The roster · 26 free · 7 pro · 72 on the roadmap
Pick what you need to protect. Wire it in. Watch it.
You don't have to know what Wazuh is to start. Pick the thing you're worried about — your laptops, your firewall, your DNS, your cloud — expand a card to see the prerequisites and the exact onboard command for each.
Browse connectors
Click any card to see what it does, where to get it, and the install command. Skip to the MITRE matrix below if you already know which tools you want.
Secure my laptops & servers
5 toolsWhat's running on each machine, what files changed, what processes started, what users logged in — the unfakeable signal of host compromise.
Wazuh stable Free
The keystone of your stack. Wazuh agents sit on every laptop and server, watching files, processes, and system events. It's how you know if something on a machine just got compromised — and how you know what changed.
curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh && sudo bash wazuh-install.sh -a
auditd stable Free
Linux's built-in audit recorder. Captures sudo commands, file access, process starts — the unfakeable log of what actually happened on a Linux box. Already installed on most servers; CyberCLI just turns the firehose into signals.
sudo apt install auditd audispd-plugins
osquery beta Free
Query your endpoints with SQL. "Show me every host where Chrome is older than version 130" returns in seconds. Persistence checks, software inventory, process tree — answers questions an EDR can't.
curl -fsSL https://pkg.osquery.io/deb/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/osquery.gpg && sudo apt install osquery
Falco beta Free
Runtime security for Linux and containers. Catches "someone just spawned a shell inside a running container" and "a process is reading /etc/shadow" in real time. CNCF-graduated, container-native.
curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | sudo gpg --dearmor -o /usr/share/keyrings/falco.gpg && sudo apt install falco
ClamAV beta Free
Free, open-source antivirus. Scans downloaded files, email attachments, and mounted storage against a continuously-updated signature database. Not magic, but it catches the boring stuff so you don't have to.
sudo apt install clamav clamav-daemon && sudo freshclam
Watch my firewall & network
6 toolsEvery packet crossing your perimeter, plus the firewall, switch, and AP events that explain why.
pfSense stable Free
The de-facto open-source firewall for SMB and homelab. FreeBSD-based, fully configurable via web UI, runs on anything from a Raspberry Pi to a 10G appliance.
Download ISO from pfsense.org · install to bare-metal or VM · point your network at it
OPNsense Free
pfSense's actively-maintained fork with a faster release cadence. Drop-in equivalent — same filterlog format, same rule semantics. Pick whichever your team prefers.
Download ISO from opnsense.org · install to bare-metal or VM
Suricata beta Free
Watches every packet crossing your network for known-bad signatures and protocol anomalies. The OSS equivalent of a commercial IDS appliance — runs on commodity hardware, no per-Mbps licensing.
sudo add-apt-repository ppa:oisf/suricata-stable && sudo apt install suricata
Zeek beta Free
Turns raw network traffic into searchable structured logs — every DNS query, every TLS handshake, every HTTP request. Where Suricata says "this looks bad," Zeek lets you reconstruct exactly what happened.
sudo apt install zeek
CrowdSec preview Free
Crowdsourced firewall. Reads logs from anything (web server, SSH, mail) and blocks attackers at the network edge based on a shared community blocklist of known bad IPs. Free to use, free to contribute.
curl -s https://install.crowdsec.net | sudo sh && sudo apt install crowdsec
UniFi stable Pro
Ubiquiti's commercial network platform — UDM, UDM-Pro, Dream Machine, USG, UniFi Switches. CyberCLI pulls firewall events + admin audit + client activity from the controller API, and lights up Protect (camera) events as Pro tier matures.
Already deployed Ubiquiti gear? Generate an API key in your UniFi controller → `cybercli onboard unifi`
Monitor my DNS
2 toolsBlock malware + tracker domains for everyone on the network, and search the query log when an IOC drops.
AdGuard Home Free
Self-hosted DNS sinkhole. Blocks tracker and malware domains for everyone on your network, and gives you the query log — invaluable for IOC hunting when someone says "is this domain bad?"
