Connectors
Native Integrations for Comprehensive Security Coverage
AR² provides 74+ native connectors that enable seamless integration with your existing security infrastructure. Each connector is purpose-built to provide bidirectional communication, allowing AR² agents to ingest alerts, query context, and execute response actions without custom development.
All connectors are maintained by BluSapphire, ensuring compatibility with the latest versions of integrated tools and automatic updates as APIs evolve.
Connector Architecture
Integration Patterns
AR² connectors support three primary integration patterns:
Alert Ingestion (Pull)
AR² periodically queries security tools for new alerts
Suitable for tools without webhook/push capabilities
Configurable polling intervals (1-60 minutes)
Automatic deduplication and state tracking
Alert Streaming (Push)
Security tools push alerts to AR² via webhooks
Real-time alert delivery (< 1 second latency)
Preferred method for time-sensitive threats
Automatic retry and buffering for reliability
Bidirectional API
Full read/write access to security tool capabilities
Enables context enrichment during investigations
Supports automated response actions
Used for EDR, firewalls, identity providers
Connector Capabilities Matrix
Alert Ingestion
Receive security alerts and events
SIEM correlation alerts, EDR detections
Context Query
Retrieve additional investigation data
Query SIEM for related logs, fetch endpoint details from EDR
Threat Enrichment
Lookup IOCs and threat intelligence
Check IP reputation, query file hashes
Response Actions
Execute containment and remediation
Isolate endpoint, block IP, disable user account
Ticket Management
Create and update incident tickets
Create ServiceNow ticket, add investigation notes
Status Sync
Bidirectional status updates
Mark SIEM alert as resolved, close EDR case
Connector Catalog
Cloud & Identity Platforms
Microsoft Azure / EntraID
Category: Cloud Identity & Access Management Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Sign-in logs, audit logs, identity protection alerts
Context Queries: User details, group memberships, conditional access policies, MFA status
Response Actions: Disable user account, revoke sessions, enforce MFA, reset password
API Requirements: Azure AD Premium P2 license, Global Administrator or Security Administrator role
Setup Time: 1-2 hours
Common Use Cases:
Investigate compromised user accounts
Detect impossible travel and anomalous sign-ins
Automate account lockout for high-risk users
Enforce MFA for suspicious authentications
AWS Security Hub
Category: Cloud Security Posture Management Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: GuardDuty findings, Config compliance violations, Inspector vulnerabilities, third-party tool findings
Context Queries: EC2 instance details, S3 bucket configurations, IAM policies, VPC flow logs
Response Actions: Isolate EC2 instances, modify security groups, revoke IAM credentials, enable GuardDuty
API Requirements: AWS account with Security Hub enabled, IAM role with appropriate permissions
Setup Time: 2-3 hours
Common Use Cases:
Respond to GuardDuty threat detections
Remediate misconfigurations automatically
Investigate lateral movement in AWS environments
Enforce security group policies
Google Cloud Security Command Center (SCC)
Category: Cloud Security Posture Management Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security findings from GCP services, Event Threat Detection, Container Threat Detection
Context Queries: GCE instance metadata, GCS bucket permissions, IAM bindings, VPC logs
Response Actions: Stop GCE instances, modify firewall rules, revoke service account keys
API Requirements: GCP project with SCC enabled, service account with Security Center Admin role
Setup Time: 2-3 hours
SIEM Platforms
Splunk
Category: Security Information and Event Management Capabilities: Alert Ingestion, Context Query, Status Sync
Integration Details:
Alert Sources: Notable events, correlation searches, scheduled searches
Context Queries: SPL queries for related logs, user activity, network connections
Response Actions: Update notable event status, add comments, create correlation rules
API Requirements: Splunk Enterprise Security, REST API access, admin or power user role
Setup Time: 2-4 hours
Common Use Cases:
Investigate SIEM correlation alerts
Query raw logs for forensic evidence
Enrich alerts with historical context
Close false positive notable events
IBM QRadar
Category: Security Information and Event Management Capabilities: Alert Ingestion, Context Query, Status Sync
Integration Details:
