Cloud-delivered Incident ResponderIncident Responder Documentation

Before you configure an Incident Responder service, ensure you have the correct product versions, have the permissions and credentials you need, and whitelist relevant URLs and ports if you use a proxy.

To configure a third-party service, you enter information about the service. This information differs for each service.

Amazon EC2	Anomali ThreatStream	Atlassian Jira	BMC Remedy	Check Point Firewall
Cisco AMP for Endpoints	Cisco Identity Services Engine (ISE)	Cisco Threat Grid	Cisco Umbrella Enforcement	Cisco Umbrella Investigate
CrowdStrike Falcon Host API	CyberArk	Cylance	Exabeam Advanced Analytics	Exabeam Cloud Search
Exabeam DL	FireEye HX	Fortinet	Google Gmail	IntSights Cyber Intelligence Ltd.
IRNotificationSMTPService	Joe Security Joe Sandbox	Microsoft Active Directory (AD) (Latest)	Microsoft Exchange	Microsoft Outlook Office 365
Microsoft Windows Defender ATP	Microsoft Windows Management Instrumentation	Netskope	Okta	Palo Alto Networks Firewall
Palo Alto Networks Wildfire	Rapid7	SentinelOne	SentinelOneV2	Service Now
Slack	SlashNext	Splunk	ThreatConnect API	Urlscan.io API
VirusTotal	Zscaler