Pull endpoint telemetry.
Push responses.
Build the connector once.
Synqly connects your product to the leading EDR and endpoint protection platforms so you can pull threat data, enrich alerts with device context, report indicators of compromise, and trigger response actions, through a single API that works across all of them.
Bi-Directional Integration with Endpoint Security Platforms
Endpoint detection and response platforms sit at the center of most security operations. They generate threat detections, maintain device inventories, track running processes and applications, and support response actions like quarantine. Products that need this data, including SIEMs, SOAR platforms, risk engines, and security data pipelines, traditionally build a separate connector for every EDR vendor.
Synqly’s Endpoint Security connector replaces that stack of custom integrations with a single API. Query threats, files, applications, and device information across supported EDR platforms. Report IOCs in a normalized format. Trigger discrete actions like device quarantine, without writing vendor-specific code for each one.
Threat data enrichment
Pull endpoint detections and process context from CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Sophos, ESET, ThreatDown, and Tanium into your product to enrich alerts with device and behavioral data.
Automated response
When your product detects a confirmed threat, trigger device isolation or quarantine actions across the customer’s EDR platform, without building vendor-specific action logic.
IOC distribution
Push threat intelligence and indicators of compromise from your product to connected EDR platforms so customers can benefit from your detections at the endpoint level.
Asset inventory augmentation
Read device records and application inventories from EDR platforms to enrich asset management systems with current endpoint state.
Synqly Trusted
Endpoint Security Partners
Endpoint Security Integration Technical Capabilities
Create IOA
Creates an IOA rule for the token-linked EDR source.
Create IOCs
Creates a list of iocs that match the stix input for the EDR source.
Create Threat Note
Creates a note for a threat.
Delete IOAs
Deletes the IOA rules identified by the ids in the query params. Some providers scope rule ids to a rule group; for those providers `group_id` is required.
Delete IOCs
Deletes a list of iocs that match the input of ids in the query param
Execute Command
Runs a provider-backed command on the endpoint identified by `{uid}` and returns normalized stdout and stderr without exposing provider session details.
Execute Remote Script
Runs a script on the endpoint identified by `{uid}` and returns normalized stdout and stderr without exposing provider session details. Long-running executions return a pending status with a cursor to resume polling.
Get Endpoint
Gets a single endpoint assets matching the UID from the token-linked EDR source.
Get Threat Notes
Returns a list of notes for a threat.
Quarantine Endpoints
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
Query Alerts
Returns a list of alerts that match the query from the token-linked EDR source.
Query Applications
Returns a list of applications matching the query from the token-linked EDR source.
Query EDR Events
Returns a list of EDR events that match the query from the token-linked EDR source.
Query Endpoints
Returns a list of endpoint assets matching the query from the token-linked EDR source.
Query IOAs
Returns a list of IOA rules that match the query from the token-linked EDR source.
Query IOCs
Returns a list of iocs that match the query from the token-linked EDR source.
Query Posture Score
Returns the posture score of the endpoint assets that match the query from the token-linked EDR source.
Query Threat Events
Returns a list of threats that match the query from the token-linked EDR source.
Retrieve File
Retrieves a file from the endpoint identified by `{uid}` and returns the provider artifact as a binary file response.
