TechWatchAlert
Sign in Free trial
NIS2PricingFAQSign inStart for free
Connectors

All your tools, one monitoring feed

TechWatchAlert plugs into your repositories, fleet, RMM, scanners, ticketing tools and SIEM: each connector enriches the real inventory your alerts are matched against, or takes the alert to where the team acts.

Code repositories

The dependencies in your repositories, read from their lockfiles, manifests and SBOMs, and kept up to date with no manual entry.

GitHubYour GitHub dependencies monitored on every push, through a read-only app.View connector →GitLabYour gitlab.com or self-hosted projects monitored, read-only and without webhooks.View connector →

Containers

The system packages in your container images, which dependency files cannot see.

Docker and image registriesThe system packages in your Docker images (OpenSSL, glibc, curl…) finally in your monitoring.View connector →KubernetesThe images actually running in your clusters, discovered with nothing more than permission to list pods.View connector →

Fleet and cloud

The software actually installed on your workstations, servers and cloud machines, read from where you already inventory it.

GLPIThe software inventoried in GLPI becomes your monitored stack, resynced automatically.View connector →Microsoft IntuneThe apps Intune detects on your managed devices, monitored with nothing to install.View connector →Jamf ProThe apps on your Jamf Pro-managed Macs, monitored Mac by Mac.View connector →WazuhYour Wazuh agents already collect packages: TechWatchAlert turns them into precise CVE monitoring.View connector →AWS Systems ManagerThe software on your EC2 instances and hybrid servers, read from the Systems Manager inventory.View connector →Microsoft AzureYour Azure VMs and Azure Arc servers monitored through Change Tracking & Inventory.View connector →TechWatchAlert agent (Windows, Linux, macOS)A lightweight agent that reports the inventory and missing updates of every workstation and server.View connector →Microsoft Entra IDThe devices in your Entra ID directory join the fleet, with their OS and last sign-in.View connector →Active Directory (LDAP)The computers in your Active Directory, with their OS and last logon.View connector →Palo Alto Cortex XDREndpoints protected by Cortex XDR join the fleet, with their agent version.View connector →Microsoft Defender for EndpointDefender machines and the software installed on each, with no extra agent.View connector →ServiceNow CMDBThe computers in your CMDB and their software, monitored as ServiceNow knows them.View connector →

RMM

The inventory your RMM already keeps, read through its API: devices, software and missing patches, without deploying another agent.

NinjaOneNinjaOne devices, software and pending patches, read through the API, without deploying another agent.View connector →Datto RMMThe devices of your Datto RMM sites and their audited software, read through the API and monitored without another agent.View connector →N-able N-centralYour N-central customers' devices and their inventory, read through the API for CVE monitoring endpoint by endpoint.View connector →AteraYour Atera agents, their OS and their available patches, read through the API and matched with CVEs.View connector →

Virtualization

Your hypervisors and their virtual machines: the exact version of each host, the one targeted by the most exploited flaws.

VMware vCentervCenter and every ESXi host version monitored, with the list of your virtual machines.View connector →VMware ESXiThe version of a standalone ESXi host and its virtual machines, without vCenter.View connector →Microsoft Hyper-VThe exact Windows Server version, the host's software and its virtual machines.View connector →Nutanix Prism CentralAOS and Prism Central versions, each host's hypervisor and your virtual machines.View connector →Proxmox VEThe version of Proxmox VE and its components (kernel, QEMU, LXC, Ceph…) on each node, with your virtual machines.View connector →

Network and firewalls

The OS version of your firewalls and network devices, attackers' first target, read again automatically.

FortiManagerThe FortiOS version of all your managed FortiGates, read automatically from FortiManager.View connector →FortiGateThe FortiOS version of a FortiGate firewall, monitored without FortiManager.View connector →Cisco MerakiEvery Meraki device and its firmware version, across the organization.View connector →Stormshield SNSThe version of your Stormshield Network Security firewalls, the sovereign firewall, tracked automatically.View connector →

Vulnerability scanners

Your scanners and EDRs read through their API, or their reports imported, checked against your tracking cases to surface unconfirmed fixes and inventory gaps.