Alert Sources: Offenses (correlated alerts), custom rules, anomaly detection
Context Queries: AQL queries for events, flows, assets, vulnerabilities
Response Actions: Close offenses, assign to analysts, add notes
API Requirements: QRadar 7.3+, authorized service token
Setup Time: 2-4 hours
Azure Sentinel
Category: Cloud-Native SIEM Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Analytics rules, fusion ML detections, scheduled queries
Context Queries: KQL queries across Log Analytics workspace
Response Actions: Update incident status, add comments, run playbooks
API Requirements: Azure Sentinel workspace, Sentinel Contributor role
Setup Time: 2-3 hours
Wazuh
Category: Open-Source SIEM & XDR Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security alerts, compliance violations, file integrity monitoring
Context Queries: Agent status, vulnerability data, configuration assessment
Response Actions: Active response commands, agent management
API Requirements: Wazuh manager API access, admin credentials
Setup Time: 2-3 hours
EDR / XDR Platforms
CrowdStrike Falcon
Category: Endpoint Detection & Response Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Detections, incidents, IOA (Indicators of Attack)
Context Queries: Process trees, network connections, file details, host information
Response Actions: Contain host, kill process, quarantine file, run RTR commands
API Requirements: Falcon API client with appropriate scopes
Setup Time: 1-2 hours
Common Use Cases:
Investigate malware detections
Contain compromised endpoints
Hunt for IOCs across fleet
Execute forensic commands remotely
SentinelOne
Category: Endpoint Detection & Response Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Threats, alerts, Deep Visibility events
Context Queries: Process lineage, network activity, file analysis, endpoint inventory
Response Actions: Isolate endpoint, kill process, remediate threat, rollback changes
API Requirements: SentinelOne API token with appropriate permissions
Setup Time: 1-2 hours
Microsoft Defender for Endpoint
Category: Endpoint Detection & Response Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security alerts, automated investigations, advanced hunting detections
Context Queries: Device details, user activity, file prevalence, network connections
Response Actions: Isolate machine, run antivirus scan, collect investigation package, block file
API Requirements: Microsoft 365 Defender, application registration with appropriate permissions
Setup Time: 2-3 hours
Trend Micro Apex One / Vision One
Category: Endpoint Detection & Response Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security events, detections, behavioral monitoring alerts
Context Queries: Endpoint status, detection history, threat intelligence
Response Actions: Isolate endpoint, terminate process, quarantine file
API Requirements: Vision One API key or Apex One admin credentials
Setup Time: 2-3 hours
Sophos Central
Category: Endpoint Protection & EDR Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security alerts, malware detections, exploit prevention
Context Queries: Device details, threat analysis, user activity
Response Actions: Isolate endpoint, clean threats, block applications
API Requirements: Sophos Central API credentials
Setup Time: 1-2 hours
Firewall & Network Security
Palo Alto Networks (PAN-OS)
Category: Next-Generation Firewall Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Threat logs, traffic logs, WildFire verdicts
Context Queries: Security policy rules, session details, threat intelligence
Response Actions: Block IP/domain, create security rules, update dynamic address groups
API Requirements: PAN-OS 9.0+, API key with appropriate permissions
Setup Time: 1-2 hours
Common Use Cases:
Block malicious IPs and domains
Investigate network-based attacks
Create dynamic block lists
Enforce security policies
Fortinet FortiGate
Category: Next-Generation Firewall Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: IPS alerts, web filter violations, antivirus detections
Context Queries: Traffic logs, security events, policy configurations
Response Actions: Block IP addresses, create firewall policies, ban users
API Requirements: FortiOS API access, admin credentials
Setup Time: 1-2 hours
Checkpoint Firewall
Category: Enterprise Firewall Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: IPS events, threat prevention logs, application control
Context Queries: Log queries, policy rules, threat intelligence
Response Actions: Block IPs, create access rules, update threat prevention profiles
API Requirements: Checkpoint Management API, admin credentials
