Read-only by default
The agents read rules, alerts and source health through your SIEM's own API.
Integrations
Works with the SIEM you already run.
SOCGenX connects to Wazuh and Elastic today, with Microsoft Sentinel, Splunk, IBM QRadar and Google SecOps in beta on request. Every integration carries its status.
Directory
Integrations and their status.
Beta means the connector runs with design partners and is enabled on request. Early access means we are building it with design partners.
SIEM platforms
- Wazuh Available
- Elastic Available
- Microsoft Sentinel Beta / on request
- Splunk Beta / on request
- IBM QRadar Beta / on request
- Google SecOps Beta / on request
Notifications and approvals
- Slack Early access
How it connects
One connection, inside your environment.
No new pipeline
Your logs stay in your SIEM; nothing is copied out to us.
Built with design partners
New integrations are shaped with the teams that run them.
FAQ
Integration questions.
Which SIEMs does SOCGenX work with?
Wazuh and Elastic, with Microsoft Sentinel, Splunk, IBM QRadar and Google SecOps in beta on request. The agents connect through each SIEM's own API, read-only by default, and your logs stay in your SIEM.
Do we need to move our logs to a new platform?
No. SOCGenX adds no new log pipeline. The agents run in your environment and read rules, alerts and source health from the SIEM you already run.
What if our SIEM or tool is not listed?
Request an integration. Tell us your SIEM and your sources; requests decide what we build next.
Running something not listed?
Tell us your SIEM and your sources. Requests decide what we build next.