Managing Integrations

SA integrates a variety of security products to aggregate their detection data and manage all findings in one place.

By default, SA integrates the events from the following cloud services:

Anti-DDoS
Web Application Firewall (WAF)

If you want to aggregate events from other products, click My Recommendations in the upper right corner of the Integrations page and provide details about the product.

This topic walks you through how to manage security product integrations, including enabling and disabling a product integration.

Constraints

An integration can only be enabled or disabled by region.
The account you want to use to enable integrations must have the Tenant Administrator role assigned.

Enabling an Integration

Log in to the management console.
Click in the upper left corner of the page and choose Security & Compliance > Situation Awareness > Integrations.

Figure 1 Integrations
Query the security products you want to aggregate in SA.

Select the Disabled Integrations tab and search for security products you want to enable. For more query methods, see Viewing Integrations.
Start to receive events.

Locate the product whose detection data you want to receive in SA and enable the integration.

About 5 minutes after you enable an integration, you will receive the detection data reported by the product.

To let SA receive the product events properly, ensure that the corresponding protection of the product has been enabled.

Disabling an Integration

Log in to the management console.
Click in the upper left corner of the page and choose Security & Compliance > Situation Awareness > Integrations to go to the Integrations page.

Figure 2 Integrations
Query the security products that have been aggregated in SA.

Select the Enabled Integrations tab and search for security products you want. For more query methods, see Viewing the Integration List.
Stop to receive results.

Locate the product whose detection data you no longer want to receive in SA and disable the integration.