Setup Time: 1-2 hours
Cisco Firewalls (ASA, WSA, ESA)
Category: Enterprise Security Appliances Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security events, web/email threats, intrusion attempts
Context Queries: Connection logs, web traffic, email analysis
Response Actions: Block IPs/URLs, create ACLs, quarantine emails
API Requirements: REST API access, admin credentials
Setup Time: 2-3 hours
Netskope
Category: Cloud Access Security Broker (CASB) Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: DLP violations, malware detections, policy violations
Context Queries: User activity, cloud app usage, data movement
Response Actions: Block cloud apps, quarantine files, enforce policies
API Requirements: Netskope API token
Setup Time: 1-2 hours
Skyhigh Security (McAfee MVISION)
Category: Cloud Access Security Broker (CASB) Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Cloud security incidents, DLP alerts, threat detections
Context Queries: Cloud service usage, user behavior, data exposure
Response Actions: Block services, enforce policies, quarantine content
API Requirements: Skyhigh API credentials
Setup Time: 1-2 hours
Identity & Access Management
Okta
Category: Identity Provider & SSO Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security events, authentication failures, policy violations
Context Queries: User profiles, group memberships, application access, session details
Response Actions: Suspend user, clear sessions, reset MFA, deactivate account
API Requirements: Okta API token with appropriate scopes
Setup Time: 1-2 hours
Common Use Cases:
Investigate account takeover attempts
Respond to credential stuffing attacks
Automate user suspension for compromised accounts
Enforce step-up authentication
Cisco Duo
Category: Multi-Factor Authentication Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Authentication logs, fraud attempts, bypass events
Context Queries: User authentication history, device trust, location patterns
Response Actions: Deny authentication, remove trusted devices, enforce MFA
API Requirements: Duo Admin API credentials
Setup Time: 1-2 hours
Zscaler
Category: Zero Trust Network Access Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Security policy violations, malware detections, data loss prevention
Context Queries: User activity, web traffic, application access
Response Actions: Block users, enforce policies, isolate traffic
API Requirements: Zscaler API credentials
Setup Time: 1-2 hours
ForcePoint
Category: Data Loss Prevention & CASB Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: DLP incidents, insider threat alerts, policy violations
Context Queries: User behavior, data movement, policy matches
Response Actions: Block transfers, quarantine files, notify users
API Requirements: ForcePoint API access
Setup Time: 2-3 hours
Email Security
Proofpoint (TAP & Email Protection)
Category: Email Security Gateway Capabilities: Alert Ingestion, Context Query, Threat Enrichment
Integration Details:
Alert Sources: Phishing detections, malware attachments, impostor emails, credential theft
Context Queries: Email forensics, URL analysis, attachment details, campaign information
Response Actions: Quarantine emails, block senders, remove from mailboxes
API Requirements: Proofpoint TAP API credentials
Setup Time: 2-3 hours
Common Use Cases:
Investigate phishing campaigns
Analyze malicious URLs and attachments
Track email-based threats
Automate email remediation
Mimecast
Category: Email Security & Archiving Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Spam, malware, impersonation attacks, data leakage
Context Queries: Email logs, attachment analysis, URL reputation
Response Actions: Block senders, release from quarantine, create policies
API Requirements: Mimecast API credentials
Setup Time: 2-3 hours
Barracuda Email Protection
Category: Email Security Gateway Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Spam, phishing, malware, account takeover
Context Queries: Email logs, threat details, sender reputation
Response Actions: Quarantine emails, block domains, update policies
API Requirements: Barracuda API access
Setup Time: 2-3 hours
Cisco Email Security (ESA)
Category: Email Security Appliance Capabilities: Alert Ingestion, Context Query, Response Actions
Integration Details:
Alert Sources: Spam, malware, phishing, outbreak alerts
Context Queries: Message tracking, threat analysis, sender verification
Response Actions: Quarantine messages, block senders, update filters
API Requirements: REST API access
Setup Time: 2-3 hours
Ticketing & ITSM
ServiceNow
Category: IT Service Management Capabilities: Ticket Management, Status Sync