Tenable NessusYour Nessus scans checked against your cases: every unconfirmed fix stands out, host by host.View connector →Tenable Vulnerability ManagementOpen vulnerabilities from Tenable Vulnerability Management read through the API and checked against your cases, with no export to upload.View connector →Tenable Security CenterThe vulnerabilities of every host in your Tenable Security Center console, read through the API and checked against your tracking.View connector →Qualys VMDRYour Qualys VMDR detections, read through the API or imported, checked against your tracking to see what really remains to fix.View connector →Rapid7 InsightVM / NexposeYour InsightVM vulnerabilities read through the API, or your InsightVM and Nexpose exports imported, turned into fix tracking, host by host.View connector →Microsoft Defender Vulnerability ManagementThe vulnerabilities Defender sees on each machine, software by software, checked against your cases without deploying anything.View connector →CrowdStrike Falcon SpotlightThe open vulnerabilities of every endpoint protected by Falcon, read through the API with a single read scope.View connector →Greenbone / OpenVASYour Greenbone and OpenVAS reports checked against your monitoring, minus known false positives.View connector →TrivyYour Trivy reports uploaded by CI and checked against your cases, on every build.View connector →GrypeYour Grype reports checked against your tracking, with the evidence behind each match.View connector →

SBOMs and lockfiles

An inventory imported from a single file: CycloneDX or SPDX SBOMs, manifests and lockfiles from the main ecosystems.

CycloneDX and SPDX SBOMs and lockfilesOne SBOM or lockfile is enough: your components are monitored from the moment you import.View connector →

Exposed surface

What your sites and domains show the Internet: served technologies, certificates, subdomains and exposed services.

Websites and certificatesYour public sites scanned regularly: technologies, HTTP status and HTTPS certificate.View connector →External attack surface (EASM)Your domains as seen from the Internet: subdomains, exposed services and risky certificates.View connector →

Notification channels

Alerts land where the team works: team chat, email or signed webhook.

SlackUrgent alerts in your Slack channel, the rest in a daily digest.View connector →Microsoft TeamsYour alerts as Adaptive Cards in Teams, with one-click triage.View connector →DiscordMonitoring alerts in your Discord channel, urgent ones live and the rest in a digest.View connector →EmailUrgent alerts right away, the rest in a digest: everyone picks their pace and triages from the email.View connector →Signed webhooks (JSON)Every alert and inventory change as HMAC-signed JSON, for your SIEM or scripts.View connector →

Ticketing

A complete ticket opened in the tool where the team fixes, with no duplicate per CVE, and its status flowing back into the case.

JiraA complete Jira ticket for every CVE to fix, without copying a single line, and its status flowing back into the case.View connector →GitHub IssuesThe CVE to fix lands as a GitHub issue, in the repository of the team that fixes it, and its closing flows back into the case.View connector →GitLab IssuesThe CVE to fix lands as a GitLab issue, on gitlab.com or your own instance, and its closing flows back into the case.View connector →GLPI (tickets)The CVE to fix lands as a GLPI ticket, with an urgency that follows the decision, and its resolution flows back into the case.View connector →ServiceNow (incidents)A ServiceNow incident, or a Vulnerability Response vulnerable item, for every CVE to fix, and its state flowing back into the case.View connector →

SIEM

Your organization's security events sent to your SIEM as they happen, so the SOC can correlate them with its logs.

Syslog TLS (CEF or JSON)TechWatchAlert security events in your syslog collector, encrypted over TLS, in CEF or JSON.View connector →SplunkTechWatchAlert security events in Splunk through the HTTP Event Collector, ready to correlate.View connector →Microsoft SentinelTechWatchAlert security events in a table of your Log Analytics workspace, queryable in KQL.View connector →ElasticTechWatchAlert security events in an Elasticsearch data stream, with ECS fields.View connector →

Directory and SSO

Sign-in with the corporate account, and accounts created, updated and deactivated by your directory.

SAML 2.0 and SCIM 2.0Sign-in with the corporate account over SAML 2.0, and accounts created, updated and deactivated by your directory over SCIM 2.0.View connector →

AI and MCP

Query and drive your monitoring from your AI assistant, with your own permissions.

MCP connector (Claude, ChatGPT, Le Chat, Cursor…)Ask your AI assistant “am I affected?”: it answers with your data and your permissions.View connector →

API and CI

Your monitoring data in your scripts, your SIEM and your continuous integration pipelines.

CI/CD (GitHub Actions, GitLab CI…)Your pipeline uploads SBOMs and scan reports on every build: the inventory follows the code you ship.View connector →REST API v1Your alerts, stack and cases in your scripts and SIEM, through a documented API.View connector →
Connectors

Plug in your tools in minutes

Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.

Talk to the team

Free plan, no credit card · hosted in France