URIP Connector Catalogue

Last updated: 2026-04-29
Status: Stable
Total connectors: 61 live production connectors

Overview

URIP's connector framework handles authentication, data retrieval, normalisation, and health monitoring for every tool — automatically. Adding a connector takes a few minutes in the Tool Catalog wizard.

Your credentials are encrypted with a unique key for your organisation. They are never logged, never displayed after saving, and never leave URIP's secure storage.

Poll frequencies:

Categories

• VM — Vulnerability Management
• EDR — Endpoint Detection & Response
• CSPM — Cloud Security Posture
• DSPM — Data Security Posture
• IDENTITY — Identity & Access
• NETWORK — Network Security
• DLP — Data Loss Prevention
• FIREWALL — Firewall & NGFW
• SOC — SIEM & SOC Platforms
• EMAIL — Email Security
• COLLABORATION — Collaboration Security
• ITSM — IT Service Management
• LMS — Security Awareness Training
• PAM — Privileged Access Management
• NAC — Network Access Control
• OT — Operational Technology
• DAST — Application Security
• BAS — Breach & Attack Simulation
• EASM — External Attack Surface
• EXTERNAL_THREAT — External Threat Intelligence
• ADVISORY — Government Advisories
• BUG_BOUNTY — Bug Bounty Platforms
• GRC — GRC Platforms
• BGV — Background Verification
• HRIS — HR Information Systems

VM — Vulnerability Management

Tenable Vulnerability Manager

Setup: 1. Sign into Tenable.io → Settings → My Account → API Keys → Generate new key pair 2. Enter Access Key and Secret Key in the URIP connector wizard 3. Leave the API URL at the default unless you use a self-hosted Tenable instance

See also: guides/connectors-setup.md

Qualys VMDR

Setup: Enter Qualys Platform URL, Username, and Password (or API token).

Rapid7 InsightVM

EDR — Endpoint Detection & Response

CrowdStrike Falcon

SentinelOne Singularity

Microsoft Defender for Endpoint

ManageEngine Endpoint Central

Microsoft Intune (MDM)

Jamf Pro (Mac MDM)

ManageEngine MDM

CSPM — Cloud Posture

AWS Cloud Security Posture

Azure Cloud Security Posture

GCP Cloud Security Posture

Wiz CNAPP

Prisma Cloud CNAPP (Palo Alto Networks)

Orca Security CNAPP

DSPM — Data Security Posture

BigID (Structured DSPM)

Varonis (Unstructured DSPM)

IDENTITY — Identity & Access

Microsoft Entra ID

Setup: OAuth admin-consent flow. Click Authorize with Microsoft in the connector wizard.

Okta Workforce Identity

NETWORK — Network Security

Zscaler ZIA / ZTA / CASB

Netskope CASB + DLP

Cloudflare WAF + DDoS + Zero Trust

Cisco Meraki

DLP — Data Loss Prevention

GTB Endpoint Protector

Microsoft Purview DLP

FIREWALL — Firewall & NGFW

Fortinet Fortiguard

Palo Alto Networks NGFW (Panorama)

Check Point Quantum Security Gateway

SOC — SIEM & SOC Platforms

Microsoft Sentinel (native)

Google SecOps / Chronicle

Splunk Enterprise / Cloud (native HEC)

Generic SIEM / SOC

EMAIL — Email Security

Email Security (Google Workspace + Microsoft Defender for O365)

COLLABORATION — Collaboration Security

Microsoft 365 Collaboration

ITSM — IT Service Management

Jira Cloud / Data Center

ServiceNow

ManageEngine ServiceDesk Plus

LMS — Security Awareness Training

KnowBe4 Security Awareness

Hoxhunt Phishing Training

PAM — Privileged Access Management

CyberArk Privileged Access

HashiCorp Vault

NAC — Network Access Control

Forescout NAC

Cisco ISE (Network Access Control)

OT — Operational Technology

Armis OT

Severity mapping: Armis 0–10 scale used directly.

DAST — Application Security

Burp Suite Enterprise

Snyk (SCA + Container + IaC + Code)

GitHub Advanced Security (SAST + Secrets + Dependabot)

BAS — Breach & Attack Simulation

SafeBreach BAS

SafeBreach provides empirical validation of your security controls — URIP surfaces simulation results as risks alongside findings from real production connectors.

EASM — External Attack Surface

External Attack Surface (EASM)

EXTERNAL_THREAT — External Threat Intelligence

CloudSEK (XVigil / BeVigil / SVigil)

BitSight Security Ratings

BitSight provides board-level posture grades. URIP surfaces the current rating and trend as an external risk signal.