Integration Details:
Alert Sources: Security incidents (if ServiceNow SecOps used)
Context Queries: Incident history, CMDB data, user information
Response Actions: Create incidents, update status, add work notes, assign to groups, close tickets
API Requirements: ServiceNow instance, integration user with appropriate roles
Setup Time: 1-2 hours
Common Use Cases:
Automatically create incident tickets for AR² investigations
Sync investigation status with ServiceNow
Add investigation evidence as work notes
Close tickets when remediation complete
Jira (Service Management)
Category: Issue Tracking & Service Management Capabilities: Ticket Management, Status Sync
Integration Details:
Alert Sources: N/A (ticketing only)
Context Queries: Issue history, custom fields, user assignments
Response Actions: Create issues, update status, add comments, transition workflows
API Requirements: Jira Cloud or Data Center, API token or OAuth
Setup Time: 1-2 hours
FreshDesk
Category: Help Desk & Ticketing Capabilities: Ticket Management, Status Sync
Integration Details:
Alert Sources: N/A (ticketing only)
Context Queries: Ticket history, requester details, agent assignments
Response Actions: Create tickets, update status, add notes, assign agents
API Requirements: FreshDesk API key
Setup Time: 1-2 hours
Threat Intelligence
VirusTotal
Category: Malware & URL Analysis Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: File hash reputation, URL analysis, domain information, IP reputation
API Requirements: VirusTotal API key (free or premium)
Rate Limits: 4 requests/minute (free), 1000 requests/minute (premium)
Setup Time: 15 minutes
Common Use Cases:
Check file hash reputation
Analyze suspicious URLs
Investigate domain registrations
Assess IP address reputation
AlienVault OTX
Category: Open Threat Exchange Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IOC reputation, pulse subscriptions, related indicators
API Requirements: Free OTX account and API key
Rate Limits: 10 requests/second
Setup Time: 15 minutes
Recorded Future
Category: Threat Intelligence Platform Capabilities: Threat Enrichment, Context Query
Integration Details:
Enrichment Queries: IOC risk scores, threat actor attribution, vulnerability intelligence
API Requirements: Recorded Future subscription and API token
Setup Time: 1-2 hours
AbuseIPDB
Category: IP Reputation Database Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IP abuse confidence score, report history, geolocation
API Requirements: Free or paid API key
Rate Limits: 1000 requests/day (free), higher limits for paid
Setup Time: 15 minutes
GreyNoise
Category: Internet Scanner Intelligence Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Distinguish malicious IPs from benign scanners, classification, tags
API Requirements: GreyNoise API key
Setup Time: 15 minutes
URLhaus
Category: Malware URL Database Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: URL reputation, malware family, payload information
API Requirements: Free, no authentication required
Setup Time: 10 minutes
PhishTank
Category: Phishing URL Database Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Phishing URL verification, submission details
API Requirements: Free API key
Setup Time: 10 minutes
Have I Been Pwned (HIBP)
Category: Breach Intelligence Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Email address breach history, password exposure
API Requirements: HIBP API key (paid for automated queries)
Setup Time: 15 minutes
MalwareBazaar
Category: Malware Sample Repository Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Malware hash lookup, sample details, signatures
API Requirements: Free, no authentication required
Setup Time: 10 minutes
RiskIQ PassiveTotal
Category: Threat Intelligence & Attack Surface Capabilities: Threat Enrichment, Context Query
Integration Details:
Enrichment Queries: Domain/IP relationships, WHOIS data, SSL certificates, passive DNS
API Requirements: RiskIQ subscription and API credentials
Setup Time: 1-2 hours
Censys
Category: Internet Asset Intelligence Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IP/domain exposure, certificate information, service enumeration
API Requirements: Censys API credentials
Setup Time: 30 minutes
Shodan
Category: Internet Device Search Engine Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IP service information, vulnerability exposure, device details
API Requirements: Shodan API key
Setup Time: 15 minutes
IBM X-Force Exchange
Category: Threat Intelligence Platform Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IOC reputation, threat reports, vulnerability data
