Connected, deliberately

Platform reach without capability theater.

Threat Foundry states whether each target supports bounded read-only search, rule verification, inventory, validation, or portable export. Provider contact is explicit; provider mutation remains outside the workflow.

Request a demo See how it works

Threat intelligence

Bring intelligence in without surrendering control.

MISP

Bounded, read-only event synchronization through a configured integration. Review normalized entities before downstream use.

Read-only sync

OpenCTI

Bounded, read-only GraphQL intake from a configured server and token. Entity and relationship content stays tenant-owned.

Read-only sync

STIX 2.x

Upload a bounded STIX bundle for review when a live platform connection is not appropriate for the environment.

File intake

Connected platform families

Read-only search, validation, or rule verification—capability by capability.

Configuration, licensed products, tenant policy, permissions, telemetry, mappings, and the selected workflow determine which controls are available.

Splunk

Use configured search and detection workflows with bounded queries, reviewed limits, normalized fields, and current connector readiness.

Read-only operations

CrowdStrike LogScale

Investigate normalized alerts and run explicitly reviewed, time-bounded searches where the tenant connection is ready.

Read-only operations

Microsoft Sentinel

Use the bounded, read-only telemetry query path when the tenant connector is configured. Detection-rule deployment is not implied.

Read-only query

Elastic Security

Use the bounded, read-only telemetry query path when the tenant connector is configured. Detection-rule deployment is not implied.

Read-only query

Google SecOps

Keep UDM Search as the read-only telemetry path and YARA-L as the separate rule-verification target.

Search + verification

Palo Alto Cortex XSIAM

Use allowlisted read operations with the provider's broad-RBAC warning visible during setup and review.

Read-only boundary

Connected does not mean deployed

A connected target may support only some combination of translation, linting, query validation, bounded search, rule verification, or inventory. Threat Foundry does not create, update, enable, disable, delete, or deploy provider content.

Portable detection targets

Prepare a review package when direct validation is not available.

IBM QRadar

Customer-controlled portable export; no provider contact.

Sumo Logic + Devo

Review-package output for the customer's deployment process.

LogRhythm

Portable artifacts with the supported context and limitations attached.

Rapid7 InsightIDR

Export-only handoff rather than simulated validation.

Exabeam

Review package for customer-controlled implementation.

Detection-as-Code packages

Source, generated artifacts, tests, evidence index, approvals, checksums, guidance, and rollback planning.

Exposure + Asset Context

Connect findings to the systems and owners that make them matter.

Qualys VMDR

Bring configured vulnerability and scanner context into KEV and exposure prioritization.

Configured enrichment

Microsoft Defender Vulnerability Management

Use tenant-approved exposure evidence to enrich affected-asset and remediation decisions.

Configured enrichment

Scanner + CMDB files

Upload bounded CSV or JSON findings and business metadata when an API connection is not appropriate.

File intake

Threat Modeling inventory

Seed Threat Blueprints from offline cloud exports.

Export inventory from the customer cloud, inspect the file, and import it without granting Threat Foundry standing cloud credentials.

Amazon Web Services

Import a supported bounded inventory export to propose components, relationships, and security zones for analyst review.

Offline export

Microsoft Azure

Translate supported Azure inventory exports into Blueprint proposals without a live control-plane connection.

Offline export

Google Cloud

Use supported Cloud Asset inventory exports to seed a reviewable architecture model.

Offline export

Bring your own AI

One active route, selected by the customer.

Configure supported providers for the tenant, retain alternatives for later use, and activate exactly one. AI-assisted workflows bind the selected provider and model through Generate → Review → Run so a route change cannot silently redirect an approved handoff.

Exactly one active provider; inactive configurations are never fallback routes
Default, deep-analysis, and background model roles
Every row and field in the reviewed evidence scope is retained without hidden compaction
Reusable credential values are visibly protected; provider, connector, and configuration secrets are never prompt content
No silent provider failover or partial AI verdict when the route or complete handoff is unavailable

Customer provider and data decision

The customer selects the provider, models, account, and reviewed workflow evidence. Saving and using that route confirms acceptance of the provider’s applicable terms, privacy, retention, pricing, and data-handling conditions. Provider-account and model-choice governance remain the customer’s responsibility; Threat Foundry enforces the configured route without silently substituting or approving a provider.

Workflow diagram

BYOAI Provider Routing

Choose provider
Review evidence
Authorize
Bounded contact

Exactly one active provider, role-specific models, secret references, and customer-owned selection.

Operations ecosystem

Connect context and handoff at your pace.

Endpoint and alert context

Use supported normalized alerts and bounded host context for review-first investigation without endpoint response.

Ticketing and cases

Hand reviewed work to configured ticket providers while retaining the internal evidence and decision record.

AI providers

Use the customer-selected route for supported summarization, scoping, drafting, and analysis with visible evidence handoff and review.

API Connect

Manage supported non-secret settings and purpose-bound credential references through tenant-aware configuration.

Field normalization

Map customer aliases into a consistent investigation and detection entity model; draft mappings with Field Builder.

Data + Query Policy

Constrain indexes, sources, fields, time ranges, result limits, overrides, and telemetry expectations before execution.

