What a DRX integration does
A DRX integration connects a reviewed Nova response decision to a defined provider outcome. The supported catalog covers notification, case creation, security-record forwarding, threat-intelligence enrichment, and selected containment or recovery actions.
Connecting a provider does not authorize a response action. DRX checks the selected action, customer environment, readiness, policies and required approval before execution.
Supported integration providers
- Amazon Web Services
- Supports investigations and response across AWS identities, workloads, networks and storage. Nova DRX supports 7 actions for this provider.
- Atlassian Jira
- Creates security issues in an approved Atlassian Jira project. Nova DRX supports 1 action for this provider.
- Cloudflare
- Blocks malicious IP addresses through Cloudflare and removes the block when approved. Nova DRX supports 2 actions for this provider.
- CrowdStrike Falcon
- Contains endpoints through CrowdStrike Falcon and releases them when approved. Nova DRX supports 2 actions for this provider.
- Discord
- Sends security notifications to approved Discord destinations. Nova DRX supports 1 action for this provider.
- Elastic Security
- Forwards new security alerts to an approved Elastic Security destination. Nova DRX supports 1 action for this provider.
- Generic Webhook
- Sends response information to an approved webhook destination. Nova DRX supports 1 action for this provider.
- Google Cloud Platform
- Supports identity, access and workload response in Google Cloud and Google Workspace. Nova DRX supports 4 actions for this provider.
- MISP
- Enriches indicators with MISP threat intelligence and supports approved intelligence sharing. Nova DRX supports 2 actions for this provider.
- Microsoft Azure and Entra ID
- Supports response for identities, resources, workloads and Microsoft Sentinel in Azure and Entra ID. Nova DRX supports 5 actions for this provider.
- Microsoft Defender for Endpoint
- Supports indicator blocking and device containment through Microsoft Defender for Endpoint. Nova DRX supports 3 actions for this provider.
- Microsoft Teams
- Sends security notifications through approved Microsoft Teams workflows. Nova DRX supports 1 action for this provider.
- Okta
- Suspends Okta user accounts and restores them when approved. Nova DRX supports 2 actions for this provider.
- PagerDuty
- Escalates security incidents through PagerDuty without creating duplicate notifications. Nova DRX supports 1 action for this provider.
- Palo Alto Networks
- Forwards security alerts to Palo Alto Networks Prisma Cloud and Cortex XSOAR. Nova DRX supports 2 actions for this provider.
- Proofpoint
- Quarantines email messages through Proofpoint when the response is approved. Nova DRX supports 1 action for this provider.
- SMTP Email
- Sends security notifications by email through an approved SMTP service. Nova DRX supports 1 action for this provider.
- SentinelOne Singularity
- Isolates endpoints from the network through SentinelOne and reconnects them when approved. Nova DRX supports 2 actions for this provider.
- ServiceNow
- Creates security incidents in an approved ServiceNow instance. Nova DRX supports 1 action for this provider.
- Slack
- Sends security notifications to approved Slack destinations. Nova DRX supports 1 action for this provider.
- Splunk HTTP Event Collector
- Forwards security alerts to Splunk HTTP Event Collector. Nova DRX supports 1 action for this provider.
- Telegram
- Sends security notifications through an approved Telegram bot. Nova DRX supports 1 action for this provider.
- VirusTotal
- Checks indicator reputation through VirusTotal without changing the source. Nova DRX supports 1 action for this provider.
From proposal to response
-
01
Review the evidence
Confirm the event, finding, identity, asset, or indicator that supports the proposed response.
-
02
Choose a supported outcome
Select a named provider action from the closed DRX catalog.
-
03
Apply policy and approval
Verify customer scope, integration readiness, policy conditions, and any required separation of duties.
-
04
Retain the result
Keep the action request, decision, provider-reported result, and review history together.
Questions to confirm for an evaluation
- Which exact provider outcomes should the evaluation demonstrate?
- Which actions must require approval, a second approver, or a manual-only path?
- What source-side plan, region, target type, and customer access are required?
- What reversal, recovery, and evidence-retention expectations apply to containment actions?