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v
Pi-hole Free
The original DNS-level ad/tracker blocker. Lightweight, Raspberry-Pi friendly, web UI included. Same hunting signal as AdGuard — pick whichever you've already deployed.
curl -sSL https://install.pi-hole.net | bash
Protect my web servers
6 toolsCatch L7 attacks at the edge — probes, scanners, credential-stuffing, OWASP-Top-10 injection.
nginx stable Free
The most-deployed open-source web server / reverse proxy in the world. Access + error logs feed Layer-7 anomaly detection (probes, scanners, credential-stuffing attempts).
sudo apt install nginx
Apache stable Free
The classic LAMP web server. Still everywhere — especially behind cPanel hosting. Combined-log-format ingest with virtual-host discrimination so multi-tenant servers don't blur.
sudo apt install apache2
Caddy beta Free
Modern Go web server with automatic HTTPS. Emits structured JSON access logs that are dramatically easier to parse than combined-log-format. Default-secure config.
sudo apt install caddy
Traefik preview Free
Docker-native reverse proxy / edge router. The default in containerized SMB stacks (compose, Swarm, k3s). Routes by labels, auto-renews TLS.
docker run -d --name traefik -p 80:80 -p 443:443 -v /var/run/docker.sock:/var/run/docker.sock traefik:v3
HAProxy beta Free
Industrial-grade load balancer / reverse proxy. Where deployed, it's the chokepoint for every HTTP and TCP connection — high-value telemetry source.
sudo apt install haproxy
Coraza WAF Free
Open-source web application firewall — the modern successor to ModSecurity. Runs the OWASP Core Rule Set inline at your edge to block SQL injection, XSS, and the OWASP Top 10.
Embed in Caddy/Traefik/HAProxy via the coraza-spoa or caddy-coraza plugin — see coraza.io docs
Secure remote access
3 toolsModern VPN tunnels + mesh access with session and identity telemetry — credential abuse on remote access surfaces in the case lifecycle.
WireGuard beta Free
Modern kernel-space VPN. Tiny attack surface, fast handshake, journald-logged session events — the security stack's preferred remote-access tool.
sudo apt install wireguard wireguard-tools
OpenVPN preview Free
The classic OSS VPN — still the #1 remote-access vector for SMBs. Connection + authentication events are critical for credential-stuffing detection on the perimeter.
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh && sudo bash openvpn-install.sh
Tailscale
Coming soon
Free
WireGuard-based mesh that turns every device into a peer-addressable node on a private tailnet. Generous free tier — 3 users + 100 devices, ACLs, exit nodes, identity-backed access, and full Network Logs included on Personal plans. The security event surface of a fleet-scale VPN with the operational simplicity of a chat app.
Plan + scope on the detail page; install instructions land when the connector pack ships.
Run identity in-house
1 toolSelf-hosted identity broker — every login, token, and admin action audit-logged for free. Okta-grade telemetry without the Okta bill.
Keycloak beta Free
Open-source identity broker — the on-prem alternative to Okta and Auth0. Realms, OIDC clients, federation hops, admin-console changes. Every login, every token, every role change is an audit event you can read like the IdP saw it.
podman run --name keycloak -p 8080:8080 quay.io/keycloak/keycloak start-dev
Catch intruders before they pivot
2 toolsTripwires and honeypots that produce zero false positives by design — any hit is a high-confidence intruder.
OpenCanary preview Free
A tripwire daemon. Fakes services (SSH, HTTP, MySQL) that should never get touched on your network — any connection attempt is high-confidence intruder, with zero false positives.
sudo apt install python3-virtualenv && python3 -m venv canary && canary/bin/pip install opencanary && canary/bin/opencanaryd --copyconfig
Cowrie preview Free
Interactive SSH/Telnet honeypot. Records full attacker sessions — every credential they try, every command they run. Combine with OpenCanary for layered deception.
git clone https://github.com/cowrie/cowrie && cd cowrie && python3 -m venv cowrie-env && source cowrie-env/bin/activate && pip install -r requirements.txt
Find vulnerabilities before attackers do
1 toolScan containers, IaC, and filesystems against the CVE feed; turn the output into prioritized signals.
Trivy preview Free
Scans containers, filesystems, and infrastructure-as-code for known vulnerabilities and misconfigurations. CI-friendly defaults, generates SBOMs, makes patch-priority decisions easy.
sudo apt install trivy # or: brew install trivy
Watch the hypervisor
1 toolVM lifecycle events from your virtualization platform — who spawned what, who exfilled which disk image.
Proxmox VE Free
Open-source virtualization platform — the post-Broadcom-VMware migration target for SMBs. Cluster-wide audit events from the API give you VM lifecycle visibility.
