Adding a new security category
The bigger the team, the higher the cost of saying yes.
- Quarterly business reviews
- Security review cycles
- Agent rollouts
- Log model changes
- On-call training
- A year of low-grade integration work
INTEGRATIONS · BY STACK LAYER
Plug VerdictIQ into the stack you already run.
One API call adds a verdict, the signals behind it, and a recommended action to your SIEM, SOAR, EDR, SWG or DNS firewall flow. No migration. No agent. No new console.
- One endpoint, every layer. Same response shape, end to end.
- SaaS-only over HTTPS. No on-prem installer, no endpoint agent.
- From API key to first verdict in five minutes. Plain Bearer auth.
- Free tier
- No credit card
- Five-minute setup
- Your stack sendsany indicator
- VerdictIQ returnsverdict + signals + action
- Your stack actsexisting policy, no new console
01 · WHY THIS PAGE EXISTS
Most security teams don't need another platform. They need decisions plugged into the platforms they already run.
Your SIEM ingests logs. Your SOAR runs playbooks. Your EDR holds the endpoint. VerdictIQ doesn't replace any of them. It adds the verdict the rest of the stack is missing.
Adding a verdict, not a vendor
VerdictIQ sits beside the pipeline you already run.
- One HTTP call
- Deterministic risk score
- Signals that produced it
- A recommended action
- Consoles, dashboards and runbooks unchanged
“No migration. No deployment. No agent. Just one API.”
02 · BY STACK LAYER
Four layers. One enrichment call.
Below is the layer-by-layer pattern: where VerdictIQ sits, what it adds, and which vendors we already run alongside via API.
SIEM
Enrichment Step
Enrich the indicator your SIEM already collected. Verdict goes back to the alert as a new field, same alert, deeper context.
- Chronicle
- Elastic
- Microsoft Sentinel
- QRadar
- Splunk Enterprise Security
Fires from a correlation rule, a saved search post-action, or a streaming pipeline macro. Adds verdict, risk_score and recommended_action to the alert payload. Audit trail lives next to the original event.
SOAR
Decision Feed
Drop the verdict into a playbook decision node. Your playbook routes hard, soft or observational actions per your policy.
- Splunk SOAR
- Swimlane
- Tines
- XSOAR
Playbook step calls /enrich, parses signals, branches on signal presence (not just risk_score). Hard branch executes block or quarantine; soft branch upgrades severity; observational branch logs. We propose; the playbook executes.
Read the SOAR mapping guide →EDR / XDR
IOC Loader
Score the IOCs your EDR is about to act on. Bulk verdicts loaded into the IOC feed; per-endpoint decisions stay in the EDR.
- CrowdStrike Falcon
- Microsoft Defender XDR
- SentinelOne Singularity
Bulk pipeline calls POST /enrich_bulk on the IOC custom feed. Verdict and score arrive; the EDR's existing block list policy keys off the score threshold. We do not run on the endpoint.
SWG · DNS Firewall
Verdict Source
Pre-hoc decision before the resolution lands. Stop the lookup, not the click after.
- Cisco Umbrella
- Cloudflare Gateway
- Infoblox
- Netskope
- Quad9
- Zscaler
Inline lookup against the gateway's outbound destination, or domain enrichment fires on first resolution. If verdict crosses the block threshold, the gateway blocks at egress or the RPZ rule sinkholes the lookup, the user never reaches the host. This is the strongest pre-hoc surface in the stack.
All vendor names listed above are property of their respective owners. Listing indicates API compatibility, not partnership or endorsement. Last reviewed: 2026-05-02.
03 · INTEGRATION PATTERN
One pattern. Every layer.
The flow is identical whether the caller is a SIEM enrichment macro, a SOAR playbook task, an EDR feed loader or a DNS firewall verdict source.
- Your stack sends one indicator (POST /enrich) or a batch (POST /enrich_bulk) over HTTPS. Domain, IP, CIDR, ASN or SHA256, same call shape.
- VerdictIQ scores it live, computes the signal trail, picks a recommended action, sub-second, deterministic.
- The response lands back in your stack as a JSON object: verdict, risk_score, recommended_action, signals, evidence.
- Your SOAR playbook, SIEM correlation rule or EDR feed loader reads the response and decides what to execute. We propose. Your stack executes.
- Send →
- POST /enrich/enrich_bulk
- Score →
- Critical · 87
- Decide →
- block_domain
- Act →
- your SOAR / SWG / firewall
04 · HOW WE CONNECT
Four principles. Every layer obeys them.
These are not aspirations. They are the technical contract, what we promise the integration will look like, every call.
API over HTTPS
RESTful HTTPS, Bearer token auth, JSON payload. SaaS-only, there is no on-prem installer, appliance or sidecar. Five indicator types share the same call shape.
