the server is needed.
| Integration | In Admin → Integrations | Page |
|---|---|---|
| AWS WAF, AWS Network Firewall, AWS log collection | Amazon Web Services | AWS |
| Microsoft 365 audit logs | Microsoft 365 audit logs | AWS |
| Cloudflare (response actions and events) | Cloudflare | Cloudflare |
| Google Cloud VPC firewall blocking, Cloud Audit Logs, Security Command Center | Google Cloud | Google Cloud |
| Microsoft Defender for Endpoint, Microsoft Intune | Microsoft Defender for Endpoint, Microsoft Intune | Microsoft |
| Sophos Central | Sophos Central | Sophos Central |
| Sophos Firewall (blocking) | Sophos Firewall | Sophos Firewall |
| FortiGate (blocking) | FortiGate | FortiGate |
| OPNsense (blocking; pfSense is not supported) | OPNsense | OPNsense |
| Azure network security group (blocking) | Azure network security group | Azure |
| DigitalOcean Cloud Firewall (blocking) | DigitalOcean Cloud Firewall | DigitalOcean |
| Logs from firewalls and network devices | Firewall and network logs (syslog) | Syslog |
| AbuseIPDB, VirusTotal, OTX, MISP, NVD | Threat intelligence | Other integrations |
| SMTP e-mail, health alerts | Email and webhook | Other integrations |
| Jira | Jira | Other integrations |
| Suricata NIDS | Network sensor (Suricata) | Other integrations |
| LLM endpoint | AI model | Pallas |
| Nuclei external scanner | External scanner | |
| How long logs are kept (default 45 days) | Data retention | Compliance |
Set up an integration
- Open Admin → Integrations and choose the integration.
- Fill in the fields. Secrets are never shown again once saved: the console only shows that they are set.
- Test connection, then Save.
The stack applies a saved change within a minute and records it with your provider. If applying it fails, the console shows the error and keeps the change until you save it again. Disconnect removes the integration.
Values cannot contain spaces, $, #, quotes or backquotes. The console tells you when a value is refused; if a vendor password has one of these characters, give the account a new password without it.
An integration you have not set up shows as "Not set up" in Admin → Platform health; it does not count as a fault. Data retention has a default (45 days) and shows "Default" until you set it.
Vendor connectors
Cloudflare events, Microsoft Defender, Microsoft Intune and Sophos Central each run a connector that polls the vendor every 30 minutes by default. Their alerts appear under All alerts and in the SIEM.
On a stack without the console, sudo ./theseus connectors enable <name> on the server still asks for a connector's credentials and starts it.