Download ISO from proxmox.com · install to bare-metal · `cybercli onboard proxmox`
Cover cloud identity & email · Pro
4 toolsThe credential-access perimeter for orgs running on Microsoft, Google, or Okta — plus Avanan for post-delivery email security. The layer your OSS stack physically can't see.
Microsoft 365 Pro
The default identity perimeter for most SMBs. Pulls Entra ID sign-in events, audit log, risky-user signals, mailbox audit — everything Microsoft already tracks, just routed into your sovereign SOC instead of Microsoft's.
Already on M365? Create an Entra app registration with Reports.Read.All → `cybercli onboard m365`
Google Workspace
Coming soon
Pro
The Google-shop equivalent of the M365 lane. Admin SDK Reports API delivers login, drive, mobile, and token activity into your CyberCLI case lifecycle.
Plan + scope on the detail page; install instructions land when the connector pack ships.
Okta
Coming soon
Pro
Dedicated identity provider. Okta's SystemLog API delivers every authentication, MFA challenge, group change, and admin action — the credential-access keystone for orgs that don't centralize on M365 or Workspace.
Plan + scope on the detail page; install instructions land when the connector pack ships.
Avanan beta Pro
Cloud email security from Check Point. Post-delivery phish + BEC + URL-payload detection on M365 and Google Workspace. Pulls quarantine verdicts, malicious-URL hits, and impersonation flags into the same case lifecycle as your endpoint + network signals — so when Wazuh fires on a suspicious PowerShell, you already know if the kill chain started with email.
Already on Avanan? Generate an API token in the Avanan portal — provisioned through the guided flow when you activate Pro.
Cloud-native EDR for endpoints · Pro
2 toolsIf you already pay for Falcon or SentinelOne, route their detection stream into the same case lifecycle as everything else.
CrowdStrike
Coming soon
Pro
The cloud-EDR you don't have to run. Falcon's Event Streams API delivers detection telemetry without you owning the data plane — your sovereignty is intact at the SOC layer.
Plan + scope on the detail page; install instructions land when the connector pack ships.
SentinelOne preview Pro
The other big SMB cloud-EDR option. Singularity Activity API delivers autonomous-response telemetry into the same case lifecycle as your OSS connectors.
Already on SentinelOne? Generate an API token with Viewer scope — provisioned through the guided flow when you activate Pro.
MITRE ATT&CK coverage
Free gives host + network visibility across 14 of 14 MITRE tactics. Pro adds cloud-identity, commercial-EDR, and UniFi-network telemetry — deepening tactics Free only sees host-side, like cloud credential access and lateral movement, and widening the rows below.
| Connector | Category | Tier | Recon | ResDev | Access | Exec | Persist | PrivEsc | Evade | Creds | Discov | Lateral | Collect | C2 | Exfil | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Free · OSS · 26 connectors | ||||||||||||||||
| Wazuh | Host & Endpoint | Free | ||||||||||||||
| auditd | Host & Endpoint | Free | ||||||||||||||
| osquery | Host & Endpoint | Free | ||||||||||||||
| Falco | Host & Endpoint | Free | ||||||||||||||
| ClamAV | Host & Endpoint | Free | ||||||||||||||
| Suricata | Network & IDS | Free | ||||||||||||||
| Zeek | Network & IDS | Free | ||||||||||||||
| CrowdSec | Network & IDS | Free | ||||||||||||||
| pfSense | Firewall | Free | ||||||||||||||
| OPNsense | Firewall | Free | ||||||||||||||
| AdGuard Home | DNS | Free | ||||||||||||||
| Pi-hole | DNS | Free | ||||||||||||||
| nginx | Web edge & WAF | Free | ||||||||||||||
| Apache | Web edge & WAF | Free | ||||||||||||||
| Caddy | Web edge & WAF | Free | ||||||||||||||
| Traefik | Web edge & WAF | Free | ||||||||||||||
| HAProxy | Web edge & WAF | Free | ||||||||||||||
| Coraza WAF | Web edge & WAF | Free | ||||||||||||||
| WireGuard | VPN & remote access | Free | ||||||||||||||
