Connect the sources that make a finding worth acting on.

Blumira supports a broad integration library across cloud platforms, productivity suites, identity providers, endpoint tools, firewalls, switches, and wireless access points. Supported source coverage can change over time, so teams should use the current library and setup guides to verify the sources that matter in their environment.

Blumira's library includes common cloud infrastructure, email and productivity, identity and access management, endpoint protection, firewall, network security, and wireless access point sources. Exact compatibility depends on the current source, edition, API, syslog, and deployment details, so verify the specific integration before relying on it for a coverage plan.

Cloud integrations commonly connect through APIs, while on-prem devices such as firewalls and switches often use syslog through a virtual sensor. Setup details vary by source and environment, so teams should follow the relevant guide and validate that useful security events are flowing before treating a source as covered.

If your environment includes a tool or data source not in the standard integration library, Blumira partners with you to evaluate the feasibility of a custom integration. This is a collaborative process with the security operations team. Custom integrations depend on the data source having an accessible API or syslog output. Blumira's team assesses whether the data source provides security-relevant telemetry worth ingesting and builds the integration if it does. This is how the integration library grows.

Start by checking whether the tool supports syslog output or has a REST API. If it does, there is a good chance Blumira can ingest its data through the virtual sensor (for syslog) or build a custom integration (for API). Contact Blumira's team to discuss the specific tool. If the tool has no standard log output or API, integration may not be feasible. In that case, the SecOps team can help you evaluate whether the tool's detection coverage overlaps with data sources Blumira already ingests, which may mean you are already covered.

Start with the sources most likely to produce high-value security context: identity, Microsoft 365 or Google Workspace, endpoint, cloud infrastructure, firewall, and other systems tied to privileged access or sensitive data. A useful integration plan should map sources to detection coverage, response decisions, and evidence needs instead of treating the library as a checklist.

If your environment relies heavily on proprietary or legacy systems that do not support standard protocols (syslog, REST API, or common cloud API formats), Blumira may not be able to ingest that data. Highly customized on-prem environments with homegrown applications or industrial control systems (OT/ICS) may have limited integration options. Blumira's integration library is optimized for the IT tools most mid-market organizations use. If your stack is primarily niche or specialized systems, verify specific integration availability with Blumira's team before committing.