Connect your stack in minutes

Most connectors are live in under an hour: add credentials, and the manifest handles auth, scheduling, checkpointing, and dedup.

Yes. Every source normalises into the entity graph that ManySignal's agentic SOC reasons over — triage verdicts include cross-source context automatically.

Connector health monitoring flags silent or stalled sources immediately, so gaps never become blind spots.

Yes — connectors are declarative manifests, so new sources ship quickly. Contact us with your stack.

Log ingestion connectors require read-only access to the source system's API or log stream. Response action connectors (for containment — isolate endpoint, disable account, block IP) require scoped write permissions to the specific action types ManySignal will execute. All permissions are documented per integration in the connector setup guide, and principle of least privilege is applied throughout.

All inbound events are mapped to ManySignal's OCSF-aligned entity event model at the connector layer. The connector manifest defines the field mapping from the source schema to the normalised model. This means detection rules and triage logic operate against a consistent schema regardless of source — a user authentication event from Okta and one from Active Directory have the same fields after normalisation.

Connector health monitoring detects authentication failures immediately and raises a health alert in the operations dashboard and to the configured notification channel. A connector that fails authentication stops ingesting events — the platform does not silently drop events without notification. The health alert includes the specific connector, the failure reason, and a link to the credential update flow.

Yes. Multiple instances of the same connector type are fully supported. Each instance is configured independently with its own credentials, scope, and health monitoring. AWS multi-account setups are handled via organisation-level IAM roles that provide read access across accounts from a single connector configuration, or via individual connectors per account.

ManySignal's connector team monitors API deprecation notices and breaking changes from all integrated sources. Connector manifests are updated before API changes take effect, and updates are deployed transparently without customer action. For breaking API changes that require credential re-authorization, customers are notified in advance with the steps required before the deadline.