API Requirements: IBM X-Force account and API key
Setup Time: 30 minutes
Emerging Threats (Proofpoint ET Intelligence)
Category: IDS/IPS Rules & Threat Intelligence Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Rule information, IOC feeds, threat categories
API Requirements: ET Intelligence subscription
Setup Time: 1 hour
Hunter.io
Category: Email Verification & OSINT Capabilities: Context Query
Integration Details:
Enrichment Queries: Email verification, domain email patterns, contact discovery
API Requirements: Hunter.io API key
Setup Time: 15 minutes
SANS Internet Storm Center
Category: Threat Intelligence & Research Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IP reputation, port scanning activity, threat trends
API Requirements: Free, no authentication required
Setup Time: 10 minutes
Anomali ThreatStream
Category: Threat Intelligence Platform Capabilities: Threat Enrichment, Context Query
Integration Details:
Enrichment Queries: IOC intelligence, threat actor profiles, campaign tracking
API Requirements: Anomali subscription and API credentials
Setup Time: 1-2 hours
Sandbox & Malware Analysis
Hybrid Analysis
Category: Malware Sandbox Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: File behavior analysis, IOC extraction, malware family identification
API Requirements: Hybrid Analysis API key
Setup Time: 30 minutes
Joe Sandbox
Category: Malware Analysis Platform Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Deep malware analysis, behavior reports, IOC extraction
API Requirements: Joe Sandbox subscription and API key
Setup Time: 30 minutes
ANY.RUN
Category: Interactive Malware Sandbox Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: Malware behavior, network activity, process tree
API Requirements: ANY.RUN API key
Setup Time: 30 minutes
Vulnerability Management
Qualys VMDR
Category: Vulnerability Management Capabilities: Context Query
Integration Details:
Context Queries: Asset vulnerabilities, patch status, compliance posture
API Requirements: Qualys subscription and API credentials
Setup Time: 1-2 hours
Rapid7 InsightVM / Nexpose
Category: Vulnerability Management Capabilities: Context Query
Integration Details:
Context Queries: Vulnerability data, asset inventory, risk scores
API Requirements: Rapid7 API key
Setup Time: 1-2 hours
Tenable Nessus / Tenable.io
Category: Vulnerability Scanning Capabilities: Context Query
Integration Details:
Context Queries: Scan results, vulnerability details, asset information
API Requirements: Tenable API keys
Setup Time: 1-2 hours
Log Management & Search
Elasticsearch
Category: Search & Analytics Engine Capabilities: Context Query
Integration Details:
Context Queries: Full-text log search, aggregations, time-series analysis
API Requirements: Elasticsearch cluster access, appropriate index permissions
Setup Time: 1-2 hours
OpenSearch
Category: Search & Analytics Engine Capabilities: Context Query
Integration Details:
Context Queries: Log search, aggregations, dashboards
API Requirements: OpenSearch cluster access
Setup Time: 1-2 hours
Threat Intelligence Platforms
MISP (Malware Information Sharing Platform)
Category: Threat Intelligence Sharing Capabilities: Threat Enrichment, Context Query
Integration Details:
Enrichment Queries: IOC lookup, event correlation, threat sharing
API Requirements: MISP instance access, API key
Setup Time: 1-2 hours
ThreatConnect
Category: Threat Intelligence Platform Capabilities: Threat Enrichment, Context Query
Integration Details:
Enrichment Queries: IOC intelligence, threat campaigns, adversary tracking
API Requirements: ThreatConnect subscription and API credentials
Setup Time: 1-2 hours
Talos Intelligence
Category: Threat Intelligence & Reputation Capabilities: Threat Enrichment
Integration Details:
Enrichment Queries: IP/domain reputation, threat categories, blocklist status
API Requirements: Free, web-based queries
Setup Time: 15 minutes
Custom Connector Development
When to Build Custom Connectors
Consider custom connector development when:
Proprietary Tools: Your organization uses internally developed security tools
Niche Vendors: Security tool not in our standard catalog
Specialized Requirements: Unique integration patterns or data formats
Legacy Systems: Older systems without modern APIs
Custom Connector Framework
AR² provides a connector SDK that simplifies custom development:
SDK Features:
Python-Based: Leverage familiar Python libraries and frameworks
Template Library: Pre-built templates for common integration patterns
Testing Framework: Automated testing and validation tools
Documentation Generator: Auto-generate connector documentation
