Next lesson
Writing requirements from the seven criteria
Turn the seven criteria this site scores into seven testable requirements, mark must-haves, and set weights before the first demo.
Straight answer
A connector page is the quickest way to check a data-reach claim before a call. Look for named platforms, whether each is queried in place or ingested, what each connector can do, and whether the list is current.
Why does the connector page matter more than the home page?
Home pages describe reach in general terms, such as every source or without moving the data. A connector page, when a vendor publishes one, lists the platforms by name. For a buyer that list can be checked: you can hold it against your own platforms before anyone books a demo.
Four questions to ask of any connector list
- Is each platform named? A logo wall is a start. A written list with product names is better, because one vendor name can cover an EDR, a SIEM and more.
- Is each platform queried in place or ingested? Artemis Security's connector page shows the idea: it lists Splunk, Microsoft Sentinel, Exabeam, LogRhythm and CrowdStrike NG-SIEM as ingested, and AWS Athena, AWS Security Lake, Google SecOps, BigQuery, Snowflake, Elasticsearch, ClickHouse and Trino as queried in place.
- What can the connector do? Reading data for a hunt is one thing. Writing rules back to a platform, or acting on an endpoint, is another.
- Is the list current? Vendors add platforms with each release. Anvilogic 8.0, announced on 30 July 2026, added Elastic, CrowdStrike LogScale and Dynatrace to its federated search.
What do the six vendors publish?
They publish different amounts. Anvilogic names four SIEM platforms, six data lakes and three object stores. Mars Security's September 2026 press release names CrowdStrike Falcon, Wiz, Splunk, firewall logs, Linux Sysmon, identity providers, AWS telemetry, Snowflake and Databricks. Nebulock's documentation lists integrations including Okta, Microsoft Entra, Duo, CrowdStrike, Microsoft Defender, SentinelOne, AWS CloudTrail and Microsoft Sentinel. Cotool lists 40+ native integrations and custom MCP servers. Artemis Security lists 225+ connectors in 17 categories. Vega's connectors page does not name platforms, though Vega announced a Wiz integration on 21 September 2026.
How do you turn the list into a check?
Make a table with your own platforms as rows: SIEM, EDR, identity provider, cloud accounts, data lake and object storage. For each vendor, mark each row as queried in place, ingested, not supported, or not stated. Every "not stated" becomes a demo question. The data reach row on the matrix gives our reading of each vendor's public list, and Twelve questions to ask in a threat hunting platform demo includes the questions to ask on the call.
Related
Editorial assessment · Desk research from public vendor material, last reviewed September 2026