Incident ResponderIncident Responder Documentation

Before you configure an Incident Responder service, ensure you have the correct product versions, have the permissions and credentials you need, and whitelist relevant URLs and ports if you use a proxy.

To configure a third-party service, you enter information about the service. This information differs for each service.

Amazon EC2	Anomali ThreatStream	Atlassian Jira	BMC Remedy	Check Point Firewall
Cisco AMP for Endpoints	Cisco Identity Services Engine (ISE)	Cisco Threat Grid	Cisco Umbrella Enforcement	Cisco Umbrella Investigate
CrowdStrike Falcon Host API	CyberArk	Cylance	Exabeam Advanced Analytics	Exabeam DL
FireEye HX	Fortinet	Google Gmail	IntSights Cyber Intelligence Ltd.	IRNotificationSMTPService
Microsoft Active Directory (AD) (Latest)	Microsoft Exchange	Microsoft Outlook Office 365	Microsoft Windows Defender ATP	Microsoft Windows Management Instrumentation
Netskope	Okta	Palo Alto Networks Firewall	Palo Alto Networks Wildfire	Rapid7
SentinelOne	SentinelOneV2	Service Now	Slack	SlashNext
Splunk	ThreatConnect API	Urlscan.io API	VirusTotal	Zscaler