| OpenVPN | VPN & remote access | Free | ||||||||||||||
| Tailscale | VPN & remote access | Free | ||||||||||||||
| OpenCanary | Deception | Free | ||||||||||||||
| Cowrie | Deception | Free | ||||||||||||||
| Trivy | Vulnerability scanner | Free | ||||||||||||||
| Proxmox VE | Hypervisor | Free | ||||||||||||||
| Keycloak | Identity (self-hosted) | Free | ||||||||||||||
| ↑ Upgrade to Pro · 7 cloud-identity + EDR + network-gear connectors | ||||||||||||||||
| UniFi | Network gear | Pro | ||||||||||||||
| Microsoft 365 | Cloud Identity & Email | Pro | ||||||||||||||
| Google Workspace | Cloud Identity & Email | Pro | ||||||||||||||
| Okta | Cloud Identity & Email | Pro | ||||||||||||||
| Avanan | Cloud Identity & Email | Pro | ||||||||||||||
| CrowdStrike | Cloud EDR | Pro | ||||||||||||||
| SentinelOne | Cloud EDR | Pro | ||||||||||||||
MITRE ATT&CK Enterprise v17 · capability mode (not telemetry mode) · single source: src/cybercli/coverage/mitre.py
Notification channels · 32 ways to be told
The outbound side of the engine — the Herald role's reach. When CYCON elevates, the right channels fire per a per-state routing matrix you control. CYCON 2/1 alerts stay in a durable repeat-until-ack loop until an operator clicks "I'm on it" — every fire, ack, and de-escalation lands in the hash-chained audit log. Open any channel for where to get it, how to connect, and when to use it.
Free · 17 sovereign / self-hosted / scriptable · Pro · adds 6 chat · push · ticket · Business · adds 9 paging · ITSM · escape-hatch
◐ Email (SMTP) Free
Any SMTP server. Sends through your provider; nothing routes through us.
Any SMTP server you already have — your mail provider, a relay, or a self-hosted Postfix.
Slack Free
Incoming webhook to any channel. The URL is the credential — vault-stored.
Your own Slack workspace — create an Incoming Webhook for the target channel.
Discord Free
Homelab + small-MSP default. BYO channel webhook, rich embeds.
Your own Discord server — a channel webhook (Server Settings → Integrations → Webhooks).
Telegram Free
Bot API push, instant and free — no per-message cost. The homelab + EU-MSP default.
A Telegram bot you create with @BotFather (free), plus your chat/group id.
ntfy Free
Open-source push. Self-host for full local sovereignty (mobile + desktop apps).
Self-host the open-source ntfy server (or use ntfy.sh). github.com/binwiederhier/ntfy
Gotify Free
Your own self-hosted push server. The simplest "your own Pushover."
Self-host the open-source Gotify server. github.com/gotify/server
◐ Webhook (HMAC) Free
Generic signed POST to any URL. Optional HMAC-SHA256; custom body templates.
Any HTTP endpoint you control — n8n, Node-RED, a Lambda, your own service.
◐ Local command Free
Run a script with the payload on stdin. Maximum sovereignty — never leaves the box.
A script on the CyberCLI host — bash, python, anything executable.
MQTT Free
Publish to your broker. Unlocks Home Assistant, Node-RED, wallboards, lights.
Your own MQTT broker — Mosquitto, EMQX, or the one inside Home Assistant.
◐ RSS / Atom Free
A token-scoped local feed of CYCON + cases. Boring, durable, scriptable.
Served by CyberCLI itself on your LAN — a token-scoped feed URL.
◐ Syslog / CEF Free
Forward alerts to the SIEM you already run — RFC5424 or CEF, no cloud.
Your existing syslog collector / SIEM — Splunk, Elastic, Graylog, Wazuh itself.
Home Assistant Free
Bridge to physical + ambient alerting — the CYCON desk light recipe.
Your Home Assistant instance (and optionally a smart bulb, Blink(1), or Luxafor).
Microsoft Teams Pro
Incoming Webhook → Adaptive Card, themed by urgency. SMB table-stakes.
Your own Teams channel — an Incoming Webhook (or Workflows connector).
Matrix / Element Pro
Federated, self-hostable, E2EE-capable team chat. The sovereign Slack.
Your own Matrix homeserver (Synapse/Dendrite) or any server you trust.
Pushover Pro
Push with native repeat-until-ack on emergency priority.
A Pushover account (one-time app fee) + an application token.
