Pipe Device DNA into the tools you already run. Two surfaces, same data.

Splunk Enterprise / Splunk Cloud

Channel: Syslog over TCP+TLS into an HEC-compatible receiver. Pull via the REST API also supported for batch ingest.

Sourcetype: cybriq:event · Index: dedicated cybriq index recommended.

Sample SPL:

index=cybriq event=device-substituted similarity<0.5
| join port [search index=ticketing change_window="open" device_id="*"]
| where NOT match
| stats count by site, port, current_vendor_hint

Correlation rule template surfaces substitutions that don't match an open change ticket.

Microsoft Sentinel

Channel: Syslog into the Azure Monitor Agent (CEF format), or REST-pull via a Logic App into an Azure Monitor Custom Log.

Sample KQL:

CybrIQEvent_CL
| where event_s == "device-substituted" and similarity_d < 0.5
| extend mitre_techniques = parse_json(mitre_s)
| project TimeGenerated, site_s, port_s, previous_vendor_hint_s, current_vendor_hint_s, similarity_d

Pre-built analytic rule template available; ARM bicep on request.

Google Chronicle / SecOps

Channel: Syslog over TCP+TLS to Chronicle's ingestion endpoint, mapped to the UDM event model.

CybrIQ ships a normalized UDM parser that maps Device DNA events to EVENT_TYPE_GENERIC_EVENT with principal.asset.attribute.labels carrying the DNA hash and MITRE technique IDs. Sample UDM payload and parser available on request.

Elastic SIEM

Channel: Filebeat reading from the syslog stream, into the Elasticsearch ingest pipeline.

Ingest pipeline template maps to ECS (Elastic Common Schema). event.category = network; event.module = cybriq; threat.technique.id = MITRE IDs. Sample pipeline + dashboard JSON in our public Git repo.

IBM QRadar

Channel: Syslog over TCP+TLS into the QRadar event-collector. CybrIQ ships a DSM-friendly parser; events land as a custom Log Source Type.

ServiceNow ITSM & SecOps

Pattern: ServiceNow polls the CybrIQ REST API at the configured cadence (typically every 5 minutes) and creates a Security Incident for each new high-severity event. Category Hardware Integrity; priority derived from MITRE technique severity; full event payload attached.

Auto-resolve rules suppress when the related Change Request is approved within the lookback window.

CrowdStrike Falcon

Pattern: A small connector polls the CybrIQ REST API and pushes the device's confirmed identity (Device DNA + vendor + port) into Falcon as an external indicator via the Threat Intel API. When Falcon sees a host matching the indicator, the analyst gets the switch-derived context without leaving the Falcon console.

Useful for: validating that an EDR-detected host is the device you think it is (no swap attack pending), or escalating an EDR alert when the Device DNA is also anomalous.

SentinelOne Singularity

Pattern: Same shape as the CrowdStrike pattern, REST API poll, push the resolved identity into SentinelOne as an asset-record annotation. CybrIQ also publishes to SentinelOne's Threat Intelligence module for the high-severity event types (substitution, NDAA, unauthorized switch).

Cisco ISE (or other NAC)

Pattern: Two-way. CybrIQ consumes ISE's 802.1X session log to enrich Device DNA records with authenticated-user-and-VLAN context. ISE consumes CybrIQ events via syslog and can trigger quarantine policy on device-substituted or port-topology-changed using the SOAR-action endpoint in the API reference.

Net result: a device that swaps under a stable session gets isolated before lateral movement starts. The loop is sub-minute.