Integrations¶

WitFoo Conductor collects security log data from cloud platforms, endpoints, identity providers, email security, network infrastructure, and more through pull-based API integrations. The Signal Client service polls each vendor's API on a configurable schedule and publishes artifacts to the processing pipeline.

Quick Start¶

1. Ensure you have the required vendor license and API access (see each guide's Prerequisites section)
2. Create API credentials in the vendor console
3. Open the Conductor UI → Integrations page
4. Select the vendor from the Add Integration dropdown
5. Enter your credentials and enable the integration
6. Validate data flow within 1–2 polling cycles

Integration Catalog¶

Endpoint Security¶

Cloud Security¶

Network Security¶

Identity & Access¶

Email Security¶

SIEM¶

Infrastructure¶

Vulnerability Management¶

Common Configuration¶

All integrations share these common behaviors:

• Polling Interval — Built into each connector and not configurable; each guide lists its connector's interval. Splunk is the exception: its form has a Poll Interval field (seconds)
• Checkpoint Tracking — Signal Client resumes from the last successful position after restarts, avoiding duplicate collection
• Rate Limiting — Built-in respect for vendor API quotas with exponential backoff on HTTP 429 responses
• Enable/Disable — Each integration can be toggled without removing its configuration

Configuration changes propagate within seconds via the NATS KV watch mechanism. No container restart is required.

See also: Integration Management · Signal Client · Common Troubleshooting