Alert sources and integrations: what an AI SOC needs to connect to

• SIEM: correlated alerts from logs across the environment, and the place many investigations query first.
• EDR: endpoint alerts, process trees and the ability to isolate a host.
• Identity: sign-in anomalies, privilege changes and the ability to revoke sessions or reset credentials.
• Email: reported phishing and malicious attachments, and the ability to pull a message from mailboxes.
• Cloud: configuration changes and suspicious API activity in cloud accounts.

An alert source raises the alert. An investigation source answers questions about it: the HR system that says whether a user is a leaver, the asset inventory that names a server's owner, the ticketing system that shows a change was approved. Playbooks call investigation sources that their authors thought of; an agent can call any it is connected to. List both kinds when you check coverage, because an agent without the right investigation sources reaches weaker verdicts.

Some details behind the numbers: Dropzone AI groups its 90+ integrations into 14 categories, including SOAR platforms. Torq lists 300 pre-built integrations and 4,000+ pre-built steps, and generates new integrations with AI. Mate Security names Microsoft, Google Workspace, CrowdStrike, SentinelOne, Proofpoint, Slack and threat intelligence platforms and says it is stack agnostic, but publishes no count. 7AI publishes no count on the pages we reviewed.

An integration can mean read-only access to alerts, or full read and write access with response actions. Two vendors with the same count can cover very different ground. Ask, for each of your tools, what the platform can read and what it can do.

How data is reached also differs. Dropzone AI says it investigates without data normalisation, querying tools through their APIs. 7AI's Federated SIEM, launched in July 2026, queries data where it already lives, in SIEMs, data lakes and cloud platforms. Either approach avoids copying everything into one store first, which matters for cost and data residency.

• List your top alert sources by volume and your top investigation sources by how often analysts use them.
• Ask each vendor for its supported list and mark each tool as read, act or not supported.
• For tools not supported, ask whether a custom or AI-generated integration is possible and who maintains it.
• Test the three most important integrations in the proof of value, not in a demo environment.

Coverage of alert sources carries 15% of the weighted score in our method. The highest score is 10, held by Cortex XSOAR; the lowest is 6, held by 7AI.