Integrations

60+ sources. One place to investigate them.

Connect any of these with read-only credentials. Every incoming alert becomes a finished case, cross-checked against your history.

Identity Cloud SIEM & Log EDR & Endpoint Network Email & Collab Threat intel Response

Identity & Access · 9 integrations

Sign-ins, MFA events, admin actions, role changes, SaaS access patterns, session anomalies.

OktaOkta
Microsoft 365Microsoft 365 / Entra
Google WorkspaceGoogle Workspace
Active DirectoryActive Directory
Duo SecurityDuo Security
JumpCloudJumpCloud
Auth0Auth0
Obsidian SecurityObsidian Security
Push SecurityPush Security

Cloud & Infrastructure · 8 integrations

CloudTrail, audit logs, IAM events, storage exposure, CSPM findings, code repositories.

AWSAWS
Google CloudGoogle Cloud (SCC)
CloudflareCloudflare
GitHubGitHub
WizWiz
Orca SecurityOrca Security
PermisoPermiso
StackletStacklet

SIEM & Log analytics · 15 integrations

Native ingestion or bidirectional. Alerts pulled in, cases pushed back as enrichment.

Microsoft SentinelMicrosoft Sentinel
SplunkSplunk
Sumo LogicSumo Logic
ElasticsearchElasticsearch
DatadogDatadog
DevoDevo
OpenSearchOpenSearch
PantherPanther
IBM QRadarIBM QRadar
ExabeamExabeam
GravwellGravwell
Rapid7Rapid7
DarktraceDarktrace
Google ChronicleGoogle Chronicle
Stellar CyberStellar Cyber

EDR & Endpoint · 11 integrations

Process trees, file events, device inventory. AirMDR pulls detections and enriches them with the surrounding stack.

CrowdStrikeCrowdStrike Falcon
SentinelOneSentinelOne
Microsoft DefenderMicrosoft Defender
Cortex XSIAMCortex XSIAM
Trend MicroTrend Micro
Cisco AMPCisco AMP
LimaCharlieLimaCharlie
CyberhavenCyberhaven
JamfJamf
HexnodeHexnode
Kaseya VSA XKaseya VSA X

Network Security · 5 integrations

Flow data, network detections, DLP triggers, secure-access gateway alerts.

ExtraHopExtraHop
ForescoutForescout
ibossiboss
SonicWallSonicWall
ZscalerZscaler

Email & Collaboration · 7 integrations

Phishing, external-share triggers, message-thread investigations. Cases pushed as messages so your team acts in-context.

GmailGmail
Google DriveGoogle Drive
Microsoft TeamsMicrosoft Teams
SlackSlack
MimecastMimecast
Abnormal SecurityAbnormal Security
KnowBe4KnowBe4

Threat intelligence & enrichment · 12 integrations

Auto-queried when an alert names an IP, domain, hash, URL, or CVE. AirMDR pulls reputation, actor context, and CVE metadata into every case.

AbuseIPDBAbuseIPDB
VirusTotalVirusTotal
Recorded FutureRecorded Future
OpenCVEOpenCVE
SOC RadarSOC Radar
MaxMindMaxMind
MalwareBazaarMalwareBazaar
PhishTankPhishTank
SpamhausSpamhaus
APIVoidAPIVoid
IPRegistryIPRegistry
AstrixAstrix

Response & Alerting · 3 integrations

Cases pushed as pages, tickets, or incident timelines so your team acts without leaving their tools.

PagerDutyPagerDuty
Incident.ioIncident.io
OpenAIOpenAI (enrichment)

Don't see your source? We'll build it fast.

Most new integrations ship in under a week. If it has an API, we can usually turn it around in days. Send us the source and any docs you have, and we take it from there. There's no add-on cost.

Request an integration

Connect any source in five minutes.

Read-only credentials. No agents to install. First investigation closes before your coffee gets cold.

Try for free