Integrations
Works with the tools you already run.
Alerts and the evidence log go only to destinations an Admin configures, each filtered to what its team acts on. Every destination is checked before each connection, and secrets never appear in what is sent. Delivery is built; the setup screen is in development, so destinations are added through the appliance’s API today.
Everything it works with.
Text names, not logos: there are no partnerships, and a logo would suggest one.
What this shows
The GigID Labs Appliance sits in the middle. Arrows go out from it, only to systems an Admin configures: SIEM and logs (Splunk, Microsoft Sentinel, Syslog); Chat (Microsoft Teams, Slack); Email, paging, SNMP and webhooks (Email, PagerDuty, SNMP, Webhook); Ticketing and PSA (ServiceNow, ConnectWise, Autotask, HaloPSA); Exports (CSV, NDJSON). One dashed arrow comes in: device lists to reconcile (Active Directory, Microsoft Entra ID, Microsoft Intune, CrowdStrike, Microsoft Defender, DHCP, Spreadsheet), imported as files or pulled from your own Microsoft tenant; an import never approves a device. GigID Labs is refused as a destination: there is no connection to it.
SIEM and logs
Alerts and the whole evidence log, in order. A SIEM that was down gets what it missed.
- SplunkHTTP Event Collector
- Microsoft SentinelLogs Ingestion API
- SyslogRFC 5424, CEF, LEEF 2.0 over TLS
Chat
Alerts where your team already talks.
- Microsoft TeamsWorkflows, Adaptive Cards
- SlackBlock Kit messages
Ticketing and PSA
One ticket per device per destination. A retry finds the ticket it already opened.
- ServiceNowTickets
- ConnectWisePSA tickets
- AutotaskPSA tickets
- HaloPSATickets
Email, paging, SNMP and webhooks
Your own mail relay, PagerDuty pages that resolve when the alert does, SNMPv3 notifications your NMS acknowledges, or a signed webhook to anything else.
- EmailYour relay, STARTTLS required
- PagerDutyTrigger and resolve
- SNMPInforms or traps to your NMS
- WebhookSigned request
Device lists to reconcile
Compared with what is really on the wire. An import never approves a device.
- Active DirectoryCSV or LDIF export
- Microsoft Entra IDCSV, or opt-in Microsoft Graph
- Microsoft IntuneCSV, or opt-in Microsoft Graph
- CrowdStrikeCSV export
- Microsoft DefenderCSV export
- DHCPISC dhcpd leases, Kea JSON
- SpreadsheetYour own CSV
Exports
Seven lists, the same columns in the interface and on the command line.
- CSVFormula-safe
- NDJSONOne record per line
Product names are trademarks of their owners. Listing them does not mean a partnership or an endorsement.
Delivery
An alert that is raised is delivered, or the log says why not.
- Each new alert is queued in the same database transaction that raised it, so nothing is lost between the two.
- Each destination has a minimum priority, a rate limit and an on/off switch. A paused destination keeps queuing.
- Each destination can have filters: only, or never, alerts about a vendor, subnet, site, switch, port, VLAN or evidence tier. A vendor rule never holds back a clone, impersonation, tripwire or not-approved alert, and a filtered alert is a line in the delivery log, not a silent drop.
- A slow or unreachable destination never delays the others. Retries back off from 30 seconds to an hour, for up to 72 hours, then the item is set aside with a code that says how to fix it.
- The audit stream sends every log entry in order, checkpoints included. Its cursor moves only on success, so a SIEM that was down for a week receives what it missed.
- One ticket per device per destination, ever. A retry searches for its own marker before opening a ticket.
- Every final delivery result, and every change to where data goes, is an entry in the audit log.
- Syslog
- Over TLS on 6514, RFC 5424 octet counting; RFC 5424, CEF or LEEF 2.0. Every line carries the entry hash.
- Splunk
- HTTP Event Collector, batched.
- Microsoft Sentinel
- Logs Ingestion API, to a custom table, with Entra client credentials.
- Teams and Slack
- Teams Workflows (Adaptive Cards) and Slack Block Kit messages.
- Ticketing
- ServiceNow, ConnectWise, Autotask and HaloPSA. New devices open tickets.
- PagerDuty
- Events API v2: a trigger when an alert is raised and a resolve when it resolves, one deduplication key per alert.
- SNMP
- SNMPv3 informs (acknowledged, so retried) or traps to your NMS on UDP 162, with the MIB to load. SNMPv2c only as a logged exception.
- Through your own relay, with STARTTLS required on 587 or TLS on 465.
- Webhook
- JSON signed with HMAC-SHA256 over timestamp and body, with an idempotency key.
Outbound safety
It sends only where you point it, and nowhere else.
- Every host is resolved when it is saved, and the address actually dialled is checked again on every connection.
- Loopback, link-local (where cloud metadata lives), multicast, reserved and documentation addresses, and the appliance’s own, are always refused.
- Private ranges need an explicit opt-in, and then only the addresses approved at save.
- Redirects are never followed, proxy settings from the environment are ignored, and any host under gigidlabs.com is refused.
- Secrets are sealed with AES-256-GCM and write-only: the settings show their names, never their values. Every payload and error message is scrubbed of them.
- TLS 1.2 or later everywhere, with an optional private CA bundle for internal receivers.
Who can see this
Destinations are added and changed by an Admin, with an authenticator code. An Examiner can see every destination and its delivery log, read-only, so an examiner sees everything that leaves the box.
Scripts and monitoring
Exit codes your RMM and monitoring already understand.
The read-only command-line modes run beside a live appliance and return codes a scheduler can act on.
- appliance segments
- Exit 0 when no blind spot is found, 9 when there are findings.
- appliance metrics -fail-on-miss
- Exit 0 when every policy target was met, 9 when one was missed.
- appliance audit
- Exit 0 when the log is clean, 8 when it found problems, each named by entry.
- appliance verify
- Exit 0 PASS, 3 UNKNOWN SIGNER, 4 TAMPERED, 5 HISTORY REWRITTEN, 6 INCONSISTENT, 7 MALFORMED, 8 HISTORY NOT CHECKED.
- appliance report-verify
- Exit 0 PASS, 10 NUMBERS DIFFER when a figure does not follow from the signed log.
- appliance export
- Writes devices, alerts, decisions, audit, coverage, polls or reviews as CSV or NDJSON, and prints the SHA-256.
appliance segments -data-dir /var/lib/appliance -json# exit 9 raises a ticket in your RMM when a new blind spot appearsappliance export -data-dir /var/lib/appliance -list decisions \ -from 2026-10-01 -out decisions-october.csv# formula-safe CSV; prints the row count and the file's SHA-256Policy figures are also served as Prometheus text, and as long-form CSV for Excel, Power BI or Tableau, behind a sign-in.
How it was tested
What we have checked, and what we have not.
Every destination’s request format is tested against local stand-ins in the test suite, including failures, retries and refusals. SNMP informs and traps were also checked against net-snmp’s own receiver. None has been tested against a vendor’s own sandbox yet, PagerDuty has not been run against a real account, and none is a certified or partner integration.
The Defender and Intune export headers and the Microsoft Graph fields used by reconcile still need checking against real consoles. If you run one of these tools, a demo against your own export is the quickest way to find out.
Early access: now taking pilot customers.
Bring your stack to the demo.
Tell us which SIEM, PSA and directory you run, and we will show the alerts and exports in those terms.