Tools & Integrations

Tools are the connections between CloudPeek and the security products you already use. They're how the AI reads your data and how alerts get pulled in. This page covers adding, configuring and managing them.

Adding a new tool

The click-path is:

Settings → Tool Management → Add Tool → pick a provider → enter credentials → Test Connection → Create Configuration.

Step by step:

1. Open Settings (gear icon in the sidebar) and click the Tool Management card: or go straight to /tools.
2. Click Add Tool (top-right). This opens the provider picker (/tools/new), titled "Add New Tool."
3. Choose the provider you want to connect (see the list below). Click Configure on its card.
4. Acknowledge the credential-handling notice.
5. Fill in the configuration form (see The configuration form).
6. Click Test Connection to verify CloudPeek can reach the tool (you'll see "Connection successful" or "Connection failed").
7. Click Create Configuration.

Your new tool appears as a card on the Tool Management page, where you can later edit or delete it. (Deleting asks you to confirm.)

Available providers

CloudPeek ships with connectors for a range of security products. Individual providers include:

• Splunk: search and correlate logs in Splunk.
• OpenSearch / Elasticsearch: search log and event indexes.
• GitHub: repository and security data (supports OAuth "Connect with GitHub").
• Trend Micro Vision One: endpoint/XDR alerts (can act as an alert source).
• Netskope: cloud security data.
• VirusTotal: look up IPs, domains, file hashes and URLs across 70+ engines.
• Shodan: internet-exposure intelligence.
• GreyNoise: internet background-noise / scanner intelligence.
• PostHog: product analytics data.
• CloudPeek: CloudPeek's own tooling.

AWS and Azure bundles

AWS and Azure are configured as bundles: you enter the cloud credentials once and then enable the individual services you need.

• AWS bundle: "Configure AWS credentials once and enable Security Hub, GuardDuty, CloudWatch, IAM, Security Lake and Systems Manager." Services include Security Hub, GuardDuty, CloudWatch Logs, IAM, Security Lake and Systems Manager (SSM).
• Azure / Defender XDR bundle: "Configure Azure credentials once and enable Defender XDR, Sentinel, Entra ID, Intune, Purview and more." Types include Defender XDR, Sentinel, Entra ID, Log Analytics, Office 365, Intune, Defender for Endpoint and Purview.

To add one, pick the AWS or Azure card in the tool picker, enter the shared credentials, and toggle on the services you want.

The configuration form

When you configure a tool you'll see (fields vary by provider):

• Tool Type: the provider (only shown if you didn't pre-select one).
• Tool Name (Optional): a label; leave blank to use the type as the name (e.g. splunk-001).
• Enable this tool: whether the tool is active.
• Tool Access: who can use this tool:
  • Private: only you.
  • Tenant: everyone in your tenant.
  • (This can't be changed after creation.)
• Provider credentials: the connection details for that product (host, token, username/ password, API key, access keys, etc., depending on the provider).
• Advanced Mode (JSON): edit the raw configuration directly, for advanced cases.

Some providers add their own panels, for example GitHub offers Connect with GitHub (OAuth, so no long-lived token is stored in your browser) with a "Use Personal Access Token instead" fallback.

Incident sources

Any tool that can supply alerts can be turned into an incident source so CloudPeek pulls alerts in automatically. In the tool configuration, expand Incident Source Configuration and switch on Enable as Incident Source, then set:

• Polling Schedule (Cron): how often to check for new alerts (default */15 * * * *, i.e. every 15 minutes).
• Alert Types: which alert types to pull.
• Dedup Field: the field used to avoid creating duplicate incidents.
• Time Range (hours): how far back to look each poll (1-168).

A Supported badge indicates providers that can act as alert sources (for example Trend Micro Vision One and AWS Security Hub). Once enabled, CloudPeek's incident-sync worker polls the source on schedule, creates incidents, and queues them for triage.

Linking a playbook to a tool

In the tool configuration you can link a playbook so the AI knows how to use that tool for a given procedure. See Runbooks & Playbooks.

Managing existing tools

On Tool Management (/tools) you can search your tools, edit a configuration, re-test the connection, adjust capabilities, or delete a tool. Changes take effect immediately for new AI work.

Related

• Tools API: create and manage tools and bundles programmatically.
• Automatic Triage: what happens to alerts from an incident source.
• Admin & Settings: where Tool Management lives in the settings hub.