SMS (Twilio) Pro
BYO Twilio account; a CyberCLI-hosted relay is available at Business+.
Your own Twilio account + a sending number (or Hosted Relay at Business+).
GitHub / GitLab issues Pro
Open + sync an issue per case. The technical team's ticket system.
Your GitHub/GitLab repo (cloud or self-hosted GitLab/Forgejo) + a scoped token.
◐ Browser Web Push Pro
Mobile-grade alerts in the browser — before the native app ships. No app store.
Any modern browser (desktop or mobile) — no install, no app needed.
PagerDuty Business
Events API v2 — native ack + escalation policies via your PagerDuty account.
Your PagerDuty account + an Events API v2 integration key.
Opsgenie Business
Atlassian-shop paging alternative — alerts, schedules, escalations.
Your Opsgenie account + an API integration key.
Voice (Twilio) Business
Outbound voice paging. Voicemail-detected → marked failed → loop re-fires.
Your Twilio account + a voice-capable number (or Hosted Relay).
Apprise Business
Escape hatch to 100+ community destinations via one adapter. Self-hosted URLs supported.
The open-source Apprise library (github.com/caronc/apprise) — point it at any of its targets.
Telegram Free
Your own bot, your own chat. Fast, free, everywhere.
Your own Telegram bot (create one with @BotFather) and the target chat id.
Signal Free
End-to-end encrypted, self-hosted via signal-cli. Nothing but the message leaves.
A self-hosted signal-cli / signal-cli-rest-api instance with a registered number.
Matrix Free
Federated, self-hostable chat. Point it at your own Synapse homeserver.
A Matrix homeserver (yours or any) + a bot access token and room id.
Mattermost Business
Self-hosted Slack alternative. Incoming webhook to your own server.
Your self-hosted Mattermost server + an incoming webhook URL.
Rocket.Chat Business
Self-hosted team chat. Incoming webhook to your own instance.
Your self-hosted Rocket.Chat instance + an incoming webhook URL.
Zulip Business
Threaded team chat. Bot API to your stream/topic.
A Zulip organization (self-hosted or cloud) + a bot's email/API key and stream/topic.
Google Chat Business
Google Workspace spaces. Incoming webhook to your space.
A Google Chat space with an incoming webhook URL.
Gotify Free
Self-hosted push server. The sovereign ntfy alternative.
A self-hosted Gotify server + an application token.
Home Assistant Free
Homelab-native. Fire a notify service or flip a light on CYCON change.
Your Home Assistant instance + a long-lived access token.
Opsgenie Business
Atlassian on-call paging. Wake the right person on a real incident.
An Opsgenie account + an API integration key.
Engine truth: src/cybercli/delivery/framework.py · adapter SDK ships with v1.2 · self-register new channels in one file
Build your stack
Tap the tools you run. See your live MITRE ATT&CK coverage — and get the exact commands to wire each one into CyberCLI.
— pick tools above —
Shipping next
Roadmap · 72 more in the queue
The connectors we're planning across 14 categories — physical security (cameras, alarms), MSP toolchain (RMM, PSA), backup, MDM, commercial network edge, SaaS storage, compliance, cloud security, additional EDR/XDR, SIEM, identity, vulnerability management, and email. Proposed tier per item; tell us what to ship first.
Cameras & Video Surveillance
Coming soon · 5Bring physical-security feeds into the same SOC as your cyber telemetry. Person/vehicle/loitering events flow into the same case lifecycle as firewall alerts.
- Free Frigate NVR · Open-source NVR with on-device object detection. The natural first physical-security connector.
- Pro UniFi Protect · Already deployed UniFi gear? Pull person/vehicle events from the Protect API — same Pro license as the network lane.
- Pro Synology Surveillance Station · Common SMB NVR. Camera event + motion API ingest.
- Pro Blue Iris · Windows NVR with broad camera-vendor support. Webhook-out for events.
- Pro Reolink / Axis / Hikvision · Per-vendor camera APIs. Direct ingest where no NVR sits in front.
Alarm Panels & Physical Sensors
Coming soon · 4Door, window, motion, glass-break — make the physical-intrusion signal cross-correlate with the cyber-intrusion signal in one operator console.
- Free Home Assistant security · Universal smart-home broker. One bridge to Z-Wave / Zigbee / Matter door + motion sensors.