No migration, no agent
No log shipping, no endpoint agent, no console to log into. Your SIEM keeps ingesting. Your SOAR keeps executing. Your EDR keeps the endpoint. We add a verdict, not a tool.
Vendor-agnostic
VerdictIQ is not bonded to a specific SIEM, SOAR or EDR. The same response shape lands in Splunk, Sentinel, XSOAR and Tines without branching. If a vendor speaks JSON over HTTPS, the integration works.
SOAR-ready output
The response is shaped to drop straight into a playbook condition: verdict, risk_score, recommended_action, signals, evidence. Hard, soft or observational branches key off either the score or specific signals. No analyst in the middle to interpret the field.
05 · SOAR INPUT ANATOMY
What your playbook actually needs.
Your playbook doesn't see a sentence, it sees a handful of fields. risk_score for thresholds, risk_level for tier-based policy maps, recommended_action for direct policy alignment, plus the signals that fired.
- Same response shape for domains, IPs, ASNs, CIDRs and hashes.
- Your condition node never branches by indicator type, one mapping handles them all.
- Mix indicator types in a single bulk call (POST /enrich_bulk).
- risk_level →
- criticalTier branch: critical, high, medium, low or clean.
- risk_score →
- 87Threshold branch: scores above N trigger hard action.
- recommended_action →
- block_domainPolicy branch: map our action key to your action library.
- signals →
- 3 signals firedBehavior branch: fire on a specific signal regardless of score.
06 · MULTI-TENANT
Same risk language across every tenant.
MSSP and MDR teams run dozens of customer environments. The hard problem is not enrichment, it is consistency. Two tenants, two analysts, the same indicator should produce the same answer. VerdictIQ guarantees that by contract.
Same fields. Same scoring. Same vocabulary.
Determinism is per-input, not per-tenant. The score for a given indicator is identical across every tenant who calls it, no tenant-specific drift, no per-customer model retraining.
Audit-ready signal trail, partitioned per tenant.
Each tenant's calls carry an X-Customer-Id header on the shared master key. The signal, evidence and analyst Q&A trail is identical in shape but partitioned per tenant, your customer review and your internal compliance both pass.
“Decisions stop depending on the analyst, and start depending on the system.”
07 · WHAT WE'RE NOT
Five things this page is not, and one thing it is.
Integration hubs drift toward vendor logo walls and partner badges. We hold a tighter line on purpose.
WHAT THIS PAGE IS NOT
- We do not certify or partner with the vendors listed above. Listing means API compatibility, that's it.
- This is not a marketplace. There is no plugin to install on your SIEM or SOAR side.
- This is not a migration playbook. Vendor-specific rollout instructions live in /docs.
- This is not a replacement story. We are not asking you to drop your SIEM, SOAR or EDR.
- This is not an exhaustive vendor list. If a tool speaks JSON over HTTPS, the integration works, listed or not.
Looking for the technical mapping?
Vendor-specific field mappings (XSOAR, Splunk SOAR, Tines), example payloads and authentication patterns live in the developer docs.
This is the architectural pattern: where VerdictIQ sits, what it adds, and what it deliberately leaves alone.
08 · WHERE THIS LANDS FOR YOU
Pick the seat you sit in. We have a deeper page for it.
Integration mechanics look the same across stacks. The why differs by role. Each persona page picks one job to be done and lays out the proof for it.
Triage 50+ alerts a shift, without leaving the queue.
Every SIEM alert keys off /enrich. Verdict and recommended action are inside the alert payload before the analyst opens it.
Wire scoring into pipelines you already maintain.
SIEM correlation rules, SOAR playbook conditions, EDR feed loaders, CI checks: same response shape, no per-vendor branching in your code.
Deterministic verdicts across every tenant.
Per-tenant isolation via X-Customer-Id, identical response shape, per-call audit trail. Customer reviews and internal compliance read the same evidence.
Triage before investigation. Only chase what scores high.
Pre-hoc verdict filters out the noise; behavioral signals catch zero-day infrastructure that feeds will publish a week from now. Pair with sandbox or OSINT for forensic depth.
09 · NEAR THIS
One more endpoint with the same response shape.
Single-IOC enrichment is one of two product surfaces. The verdict structure stays identical; the access pattern changes, and the integration math changes with it.
Replay yesterday's SIEM decisions at scale.
POST /enrich_bulk takes a day of SIEM verdicts and surfaces the false positives and the false negatives buried in them. Same signal hierarchy, same audit trail. Built for log-pipeline batch jobs and weekly review.
Plug in once. Decide every call.
Get an API key. Send your first IOC. Wire the response into the SIEM enrichment field, the SOAR condition node, the EDR feed loader, the SWG verdict source, the DNS firewall RPZ, same call, every layer.
GDPR alignedLLM-free by defaultOwn infrastructureAudit-ready signal trail
See our security posture →