AlienVault OTX (Threat Intelligence)

MITRE ATT&CK (Threat Framework)

ADVISORY — Government Advisories

CERT-In Advisories

US-CERT / CISA Advisories

ENISA Advisories

BUG_BOUNTY — Bug Bounty Platforms

Bug Bounty (HackerOne + Bugcrowd + Webhook)

GRC — GRC Platforms

Vanta GRC

Drata GRC

BGV — Background Verification

AuthBridge BGV

OnGrid BGV

GTB BGV (Global Trust Bridge)

HRIS — HR Information Systems

Workday HRIS

Workday is the authoritative source for the offboarding identity-loop: when a user is terminated in Workday, URIP triggers identity de-provisioning alerts in Entra ID / Okta.

Per-Vendor Permission Troubleshooting

When a connector test returns HTTP 403 — insufficient permissions, the fix is always on the vendor side. Here are the exact UI clicks for the five most common connectors.

Tenable.io

Symptom: HTTP 403 when testing the Tenable connector.

How to fix: 1. Sign into Tenable.io as an administrator 2. Go to Settings → My Account → API Keys 3. Check that the key pair has the Scanner role (not just Reader) 4. If not, generate a new key pair — the role is set at creation and cannot be changed on an existing key 5. Copy the new Access Key and Secret Key into URIP's connector wizard

Still failing? Verify the Tenable user account that owns the API keys has access to all scan zones and asset groups.

CrowdStrike Falcon

Symptom: HTTP 403 or "insufficient scope" when testing the CrowdStrike connector.

How to fix: 1. Sign into the CrowdStrike Falcon console as an admin 2. Go to Support → API Clients and Keys 3. Find the API client you created for URIP (or create a new one) 4. In the Scopes section, enable these read permissions: - Detections:Read - Vulnerabilities:Read - Hosts:Read - Prevention Policies:Read (optional but recommended) 5. Save the client and copy the new Client ID + Secret into URIP

Still failing? CrowdStrike scopes are tied to the customer's subscription tier. If a scope is greyed out, contact CrowdStrike support to upgrade your API access tier.

Microsoft Entra ID

Symptom: "Admin consent required" or HTTP 403 during OAuth flow.

How to fix: 1. Sign into the Azure Portal as a Global Administrator 2. Go to Azure Active Directory → App registrations → [URIP app] → API permissions 3. Verify these Microsoft Graph permissions are listed: - SecurityEvents.Read.All - IdentityRiskEvent.Read.All - AuditLog.Read.All - IdentityRiskyUser.Read.All 4. Click Grant admin consent for [your tenant] — this button is critical; user consent is not sufficient 5. A green checkmark should appear next to each permission 6. Go to Certificates & secrets and ensure the Client Secret has not expired

Still failing? Some permissions require Azure AD P2 license. Verify your subscription includes P2.

Splunk Enterprise / Cloud

Symptom: HTTP 403 or "token invalid" when testing the Splunk connector.

How to fix (Splunk Cloud): 1. Sign into Splunk Cloud as an admin 2. Go to Settings → Tokens 3. Find your HEC token or search-head API token 4. Verify the token has search and indexes_read capabilities 5. If using HEC: go to Settings → Data Inputs → HTTP Event Collector and ensure the input is enabled

How to fix (Splunk Enterprise): 1. Sign into Splunk Web as an admin 2. Go to Settings → Access controls → Users 3. Find the user account associated with the API token 4. Ensure the role (e.g., user or power) has the search capability 5. If using a custom role: Settings → Access controls → Roles → [role] → Capabilities → enable search

Still failing? Check that the Splunk search head URL is correct and reachable from your network. If you use a self-signed certificate, ensure it is trusted.

AWS Cloud Security Posture

Symptom: AccessDenied or HTTP 403 when testing the AWS CSPM connector.

How to fix: 1. Sign into the AWS Management Console as an IAM admin 2. Go to IAM → Roles → [URIP role] 3. Review the attached policies and ensure these actions are allowed: - securityhub:GetFindings - securityhub:BatchImportFindings - config:GetComplianceDetailsByConfigRule - config:DescribeConfigRules - iam:GetAccountSummary - iam:ListAccountAliases 4. If any are missing: click Add permissions → Attach policies → Create inline policy and add the missing actions 5. Verify the IAM role's Trust Policy allows URIP's account or external ID (provided by your URIP account manager)

Still failing? AWS Security Hub must be enabled in the region you are connecting to. Go to Security Hub → Settings and confirm it is active.

See Also

• Connector Setup — Wizard walkthrough
• Troubleshooting — Connector Issues
• User Guide — Tool Catalogue