Twelve integrations, all read-only

Wardell connects with the keys and apps each vendor already offers. Nothing to install on your machines, and each page lists exactly which events Wardell reads.

AWS CloudTrail

Every API call in every account, read through an organization trail.

Cloud

Okta

Sign-ins, MFA changes and admin grants from the Okta System Log.

Identity

Microsoft 365

Entra ID sign-ins, mailbox audit and OAuth consent events.

Identity

Google Workspace

Admin, login, Drive and Gmail audit logs from the Reports API.

Identity

GitHub

Organization audit log, secret scanning and repository visibility changes.

Code

Cloudflare

WAF, Zero Trust and account audit events through Logpush.

Network

Slack

Where Wardell posts cases, and an audit source on Enterprise Grid.

Collaboration

1Password

Sign-in attempts and item usage from 1Password Business Events.

Identity

Kubernetes

API server audit logs from EKS, GKE and AKS clusters.

Cloud

Terraform Cloud

Workspace runs, variable changes and team permission audit trail.

Code

Atlassian Jira

Open and sync tickets from cases, both ways.

Workflow

PagerDuty

Route pages to your own rotation during business hours.

Workflow

Missing a source you rely on?

Anything that can send JSON over HTTPS or write to an S3 bucket can be a Wardell source. Tell us what you run and we will scope it in a day.

Ask about a source

Send us one week of logs. We send back what we found.

Connect one source with a read-only key. Within 48 hours you get a written report of what Wardell would have caught. No contract, and you can disconnect at any time.

Get a 48-hour threat review

Use this free template

Get a 48-hour threat review