SOCRadar Splunk integration: new MSSP and vulnerability apps. Your analysts live in Splunk. Your external risk does not: SOCRadar alarms for dozens of managed companies, and vulnerability findings across an attack surface that changes every day. Why should seeing either one still mean another console, another input per customer, or another spreadsheet of CVEs? Today SOCRadar is releasing two new SOCRadar apps on Splunkbase at the same time: SOCRadar Incidents MSSP and SOCRadar Vulnerability. SOCRadar Incidents MSSP: alarms, severities and trends per company, with a company filter on every dashboard. Multi-Tenant socs outgrow single-tenant integrations. Most SIEM integrations are built for a single organization. That works until you are an MSSP, or an enterprise with many subsidiaries. Then every new customer means another input to configure, another API key to rotate and another dashboard to clone. The bigger risk is data mixing: when alarms from several companies land in the same index without a reliable tenant label, a search, report or alert can easily cross customer boundaries. Vulnerability findings that never reach the SIEM never get prioritized. External vulnerability findings, such as exposed services, outdated software with known CVEs and weak mobile app builds, are usually reviewed in a separate tool. They rarely sit next to the asset, identity and network data that would tell you which ones matter most, and closing a finding means switching back to yet another console. The SOCRadar capability behind these apps. Both apps are powered by the SOCRadar platform, which correlates findings from Cyber Threat Intelligence, Brand Protection, Dark Web Monitoring and External Attack Surface Management into prioritized, validated alarms. Use cases covered include: * Leaked credentials and exposed PII across all managed companies * Impersonating domains, social media accounts and mobile apps per customer * Exposed services and known CVEs on your external attack surface * Insecure mobile application builds found by Mobile Application Security SOCRadar Incidents MSSP. SOCRadar Incidents MSSP brings incidents for every company you manage into Splunk. One input, all companies. Configure a single input with your Multitenant API Key and Multi-Tenant ID, and incidents from every managed company start flowing into Splunk. One input with your Multitenant API Key and Multi-Tenant ID collects incidents for every managed company. Tenant-safe data. Every alarm keeps the company it belongs to, so searches, reports and alerts never mix tenants. MSSP Overview dashboard. Alarms, severities and trends per company, with a company filter on every dashboard. Bi-directional status updates. Update an alarm's status in SOCRadar directly from Splunk and keep both sides in sync.

Dashlane expands SIEM integrations with browser telemetry. Wed, 7th Oct 2026 (Today) Dashlane has expanded SIEM integrations for its Omnix product to include Panther SIEM, Datadog Cloud SIEM and CrowdStrike Falcon Next-Gen SIEM, extending existing links with Microsoft Sentinel and Splunk. The move is intended to bring browser-based credential telemetry into the security information and event management platforms many security operations teams already use. The integrations feed data such as at-risk credential use and visits to suspected phishing domains into those systems without requiring a separate console. Security teams commonly rely on identity providers, endpoint detection and response tools, cloud monitoring products and log aggregation systems to detect threats. Yet those systems often do not show what happens inside a web browser, where employees enter passwords, log into software services and encounter phishing pages. That browser gap has become more significant as staff use a growing number of sanctioned and unsanctioned software tools during the working day. Dashlane said some credential-related activity may not be captured by the wider security stack, particularly when users are not logged into a password manager or when logins take place outside approved single sign-on systems. The blind spot Dashlane argued that three issues recur for security teams. First, browser-based credential risk does not usually reach the SIEM because identity and endpoint tools do not generate that data. Second, shadow IT and unmanaged software-as-a-service logins may go untracked, leaving no record in the SIEM. Third, credential information often sits in a separate password management environment, forcing analysts to piece together incidents manually. Omnix captures credential-related events in the browser as they happen, whether or not single sign-on or a password vault is in use, according to Dashlane. Those signals can then be correlated with identity, endpoint, network, cloud and observability data already collected by the SIEM. The approach reflects a broader shift in security operations towards consolidating more data types into existing monitoring and response workflows. Many security teams have tried to reduce the number of separate dashboards analysts must check during an incident, both to speed response times and cut the complexity of investigations. Added platforms The new integrations cover three established names in the security monitoring market. Panther is known for cloud-native security operations and detection engineering. Datadog Cloud SIEM is part of Datadog's broader observability and monitoring platform. CrowdStrike Falcon Next-Gen SIEM extends CrowdStrike's presence from endpoint security into log management and security analytics. By adding those products, Dashlane is broadening the range of SIEM environments into which its browser-based telemetry can flow. That gives organisations a more consistent workflow across different security stacks, rather than requiring teams to switch to a separate tool to review credential risk, the company said. One use case highlighted by Dashlane is phishing. Omnix uses an AI phishing model to assess suspicious websites before credentials are entered and then alerts employees, according to the company. The resulting events can then be shown directly within the SIEM used by the security team. Dashlane also said the integrations can shorten the time needed to identify credential-related threats. Issues that previously took days or weeks to uncover can instead be detected in seconds when browser telemetry is available alongside other operational and security data, it argued. That claim points to a longstanding problem for security operations centres. When relevant evidence is split between password tools, identity systems, endpoint logs and cloud services, analysts often spend significant time correlating timelines and confirming whether a user's credentials were exposed, weak, reused or entered into a malicious site. A statistic cited by the company underlines the visibility challenge around risky password behaviour. Dashlane said that when an employee uses a risky password, there is a 53% chance that person is not logged into their password manager, meaning the broader security stack may not register the activity. Market context The expansion also reflects the growing importance of credential security in security operations. Credentials remain one of the most common routes into corporate systems, whether through phishing, password reuse or weak password practices. At the same time, browser-based work has become central to how employees access business applications, making the browser a key point of exposure. For vendors in password management and security awareness, that has created an opportunity to position browser telemetry as a missing source of operational security data. SIEM vendors, meanwhile, have been trying to ingest and correlate a broader mix of signals as customers demand faster detection and response within existing workflows. Dashlane said browser-native credential telemetry is becoming a standard signal in the modern security operations centre, much as endpoint detection and identity logs have become routine parts of monitoring and investigation.