- Free Konnected · Retrofits hardwired alarm panels (Honeywell, DSC, 2GIG) onto IP without ripping wire.
- Pro Ring / SimpliSafe · Cloud-based residential alarm — webhook ingest of door/window/intrusion events.
- Business Bosch / DSC / Honeywell IP · Commercial alarm panels with IP receivers. Contact-ID over network ingest.
RMM / PSA / Ticketing
Coming soon · 7The MSP toolchain. If you manage customers' endpoints with RMM and tickets with PSA, security signals belong in the same workflow your techs already live in.
- Business NinjaOne · Modern RMM popular with sub-200-endpoint MSPs. Two-way: ingest device events, push CyberCLI alerts as tickets.
- Business ConnectWise Manage / Automate · The legacy MSP heavyweight. Ticket sync + asset reconciliation.
- Business Datto RMM / Autotask · Kaseya-owned RMM + PSA stack. Common in larger MSPs.
- Business Kaseya VSA · Enterprise-class RMM. Asset + agent telemetry ingest.
- Business HaloPSA · The clean modern PSA. Ticket creation + correlation against CyberCLI cases.
- Pro Atera · All-in-one RMM+PSA popular with small MSPs.
- Pro Syncro · RMM + PSA + invoicing for break-fix and managed shops.
Backup & Disaster Recovery
Coming soon · 5Backups are an attacker's last target before they detonate — backup-job failures and unauthorized backup deletions are the highest-signal events in an incident.
- Pro Veeam Backup & Replication · The enterprise backup standard. Job + repository + immutability events.
- Pro Acronis Cyber Protect · Combined backup + endpoint security. Webhook + API ingest of job + threat events.
- Free Synology Active Backup · Common SMB backup target. Snapshot + replication + immutable-lock event ingest.
- Free Restic / Borg / Kopia · OSS backup tools. Job-success + repository-tamper telemetry.
- Business Azure Backup / AWS Backup · Cloud-native backup orchestrators. Vault events + restore-test outcomes.
MDM & Device Management
Coming soon · 5Mobile + laptop fleet posture: encryption status, jailbreak/root, missing patches, compliance drift — the things your EDR doesn't tell you because the device isn't reporting in.
- Pro Microsoft Intune · The M365 device-management lane. Compliance + enrollment + remote-action events.
- Pro Jamf · Mac-first MDM. The de-facto choice for Apple-heavy orgs.
- Pro Kandji · Modern Mac MDM with strong compliance + automation primitives.
- Pro Mosyle · Mac/iOS MDM popular with education + SMB.
- Business ManageEngine MDM · Cross-platform MDM. Common in mid-market.
Network & Security Edge (commercial)
Coming soon · 8The commercial firewall, SD-WAN, and ZTNA vendors your customers actually run. Free tier covers pfSense/OPNsense; this is the paid-vendor lane for everything else.
- Pro Fortinet FortiGate · The dominant commercial firewall in mid-market. FortiGate syslog + FortiAnalyzer API ingest.
- Pro Cisco Meraki · Cloud-managed Cisco network. MX firewall + MR wireless + MS switch event ingest.
- Business Palo Alto Networks NGFW · The enterprise NGFW. PAN-OS API + Cortex Data Lake ingest.
- Pro SonicWall · Common SMB firewall vendor. Syslog + Capture Security Center event ingest.
- Pro Sophos Firewall · Sophos Central API for firewall + endpoint correlation.
- Pro Tailscale audit · The modern mesh VPN. Audit log API + tailnet ACL change ingest.
- Pro Cloudflare Zero Trust · Cloudflare Access / Tunnel / Gateway logs. The ZTNA lane for cloud-native orgs.
- Business Zscaler · ZIA + ZPA logs. The enterprise SASE option.
SaaS & Cloud Storage
Coming soon · 5Where your data actually lives in 2026. S3 buckets, Drive folders, Dropbox shares — high-value targets you currently can't see into.
- Pro AWS S3 CloudTrail · Object-level access events. Detect unauthorized GetObject / mass-download / public-bucket drift.
- Pro Box · Enterprise file collaboration. Events API for file access + sharing + admin activity.
- Pro Dropbox Business · Team + business plan event log + Tasks API ingest.
- Pro Google Drive · Drive activity events surfaced from Workspace audit (already on Workspace? this comes for free).
