Integrations

The cloud security industry has a blind spot , and it's hiding in plain sight. Most cloud detection and response solutions were built for one world: public cloud. AWS, Azure, GCP. Clean APIs, structured logs, well-documented services. But that's not the world many enterprises actually live in. The reality? Your attack surface doesn't stop at your cloud boundary. Workloads run on VMware. Traffic routes through on-prem to cloud, And adversaries know that the seams between environments are where detection falls apart. Today, we're closing that gap. Stream Security now delivers full attack path analysis and runtime threat detection across hybrid cloud environments, starting with VMware (including NSX), on-premises routers, and network infrastructure.

Stream.Security now supports native ingestion of MongoDB Atlas audit logs, extending real-time threat detection and response to the database layer. Security teams gain immediate visibility into suspicious database activity, including unauthorized access, privilege escalation, data exfiltration, and configuration changes correlated with full cloud context across AWS, Azure, and GCP. The integration is agentless, easy to enable, and delivers out-of-the-box detections so teams can investigate and respond faster, all from a unified cloud security platform.

Stream now integrates with Microsoft 365 to cover Entra ID, DLP, SharePoint, Teams, Outlook, and OneDrive for unified, SaaS-aware threat detection.Get real-time visibility across identity, chat, files, and mail and detect token abuse, malicious OAuth apps, Teams-based phishing, and abnormal file activity from a single view.

Stream now integrates with Salesforce for advanced threat detection. The integration provides in-depth detection capabilities that will help you catch Salesforce breaches in real time, including the recent Salesloft Drift compromise.

Stream now integrates Snowflake audit logs directly into our SaaS and cloud detection framework. By including Snowflake activity as part of SaaS-sourced signals, we give SecOps teams complete visibility into how threats unfold across the chain of services connected to the cloud. This unified view closes the gaps that attackers target to ensure Snowflake is protected not just in isolation, but as part of the bigger cloud story.

Today, we’re excited to roll out our SaaS-sourced threat detections, built to give SecOps teams complete visibility across the services powering their cloud. Stream’s SaaS detections extend our end-to-end visibility beyond all cloud layers to include SaaS as part of our commitment to delivering full-spectrum coverage in a single platform.

We just released an integration with GitHub Audit Logs! 🥳 This integration is designed to address a wide range of GitHub threats by providing deep visibility into GitHub activities and enabling real-time detection of malicious behavior through Stream’s advanced detection mechanisms. Investigate and respond to GitHub threats quickly, with the context you actually need to take the right action.

In the dynamic realm of cloud security, the challenge of maintaining a comprehensive view of your environment can feel like navigating a complex Kabuki play. The illusion of security, created by disconnected security tools, often leads to costly investigations and wasted resources. This is especially true when it comes to understanding the interplay between your cloud infrastructure and your perimeter firewalls.

At Stream.Security, we believe the foundation of robust Cloud Detection and Response (CDR) lies in real-time visibility across your entire multi-cloud environment. That’s why our unique approach starts with an agentless methodology, creating a real-time model of your cloud infrastructure to provide immediate insights into attacks at the network, identity, and application log layers.

Announcing Stream's StreamLine Integration Program