Integrations Overview

TIDALBAY connects to your existing security stack to aggregate signals and calculate employee risk scores. With 41+ integrations across identity, email, endpoint, and training platforms, TIDALBAY provides comprehensive visibility.

Integration Categories

Identity Providers (IdP)

Identity provider integrations capture authentication events, MFA status, and access patterns.

  • Okta — SSO events, MFA status, user lifecycle
  • Microsoft Entra ID (Azure AD) — Sign-in logs, conditional access, MFA
  • Google Workspace — Login activity, 2FA status, admin actions
  • OneLogin — Authentication events, app access
  • Ping Identity — SSO and MFA events
Recommended First Integration
We recommend connecting your identity provider first. It provides the richest set of security signals and enables employee directory sync. See the Identity Provider setup guide.

Email Security

Email integrations capture phishing reports, suspicious email events, and email security posture.

  • Microsoft 365 — Defender events, phishing reports, safe links
  • Google Workspace — Gmail security events, phishing reports
  • Proofpoint — Targeted attack protection events
  • Mimecast — Threat detection, URL protection
  • Abnormal Security — BEC detection, account takeover signals

Endpoint Detection & Response (EDR)

EDR integrations capture malware detections, policy violations, and device compliance.

  • CrowdStrike Falcon — Detections, incidents, device health
  • SentinelOne — Threats, device compliance
  • Microsoft Defender for Endpoint — Alerts, device risk
  • Carbon Black — Alerts, watchlist hits

Security Training

  • KnowBe4 — Training completions, phishing simulation results
  • Proofpoint SAT — Training and simulation data
  • SANS Security Awareness — Training completions
  • Custom LMS — Via API or SCORM integration

Cloud & SaaS

  • AWS CloudTrail — API activity, IAM events
  • GitHub — Repository access, secret scanning
  • Salesforce — Login events, data exports
  • Slack — App installations, file sharing

Connecting an Integration

  1. Navigate to Admin → Integrations
  2. Click Add Integration
  3. Select the integration from the catalog
  4. Follow the setup wizard for the specific integration
  5. Test the connection
  6. Activate the integration
API-Based Setup
Most integrations require an API key or OAuth connection. The setup wizard provides step-by-step instructions specific to each platform.

Integration Health

Monitor integration health in Admin → Integrations:

  • Status: Connected, degraded, or disconnected
  • Last sync: When the last event was received
  • Event count: Number of events processed in the last 24 hours
  • Error log: Any connection or parsing errors

Custom Integrations

For platforms not in our catalog, you can create custom integrations using the Webhooks API:

  • Send events via HTTP POST to your TIDALBAY webhook endpoint
  • Map custom event fields to TIDALBAY's event schema
  • Create custom scoring rules for your custom events

Next Steps