Point it at what you run.
Choose the surfaces you own. Cantina handles discovery, triage, and remediation across every one of them.
Or name your own
The three roles an integration plays
Every integration is one of three things to an agent, and many are more than one.
-
Signals in
Sources that raise alerts, like CrowdStrike detections, GuardDuty findings, or Dependabot alerts.
-
Context
What agents read to make sense of an alert: asset ownership, runbooks, logs, and history.
-
Actions out
Where agents act next, like containing an endpoint in CrowdStrike, merging a GitHub PR, or paging on-call in PagerDuty.
Every integration gives your agents tools to work with, and everything you connect feeds The Brain, Clarion's security memory layer. That's what lets agents connect weak signals across separate systems into a single conclusion.
Where teams plug in
A sample across the stack, not the full catalog. Anything missing can connect through a webhook or MCP.
-
Cloud & Infra
- AWS
- Google Cloud
- Vercel
- Cloudflare
-
Identity
- Okta
- Entra ID
- 1Password
- JumpCloud
-
Endpoint & XDR
- CrowdStrike
- SentinelOne
- Defender
- Huntress
-
Code & AppSec
- GitHub
- Dependabot
- Apex
- Cantina
-
Observability
- Datadog
- Grafana
- Splunk
- Better Stack
-
Knowledge & Tickets
- Notion
- Confluence
- Jira
- Slack
You're never limited to the catalog
Three open paths mean almost anything can feed Clarion, act through it, or drive it as code.
-
Generic webhook
Any JSON POST becomes a triaged alert, including tools that have no connector.
-
Custom MCP
Connect an MCP server and agents can call your own tools during investigation and response.
-
MCP access
Drive the whole workspace as code, from any external MCP client.
Every connection uses encrypted credentials and scoped, revocable, audited access, and you connect only the servers you trust. Trust, governance & safety →
Don't see your tool?
Our integration roadmap follows what customers actually use. Tell us what's in your stack and we'll build for it.