IPQS expands integration ecosystem for fraud prevention and digital risk intelligence. Expanded ecosystem connects IPQS fraud intelligence with Shopify, Salesforce, HubSpot, Splunk, CrowdStrike, Stripe, PayPal and other leading enterprise platforms. LAS VEGAS, Sept. 28, 2026 (GLOBE NEWSWIRE) - IPQualityScore (IPQS), a provider of fraud prevention and digital risk intelligence, today announced the expansion of its integration ecosystem, giving organizations more ways to apply risk signals within the systems they use to manage customer acquisition, account access, transactions and security events. The most recent addition is IPQS's integration with Alloy, an identity and fraud prevention platform for financial institutions and fintechs. The integration makes IPQS IP address, email, phone and device risk signals available within Alloy's decisioning platform, allowing financial institutions to incorporate digital fraud intelligence into onboarding and ongoing monitoring workflows. IPQS's broader ecosystem connects its fraud and risk intelligence with established platforms across ecommerce, cybersecurity, payments, CRM and marketing automation. Available deployment options include direct integrations, plugins, marketplace applications, partner connections, APIs and workflow automation tools. "Fraud decisions increasingly span multiple systems, teams and stages of the customer lifecycle," said Dennis Weiss, CEO of IPQS. "Our integration strategy is designed to make consistent risk intelligence available at the point of decision while allowing each organization to maintain control over its policies, thresholds and customer experience." Commerce integrations involving Shopify, WordPress, WooCommerce, Magento, BigCommerce and Square enable businesses to evaluate traffic, registrations, orders and payments for signals associated with bots, automated abuse, account fraud and suspicious transactions. For security operations, IPQS connects with platforms including Splunk, CrowdStrike, IBM QRadar, Google Security Operations, Palo Alto Networks Cortex XSOAR, Fortinet FortiSOAR and Rapid7 to support threat intelligence enrichment, investigation and automated response. The IPQualityScore app for Zapier extends IPQS capabilities to widely used platforms such as Salesforce, HubSpot, Mailchimp, Stripe, PayPal, Twilio, and Marketo. These Zapier-powered connections allow organizations to incorporate device intelligence, IP address reputation, email verification, phone validation, and transaction risk intelligence into CRM, marketing, payment, and communications workflows. Additional integrations support financial services, lending, customer acquisition and performance marketing. Connections involving Oscilar, ActiveProspect, AppsFlyer, Everflow and CAKE allow IPQS signals to inform use cases such as onboarding, lead validation, mobile attribution and affiliate fraud detection. Across these environments, IPQS evaluates signals associated with proxy, VPN and Tor usage, automated activity, compromised identities, high-risk contact information, device manipulation and suspicious behavioral patterns. Organizations can use the resulting intelligence to inform approval, step-up verification, transaction review, manual investigation and other risk-based actions. Customers can use available integrations and automation tools or connect directly to IPQS APIs for proprietary applications and internal decisioning systems. About IPQS IPQualityScore (IPQS) provides fraud prevention and digital risk intelligence to more than 3,500 businesses worldwide. Founded in 2011, IPQS analyzes IP addresses, devices, email addresses, phone numbers and behavioral signals to help organizations identify bots, fake accounts, account takeover, payment fraud and online abuse. IPQS supports real-time risk decisions across account creation, authentication, transactions and other digital interactions.