> ## Documentation Index > Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt > Use this file to discover all available pages before exploring further. # Introduction to Integrations > Connect your security stack to enable automated detection and response Wirespeed connects to your existing security tools to provide automated threat detection, investigation, and response. Our integrations are designed to work together—combining detection sources with user directories, endpoint managers, and communication platforms to enable a fully automated MDR experience. New to Wirespeed? Start by connecting a [user directory](#user-directories) and a [detection source](#detection-sources) to see our automation in action. ## How Integrations Work When you connect an integration, Wirespeed automatically: 1. **Syncs your data** — We pull user directories, endpoint inventories, and detection history to build context about your environment 2. **Ingests detections** — Security alerts flow into Wirespeed in real-time from your detection platforms 3. **Enriches and triages** — Each detection is automatically enriched with context and triaged using our verdict system 4. **Takes action** — Based on your configured verdicts, Wirespeed can contain threats, notify users via chat ops, or escalate to your team All integrations use secure OAuth or API tokens. We request only the permissions necessary to deliver our service and never store credentials in plain text. ## Webhook Rate Limiting Integrations that deliver data via webhooks are subject to a rate limit of **600 requests per minute per team**. If a team exceeds this limit, Wirespeed will respond with HTTP `429 Too Many Requests` until the rate drops below the threshold. This protects the platform from misconfigured or overly aggressive webhook sources. If you encounter rate limiting, check whether the source system is sending duplicate or unnecessary events and reduce the webhook frequency accordingly. ## Source System Updates When Wirespeed processes a detection, it can sync verdict, status, notes, and comments back to the originating integration. This is called a **source system update**. It keeps your detection platform in sync with Wirespeed's triage decisions. Source system updates are controlled at three levels: ### Integration-Level Control Each integration has a **Source Updates** toggle available from the row actions menu on the [**Integrations**](https://app.wirespeed.co/settings/integrations) page. When disabled, Wirespeed will not sync verdict, status, notes, or comments back to that integration for any detection. ### Team-Level Control Under [**Settings > Team Settings**](https://app.wirespeed.co/settings/team), the **Skip Managed Source Updates** toggle controls whether Wirespeed skips source system updates for detections that are managed by a third party (e.g. CrowdStrike Falcon Complete, SentinelOne Vigilance). This is useful when a third-party managed service is already triaging detections in your security platform. Enabling it prevents Wirespeed from overwriting their work by writing verdicts or comments back to those specific detections, while still syncing updates for detections that are not third-party managed. ### Group-Level Control Groups also have an **Update Source System** toggle. When disabled for a group, detections involving assets in that group will not trigger source system updates. See [Groups](/groups/introduction) for details. If an asset belongs to **any** group that has source system updates disabled, the update is suppressed for detections involving that asset—even if other groups have it enabled. ## Beta Integrations Some integrations are marked as **beta** while we refine their capabilities. Beta integrations work for detection ingestion, asset syncing, and manual actions, but have one important limitation: Auto-containment is not performed for detections from beta integrations. If a detection is generated by a beta integration, Wirespeed will skip automatic containment and escalate the case to your team instead. Manual containment remains available. Beta integrations are labeled in the platform. Once an integration graduates from beta, auto-containment will apply normally. ## Integration Categories EDR, XDR, and SIEM platforms that generate security alerts Identity providers that define your users and their attributes MDM and endpoint platforms that inventory your devices Chat and messaging platforms for user verification Ticket systems for case management and escalation Threat intelligence and data enrichment services *** ## Detection Sources Detection sources are the foundation of Wirespeed. These integrations provide the security alerts that Wirespeed automatically triages and responds to. Connect your EDR, XDR, identity protection, or SIEM platform to get started. Endpoint privilege management and privilege-elevation security events CloudTrail and GuardDuty security events Unified endpoint and email security Extended detection and response Endpoint detection, NG-SIEM, and identity security AI-powered network detection and response Google Workspace security alerts Google Security Operations SIEM detections Google Cloud security findings Anti-ransomware detection and response Autonomous pentesting and attack simulation validation Mac-focused endpoint security Defender for