What Sable connects to, today and next.
Security feeds that land in the SOC, evidence connectors that prove controls on a schedule, and the places your team already works. Every one labelled live, in progress or planned.
4 live · 1 in progress · 43 planned
Request an integration →Sable's integrations settings: security operations cards for Microsoft 365, endpoint telemetry, SentinelOne and Check Point Email Security, Microsoft 365 switched from not connected to connected after consent, then the evidence collection cards marked coming soon.
Three kinds of connection.
- 01
Security feeds, into the SOC
Sign-in, mailbox, endpoint and email-threat activity arrives as detections and cases, triaged by SubRosa analysts alongside everything else. Read only.
4 live - 02
Evidence connectors, into controls
A scheduled check against a system you already run becomes evidence attached to the controls it proves. The first connector, Microsoft Entra ID, is in progress.
1 in progress - 03
Workflow, where the work goes
Alerts into chat, tickets into your PSA, detections out to a SIEM, and single sign-on into Sable itself.
43 planned
Every connection, labelled as it is.
Live means the connection carries customer data today. Three of the four live feeds are set up by SubRosa during onboarding; Microsoft 365 is a consent screen you drive. Coming soon means it is in the app's catalog with no date attached.
Security operations
Telemetry that arrives as detections, cases and escalations.
Microsoft 365
Sign in, mailbox and endpoint alerts from Entra ID and Defender arrive as detections and cases. Read only.
LiveSelf-serveEndpoint telemetry
Process, network and persistence activity from the managed agent on your workstations and servers.
LiveSet up by SubRosa
SentinelOne
Endpoint threats from your existing SentinelOne estate, triaged alongside everything else rather than in a second console.
LiveSet up by SubRosa
Check Point Email Security
Email threats from Check Point, correlated with the identity and endpoint activity around them.
LiveSet up by SubRosa
CrowdStrike Falcon
Falcon detections on the same footing as SentinelOne, for estates already standardised on CrowdStrike.
Coming soon
Sophos
Intercept X detections, common in the mid market and across MSP estates.
Coming soon
Evidence collection
Control evidence pulled from the systems you already run, so a control proves itself on a schedule instead of waiting on someone to take a screenshot.
Microsoft Entra ID
MFA coverage, conditional access, legacy sign-in and stale-account checks, run on a schedule and attached to the controls they prove. Separate from the Defender alert feed.
In progress
Okta
User inventory, MFA enrolment and deprovisioning history for the access control family. Its app list also shows which vendors your team actually uses.
Coming soon
Google Workspace
User inventory, two step verification and admin role evidence for teams on Google, plus the connected apps that show which vendors are in use.
Coming soon
Amazon Web Services
Account, IAM and logging configuration collected on a schedule and mapped to the controls that ask for it.
Coming soon
Microsoft Azure
Subscription, identity and diagnostic logging configuration, as evidence against your control set.
Coming soon
Google Cloud
Project, IAM and audit logging configuration, collected the same way as AWS and Azure.
Coming soon
GitHub
Branch protection, review requirements and access reviews for the change management controls.
Coming soon
GitLab
The same change management evidence for teams on GitLab.
Coming soon
Jira
Ticket history as evidence that changes and incidents were tracked, reviewed and approved.
Coming soon
Linear
The same change and incident evidence for teams running on Linear.
Coming soon
- I
Microsoft Intune
Disk encryption, screen lock, OS patch level and antivirus state per device. One connection covers a whole control family you would otherwise evidence by screenshot.
Coming soon - J
Jamf
The same device compliance evidence for Mac estates managed in Jamf.
Coming soon - Kj
Kandji
Device compliance evidence for Apple estates managed in Kandji.
Coming soon
- B
BambooHR
Joiner and leaver dates, role changes and reporting lines for the personnel controls, so onboarding and offboarding evidence itself.
Coming soon 
Gusto
The same personnel evidence for teams running payroll and HR in Gusto.
Coming soon- R
Rippling
Personnel records plus the app and device grants Rippling makes on hire, which is access provisioning evidence in the same pull.
Coming soon 
ADP
Personnel evidence for the larger payroll estates that run on ADP.
Coming soon
- K4
KnowBe4
Security awareness training completion and phishing simulation results, which sit in the training platform rather than the HR system.
Coming soon
- Ck
Checkr
Background check completion for each new hire, as evidence for the personnel screening controls.