Deployment Automation: One-command deployment to AR² platform
Development Process
Professional Services
BluSapphire offers professional services for custom connector development:
Connector Development: We build the connector for you ($5,000 - $15,000 per connector)
Integration Consulting: Architecture review and integration planning ($200/hour)
Training: SDK training for your development team (2-day workshop, $5,000)
Connector Maintenance & Updates
Automatic Updates
All native connectors are automatically updated by BluSapphire:
API Changes: Connectors updated within 30 days of vendor API changes
Security Patches: Critical security updates deployed within 48 hours
Feature Enhancements: New capabilities added quarterly
Compatibility Testing: Continuous testing against latest tool versions
Version Compatibility
Patch (bug fixes)
None (automatic)
Email notification
Minor (new features)
None (automatic)
Email notification + release notes
Major (breaking changes)
Review and approve
30-day advance notice + migration guide
Deprecation Policy
When security tools are deprecated or replaced:
12-Month Notice: Advance notification of connector deprecation
Migration Support: Assistance migrating to replacement tools
Extended Support: Optional paid support for deprecated connectors (12 months)
Integration Best Practices
Start with Core Integrations
Recommended First 5 Connectors:
Primary SIEM (Splunk, QRadar, Sentinel)
EDR platform (CrowdStrike, SentinelOne, Defender)
Cloud security (AWS Security Hub, Azure Defender, GCP SCC)
Identity provider (Okta, Azure AD)
Ticketing system (ServiceNow, Jira)
Validate Data Quality
Before enabling connectors in production:
Test Alert Flow: Verify alerts are ingested correctly
Validate Context Queries: Ensure queries return expected data
Test Response Actions: Validate actions in non-production environment
Check Rate Limits: Confirm API rate limits are sufficient
Configure Appropriate Permissions
Follow principle of least privilege:
Read-Only: For threat intelligence and context enrichment
Read-Write: For response actions (isolate, block, disable)
Admin: Only when absolutely necessary (rare)
Monitor Connector Health
AR² provides built-in connector monitoring:
Connection Status: Real-time status of each connector
API Rate Limits: Track usage against limits
Error Rates: Alert on elevated error rates
Latency Metrics: Monitor query and action performance
Implement Staged Rollout
Deploy connectors in phases:
Phase 1: Alert ingestion only (observe, no actions)
Phase 2: Enable context queries (enrich investigations)
Phase 3: Enable low-risk actions (create tickets, add comments)
Phase 4: Enable high-risk actions (isolate, block, disable)
Troubleshooting Common Issues
Authentication Failures
Symptoms: Connector shows "Authentication Failed" status
Common Causes:
Expired API keys or tokens
Insufficient permissions
IP allowlist restrictions
Credential rotation without updating AR²
Resolution:
Verify credentials are current
Check API key/token expiration
Confirm required permissions are granted
Update AR² connector configuration with new credentials
Rate Limit Errors
Symptoms: Connector shows "Rate Limit Exceeded" errors
Common Causes:
High alert volume exceeds API limits
Multiple systems querying same API
Insufficient API tier for usage
Resolution:
Review API rate limits for your tier
Adjust AR² polling intervals
Upgrade to higher API tier if available
Implement request batching where supported
Data Quality Issues
Symptoms: Incomplete or incorrect data in investigations
Common Causes:
Misconfigured log sources
Incomplete security tool deployment
Data retention policies too aggressive
API returning partial results
Resolution:
Validate security tool configuration
Check data retention settings
Review API query parameters
Enable verbose logging for debugging
Request a Connector: If you need a connector not on our roadmap, contact [email protected]
Conclusion
AR²'s comprehensive connector ecosystem enables seamless integration with your existing security infrastructure, eliminating the need for custom development in most cases. With 74+ native connectors and a robust SDK for custom development, AR² can integrate with virtually any security tool in your environment.
All connectors are maintained and updated by BluSapphire, ensuring long-term compatibility and reliability as your security tools evolve.
For connector-specific questions, integration support, or custom connector development inquiries, contact [email protected]
Document Version: 1.0 Last Updated: February 2026 Next Review: May 2026
Last updated