Endpoint, Entra ID Protection, Sentinel, and more Email security and threat protection RMM/MDM alerts, activity telemetry, and device inventory Identity threat detection Cortex XDR/XSIAM alert ingestion and endpoint management Breach and attack simulation validation Cloud security posture and workload protection Breach and attack simulation Agentless Linux detection and host telemetry Autonomous endpoint protection platform Intercept X endpoint detections and event telemetry SIEM detection ingestion Deconflict detections from vulnerability scanning Cloud-native deception platform alerts Honeypot-based intrusion detection Network detection and response Cloud security findings and vulnerability ingestion WordPress security and firewall *** ## User Directories User directories help Wirespeed understand your organization. We sync users, groups, roles, and managers to enrich detections with context and enable features like VIP protection, chat ops escalation, and user containment. Multi-factor authentication directory Privilege Cloud audit events and Identity directory sync Google directory and sign-in logs Directory events with user and endpoint sync Entra ID (Azure AD) directory sync Directory sync with user suspend and re-enable actions Universal directory and SSO PingOne audit activities and risk evaluations Connecting a user directory unlocks automatic VIP detection, manager escalation paths, and user-aware threat context. *** ## Endpoint Management Endpoint management integrations provide device inventory and health data. Wirespeed uses this information to identify critical assets, correlate detections with device context, and enable endpoint containment actions. Device and asset inventory synchronization Host management, isolation, and identity osquery-based device inventory and activity telemetry Endpoint inventory and agent status Apple device management Modern Apple MDM AD audit and endpoint monitoring Cloud-based endpoint management Linux host inventory and enrichment Endpoint inventory and containment *** ## Communication Communication integrations enable [Chat Ops](/chat-ops/introduction)—Wirespeed's ability to verify suspicious activity directly with your users. When a detection requires user verification, we reach out through your existing communication channels. Email-based user notification Send emails from your own domain In-app chat ops experience Direct message users for verification SMS verification is available as an add-on to any communication integration for enhanced identity verification. [Learn more about SMS Chat Ops](/chat-ops/communication-plan#sms-chat-ops). *** ## Ticketing Ticketing integrations sync Wirespeed cases with your existing ticket management system. Cases and detections can automatically create tickets, and updates flow bidirectionally. Professional services automation IT service management ticketing and case sync IT service management ticketing and case sync Atlassian's cloud-hosted Jira Self-hosted Jira deployment Odoo Helpdesk ticket management Incident management and on-call alerting *** ## Enrichment Enrichment integrations provide additional context and threat intelligence to enhance detection triage. These services help identify known-bad indicators and provide reputation data. Credential breach detection IP address geolocation and ASN data File reputation and malware analysis *** ## Log Forwarding For platforms without native integrations, Wirespeed supports standard log forwarding protocols and network-based telemetry sources. These allow you to send security events from any source, including firewalls, network devices, and log aggregation platforms. Password manager audit and sign-in events Organization events and user activity Cloud content management events Next-gen firewall and network security events Cloud-managed network security DNS-layer security DNS-layer security Network and security syslog events Centralized log and analytics Next-gen firewall security events Webhook-based JSON ingestion CEF and standard syslog formats Adversary infrastructure intelligence On-premises Active Directory Standalone Entra ID sign-in data Change request validation for planned maintenance workflows Next-gen firewall security events Webhook delivery for Stairwell detection events Gateway, switch, and access point syslog events VPN authentication, traffic, and alarm syslog events Windows event forwarding ZPA App Connector syslog forwarding *** ## Getting Started Ready to connect your first integration? Here's the recommended order: Start with [Microsoft 365](/integrations/microsoft), [Google Workspace](/integrations/google-workspace), or [Okta](/integrations/okta) to import your users and organizational structure. Connect your primary security platform—[Microsoft Defender](/integrations/microsoft), [CrowdStrike](/integrations/crowdstrike-falcon), or [SentinelOne](/integrations/sentinel-one) are great starting points. Set up [Slack](/integrations/slack) or [Microsoft Teams](/integrations/microsoft-teams) to enable Chat Ops for user verification. Review your [containment settings](/containment/introduction) to enable automated threat response. Need help setting up an integration? Use the **Chat** button in the Wirespeed platform to talk directly with our engineers, or email [support@wirespeed.co](mailto:support@wirespeed.co).