Coming soon - Cn
Certn
The same screening evidence for teams that run background checks through Certn.
Coming soon - St
Sterling
Screening evidence for teams that use Sterling for background checks.
Coming soon - Hi
HireRight
Screening evidence for teams that use HireRight for background checks.
Coming soon
Vendor risk
What is already known about a vendor's security, before anyone fills in a questionnaire.
SecurityScorecard
An external rating on a vendor before anyone answers anything, so a questionnaire confirms a picture rather than creating one.
Coming soon- Bi
BitSight
The same external rating, for teams whose procurement already cites BitSight.
Coming soon
Policy sources
Write policies where your team already works. Sable keeps the status, review dates, approvals and acknowledgments.
SharePoint and OneDrive
Map a folder and a changed file arrives in Sable as a new draft, straight into the usual review.
Coming soon
Notion
Author policies in a Notion database. Sable owns the status, review dates, approvals and acknowledgments around them.
Coming soon
Google Drive
The same one way sync, for teams on Google Workspace rather than Microsoft 365.
Coming soon
Box
Policy sync from a mapped Box folder. Built when a customer asks for it, so tell your SubRosa contact if that is you.
On request
MSP tooling
The PSA and RMM an MSP already runs on. Tickets stay in step, and the device estate doubles as compliance evidence.
- CW
ConnectWise PSA
Raise and update a ticket when a case is opened or escalated, so the SOC queue and the service desk agree.
Coming soon - H
HaloPSA
Two way ticketing against HaloPSA, on the same mechanism as ConnectWise.
Coming soon - At
Datto Autotask
Two way ticketing against Autotask, on the same mechanism as ConnectWise.
Coming soon - N
NinjaOne
Device inventory and patch status from the RMM. Sable scans you from the outside, so this is the only view of what is actually patched inside.
Coming soon 
Datto RMM
The same inventory and patch evidence for estates managed in Datto RMM.
Coming soon- Au
ConnectWise Automate
Inventory and patch evidence for estates managed in Automate.
Coming soon
Notifications and export
Where the work goes once Sable has raised it.
Slack
Post detection alerts and new cases into a channel, so nobody has to be signed in to find out something happened.
Coming soon
Microsoft Teams
The same alerts and case activity, posted to a Teams channel instead.
Coming soon
Splunk
Send Sable detections out to a SIEM you already run, rather than asking your analysts to watch two screens.
Coming soon- Se
Microsoft Sentinel
The same outbound stream, into a Sentinel workspace.
Coming soon
Sign in to Sable
Single sign-on and user provisioning: how people reach Sable, and lose access when they leave.
Okta
Sign in with Okta, with accounts created and removed automatically as people join and leave.
Coming soonMicrosoft Entra ID
Sign in with Microsoft, so your conditional access and MFA policies apply to Sable too.
Coming soonGoogle Workspace
Sign in with Google, with accounts managed from your Workspace admin console.
Coming soon- JC
JumpCloud
Sign in and user provisioning for teams that manage identity in JumpCloud.
Coming soon
Don't see your tool?
Tell us what you run and we'll route it to product. A sensor you already pay for is the fastest thing to add.
Common questions
- Do I need an integration to use Sable?
- No. Frameworks, controls, policies, risk and vendor questionnaires run on evidence your team uploads and reviews. Connections add telemetry to the SOC and, as evidence connectors ship, evidence that collects itself on a schedule.
- Who sets up a live feed?
- Microsoft 365 is a consent screen you complete as a Global Administrator; nothing is installed. Endpoint telemetry, SentinelOne and Check Point Email Security are set up by SubRosa during onboarding, because they arrive on managed infrastructure rather than through a button in the app.
- Is access read-only?
- Yes. The Microsoft 365 connection reads sign-in, mailbox and endpoint alerts and changes nothing in your tenant. Threat feeds are inbound only.
- What does “Coming soon” mean?
- It is in the app’s integration catalog and on the product plan, without a date. We label it so you can plan around what is live rather than what is promised. “On request” means it is built when a customer asks for it.
- Will evidence connectors make me compliant automatically?
- No. A connector collects evidence on a schedule and attaches it to the controls it proves. A person still decides whether the control is implemented and the evidence sufficient. The first connector, Microsoft Entra ID, is in progress.
- How do I request an integration?
- Tell us what you run. Sensors you already pay for, such as EDR and email security, are the fastest to add: the SOC reads them without you watching a second console.