- Pro OneDrive for Business · M365 SharePoint + OneDrive file activity (already on M365? this comes for free).
Compliance & GRC
Coming soon · 5Your auditor doesn't speak CYCON. Map the same evidence chain to SOC 2 / HIPAA / PCI / ISO controls automatically.
- Business Vanta · SOC 2 / ISO 27001 automation. API for control evidence + finding sync.
- Business Drata · Same category as Vanta. Compliance posture sync + evidence automation.
- Business Hyperproof · Multi-framework GRC. Audit-ready evidence + cross-framework control mapping.
- Business Sprinto · Compliance automation. Direct push of CyberCLI control evidence into Sprinto's framework.
- Free OpenComply · Open-source compliance scanning. CIS / NIST / PCI checks against your live infra.
Cloud Security & CSPM
Coming soon · 5Cover the cloud accounts that don't fit M365/Workspace — AWS, GCP, Azure infra, plus the CSPM vendors that already watch them.
- Pro AWS GuardDuty · AWS-native threat detection. Finding stream into CyberCLI cases.
- Pro Microsoft Defender for Cloud · Azure-native CSPM + workload protection alerts.
- Pro GCP Security Command Center · Google Cloud's centralized finding stream.
- Business Wiz · Agentless multi-cloud CSPM. Inventory + finding sync via Wiz API.
- Business Lacework / Orca / Snyk · Other CSPM + DevSecOps platforms common in growing SMBs.
Enterprise EDR / XDR (additional)
Coming soon · 4Beyond CrowdStrike + SentinelOne, the other commercial endpoint platforms our buyers already run.
- Pro Microsoft Defender for Endpoint · M365 E5's bundled EDR. ATP API for alerts + machine timeline.
- Pro Sophos Intercept X · Sophos Central API for endpoint detection events.
- Business VMware Carbon Black · Carbon Black Cloud feed. Still common in mid-market.
- Business Cybereason / Trellix / Cylance · The remaining major commercial EDRs we'll add by demand.
SIEM & Observability
Coming soon · 5Some shops keep their existing SIEM and want CyberCLI as the agentic SOC layer on top. Don't make them rip and replace.
- Business Splunk · HEC ingest + search-API outbound. Sit alongside, don't compete.
- Pro Elastic Stack · Elasticsearch ingest + Kibana cross-link for incidents.
- Business Sumo Logic · SaaS SIEM ingest + alert forwarding.
- Business Datadog Security · If you already log to Datadog, route security signals into CyberCLI cases.
- Business Cribl Stream · Vendor-agnostic data fabric. Inline route + reshape for ingest.
Identity & Auth (additional)
Coming soon · 5Beyond Okta / M365 / Workspace — the password managers, MFA, and OSS IdPs SMBs actually deploy.
- Pro Duo Security · Cisco's MFA. Admin API for auth + factor events.
- Pro 1Password Business · Events API for sign-in + item-access activity.
- Pro Bitwarden Business · OSS-rooted password manager. Event-log API ingest.
- Free Authentik / Keycloak · Self-hosted OIDC/SAML IdPs. Free-tier alternative to commercial IdP.
- Pro YubiKey / WebAuthn · Hardware-key issuance + usage telemetry from your IdP of choice.
Vulnerability Management
Coming soon · 5Beyond Trivy for containers — the network + asset scanners that drive your patch program.
- Pro Tenable Nessus · Industry-standard vulnerability scanner. Tenable.io API for finding sync.
- Business Qualys VMDR · Cloud-based asset + vulnerability platform.
- Business Rapid7 InsightVM · Real-time vulnerability + risk scoring API.
- Free OpenVAS / Greenbone · OSS vulnerability scanner. Free-tier alternative to Nessus.
- Free Nuclei · Template-driven scanner. Great for continuous external-surface monitoring.
Email Security
Coming soon · 4Phishing is still the #1 initial-access vector. Pull verdicts from the gateway that fronts your mail.
- Business Proofpoint · Enterprise email gateway. Threat detection feed for ingest.
- Business Mimecast · Secure email gateway with API for finding sync.
- Pro Microsoft Defender for Office 365 · MDO for the M365 shop. Threat protection alerts.
- Pro Vade Secure · M365/Google add-on AI email security.
Roadmap items are intentional scope, not commitments to dates. We ship breadth first, then depth on the connectors design partners actually run.