Availability note

Availability depends on licensed third-party products, current configuration, supported formats, permissions, customer policy, and the exact workflow. Vendor names describe possible interoperability and do not imply partnership, endorsement, certification, or uniform feature parity.

Asset Context

Business context, with its sources attached.

Review normalized asset identity, ownership, criticality, freshness and conflicting source assertions. Select the exact context to retain beside a hunt or Blueprint.

Read-only asset source

ServiceNow CMDB

Selected configuration items through the Table API.

Externally managed OAuth bearer.

Read-only asset source

Jira Service Management Assets Cloud

Selected workspace, schemas, types and attributes.

Externally managed OAuth bearer.

Read-only asset source

Lansweeper

Selected site through the Sites Data API.

Personal access token or OAuth bearer.

Read-only asset source

BMC Helix CMDB

Selected dataset, namespace and classes.

Externally managed AR-JWT.

Read-only asset source

Device42

Brief device inventory and approved field mappings.

API-client bearer or protected read account.

Connection and synchronization requirements

These adapters perform read-only, resumable full synchronization against supported public HTTPS endpoints. Configure approved fields, credentials and freshness before enabling a source. Private-network egress, incremental synchronization, relationship ingestion and automatic token renewal are not included. Missing source records do not prove deletion or retirement.

Vendor instance permissions, schemas and token lifecycle require qualification for your environment. Vendor names identify interoperability; they do not imply certification or partnership.

Detection outputs

Choose by capability and implementation path.

Explore supported analytics, web, network and endpoint outputs. Each artifact keeps its applicability, validation state and customer implementation requirements.

Explore all 27 output representations

Control family

27 output entries across four families

Supported output representations and operating modes
Target	Family	Deliverable	Operating mode
Splunk	Analytics	Saved-search / correlation-search configuration	Connected read-only workflows
CrowdStrike LogScale	Analytics	Humio scheduled-search resource	Connected read-only workflows
Microsoft Sentinel	Analytics	Scheduled Analytics Rule ARM resource	Connected read-only workflows
Elastic Security	Analytics	Detection Engine rule JSON; also usable for supported endpoint data	Connected read-only workflows
Google SecOps	Analytics	YARA-L rule; UDM Search remains a separate hunt target	Connected search / rule verification
Palo Alto Cortex XSIAM	Analytics	Correlation-rule request representation	Connected read-only workflows
IBM QRadar	Analytics	AQL and manual CRE rule blueprint	Offline customer implementation
Sumo Logic	Analytics	Log-monitor request JSON	Offline customer implementation
Devo	Analytics	Alert-definition request JSON	Offline customer implementation
Rapid7 InsightIDR	Analytics	Custom detection-rule request JSON	Offline customer implementation
Exabeam	Analytics	Analytics Rule import template; tenant parameters required	Offline customer implementation
LogRhythm	Analytics	Search JSON and AIE patch representation; existing rule required	Offline customer implementation
Cloudflare WAF	Web	Inactive Rulesets JSON and disabled Terraform	Offline customer implementation
AWS WAFv2	Web	Rule fragment in Count mode; WebACL and priority required	Offline customer implementation
Azure Application Gateway WAF	Web	Disabled custom-rule fragment; policy and priority required	Offline customer implementation
Google Cloud Armor	Web	Preview-mode rule body; policy and priority required	Offline customer implementation
Suricata	Network	Alert-only rule	Offline customer implementation
Snort 3	Network	Alert-only rule	Offline customer implementation
Cisco Secure Firewall	Network	Snort 3 rule and documented policy-import guidance	Offline customer implementation
Fortinet FortiGate IPS	Network	F-SBID signature and disabled/pass CLI blueprint	Offline customer implementation
Check Point IPS	Network	Snort 2.9-compatible source and import guidance	Offline customer implementation
Palo Alto NGFW	Network	Manual custom-vulnerability blueprint; tenant Threat ID required	Offline customer implementation
Trend Micro TippingPoint	Network	Snort source and DV Toolkit conversion guidance	Offline customer implementation
YARA	Endpoint	Content rule for supported file/memory predicates	Offline artifact; no endpoint scan
CrowdStrike Custom IOA	Endpoint	Manual blueprint using tenant-resolved rule schema	Offline customer implementation
Microsoft Defender XDR	Endpoint	Advanced Hunting KQL and custom-detection blueprint	Offline customer implementation
Cortex XDR BIOC	Endpoint	XQL filter and detection configuration blueprint	Offline customer implementation

Validate the artifact. Review the implementation.

Connected capabilities vary by provider, tenant configuration and workflow. Local artifact validation, live provider validation, import readiness and deployment are different states. Offline outputs require customer review and implementation; Threat Foundry does not deploy or mutate provider content.

Architecture evidence

Review a scoped AWS application snapshot.

Architecture Modernization connects application resources, IAM roles and configuration evidence. Imported snapshots support review without an active provider connection.

Live collection requires approved scope and read-only access. Azure and Google Cloud modernization collectors are not included. Evidence collection, AI assistance and hunt execution have separate prerequisites.

Explore scope and prerequisites →

Start with the workflow

Map Threat Foundry to your current stack.

We will identify what can work on day one, what requires a connection, and where offline import or portable export is the safer first step.

Request a working session Get the product brochure