Integration Guide

Jump to bottom

Osmany Montero edited this page Jul 20, 2026 · 3 revisions

The EventProcessor ecosystem can integrate with external systems to enrich data and streamline response workflows.

Threat Intelligence (TI) Platforms

Enrich your events with context from global threat feeds.

ThreatWinds: Native integration via the feeds analysis engine. It automatically correlates events with malicious indicators.
Custom TI Feeds: The architecture is open. You can create your own analysis plugins using the go-sdk to pull indicators from sources like MISP or OpenCTI.

Data Enrichment

Custom Enrichment: You can build custom parsing plugins using the go-sdk to enrich events with metadata from external databases or APIs.

Notifications

Automation of alerts and system messages.

Custom Notification Plugins: Since the architecture is gRPC-based, any external system can be integrated by building a Notification Plugin. This allows bridging to:
- Ticketing systems (JIRA, ServiceNow).
- Messaging platforms (Slack, Teams, Discord).
- Custom internal APIs.

See Custom Plugin Development for details on implementing the Notification gRPC service.