# Integrations

> The providers Vigilbase OS connects to, what each reads, which response actions it supports and how to manage connections.

Source: https://docs.vigilbase.com/os/integrations

**Integrations** is where you connect providers and manage their connections. Open it from the sidebar or press `g` then `n`. You need the `integration.read` permission to see it, and both `integration.manage` and `credential.manage` to add a connection.

> [!IMPORTANT]
> Every connector below is tested against recorded provider data. Validation against live customer tenants is in progress. In the app, **Beta** means a connector has been tested live with real accounts and may still change; **Alpha** means it is built and tested in isolation but not yet proven against a live account.

## Connectors

"Response actions" are the changes Vigilbase can propose for that provider. Every action needs write access that you grant and an approved plan. "Read-only" connectors only collect data.

| Provider | Category | Access | Maturity |
|---|---|---|---|
| [Cloudflare](https://docs.vigilbase.com/os/integrations/cloudflare) | Edge | Read + response actions | Beta |
| Microsoft Entra ID / Microsoft 365 | Identity | Read + response actions | Alpha |
| [CrowdStrike Falcon](https://docs.vigilbase.com/os/integrations/crowdstrike) | Endpoint | Read + response actions | Alpha |
| [Google Workspace](https://docs.vigilbase.com/os/integrations/google-workspace) | Identity | Read + response actions | Beta |
| Okta | Identity | Read + response actions | Alpha |
| [Google Cloud](https://docs.vigilbase.com/os/integrations/google-cloud) | Cloud | Read + response actions | Beta |
| [Amazon Web Services](https://docs.vigilbase.com/os/integrations/aws) | Cloud | Read + response actions | Alpha |
| Microsoft Azure | Cloud | Read + response actions | Alpha |
| Slack (Enterprise Grid) | Collaboration | Read + response actions | Alpha |
| Slack workspace | Collaboration | Read-only | Alpha |
| Microsoft Teams | Collaboration | Read-only | Alpha |
| Microsoft Defender for Endpoint | Endpoint | Read + response actions | Alpha |
| SentinelOne | Endpoint | Read-only | Alpha |
| Microsoft Intune | Device management | Read + response actions | Alpha |
| [NinjaOne](https://docs.vigilbase.com/os/integrations/ninjaone) | Device management | Read + response actions | Alpha |
| Jamf Pro | Device management | Read + response actions | Alpha |
| Microsoft Defender for Office 365 | Email | Read + response actions | Alpha |
| Mimecast Cloud Gateway | Email | Read + response actions | Alpha |
| Proofpoint TAP | Email | Read-only | Alpha |
| Microsoft Sentinel | Security analytics | Read + response actions | Alpha |
| Splunk | Security analytics | Read + response actions | Alpha |
| Tenable Vulnerability Management | Vulnerability | Read + response actions | Alpha |
| Qualys VMDR | Vulnerability | Read-only | Alpha |
| Fortinet FortiGate | Network | Read-only | Alpha |
| Palo Alto Networks NGFW / Panorama | Network | Read-only | Alpha |
| [Ubiquiti UniFi](https://docs.vigilbase.com/os/integrations/unifi) | Network | Read-only | Alpha |

Providers with their own page have setup steps documented here. For the others, the connect wizard in the app lists the fields and permissions each one needs.

## Add a connection

:::steps
1. **Choose Add connection,** then **Select a provider.** Search by name if you need to.
2. **Choose Connect.** Providers marked **One-click** connect by signing in to the provider, launching a CloudFormation stack, running one command in Cloud Shell or following a guided setup in Google Admin. You can always switch to the manual path, for example **Use an API token instead**.
3. **Choose Access.** **Read and write** lets Vigilbase propose response actions. **Read only** means Vigilbase only reads; you can add write access later from the connection page.
4. **Enter credentials if asked.** Secret values are encrypted on receipt and never shown again, logged or sent to Vigil.
5. **Validate, choose scopes and datasets.** On the manual path the wizard runs **Credentials**, **Validate**, **Scopes**, **Datasets** and **Done**. Validation checks which scopes are granted and which datasets and actions are actually available.
:::

When the connection is ready, collection starts for each selected scope. Health, lag and volume appear as data arrives.

## Manage a connection

Open a connection from **All connections** to see its tabs: **Overview**, **Data**, **Response actions**, **Setup & access** and **Activity**.

- **Needs attention** lists anything wrong, worst first, with one fix per item.
- **Collection jobs** shows one job per dataset and scope with its last collection, records in the last 24 hours and retries. **Collect now** requests a collection for a polled job.
- **Manage datasets** changes what is collected. **Check again** re-checks credentials, scopes and dataset availability.
- The **…** menu offers **Add write access**, **Remove write access**, **Reconnect** and **Disable connection**.

A connection's status is one of **Enabled**, **Delayed**, **Degraded**, **Authorisation required**, **Not collecting**, **Disabled**, **Licence required**, **Checking access** or **Setting up**.

### Disable or delete a connection

**Disable connection** stops collection, revokes credentials and marks coverage for dependent detections as disabled. Collected evidence stays under your retention policy. Once a connection is disabled you can choose **Delete connection** to remove it from Integrations. Deleting changes nothing in your provider account.

## Private collectors

A private collector collects generic syslog from private networks and sends it to Vigilbase. Under **Private collectors**, choose **New collector**, give it a **Name** and choose **Create enrollment token**. Save the token straight away; it is short-lived and used once to enrol the collector. The list shows each collector's status, version, last heartbeat and buffer.

> [!NOTE]
> Signed collector releases are not published yet, so private collectors are not ready for general use during the preview.