Every tool is right.
None of them agree.
You already own the right tools. Rallin is the layer that reads all of them, reconciles the disagreements into one answer you can trust, and stages the fix for a human to approve. Not another pane of glass — one system that can actually act.
Four steps. No agents installed.
Rallin reads every tool through its existing API, resolves what they disagree on, proves the answer with evidence, and stages the fix — nothing executes until a named human signs off.
Read
Read-only API into every tool in scope. No agents on the tools themselves.
Reconcile
Resolve where the tools disagree into a single, coherent answer.
Validate
Prove the answer, with the underlying evidence attached.
Stage
The fix is staged and ready. Nothing moves until a human says so.
Watch Rallin work a real scenario.
Pick a scenario. Each one plays out the same Read → Reconcile → Validate → Stage sequence from the section above, for real.
Browse all of these by pack, with the buyer-by-buyer argument for each →
The governed execution fabric.
Rallin is the layer that sits on top of the security and IT tools you already run. It reads them over their own APIs, cross-references what each one sees about anything in your environment, and turns the highest-confidence answer into one action — staged, human-approved, and permanently logged.
- A layer over the tools you already own, connected read-only through their existing APIs
- One cross-tool answer, reconciled from every connected source's view of the same asset
- A staged, human-approved action, executed through the tool that already owns it
- An append-only audit record of every decision — attributable, timestamped, permanent
- Another pane of glass to check alongside the fourteen tools you already have open
- A SIEM, XDR, or CMDB replacement — it reads them, it doesn't replace them
- An autonomous agent acting on its own — nothing executes without a human's approval
- A rip-and-replace project — most stacks are already covered by connectors on day one
You paid for a platform, use a third of it, and pay a person to reconcile the rest by hand.
The platform play doesn't work. Best of breed does — with one catch.
Every major vendor is pitching the same thing: consolidate everything onto their platform. Real enterprises don't — best of breed is what good security leaders actually recommend. The catch is that the tools don't talk to each other. That's the one problem left to solve.
The platform play
Consolidate everything onto one vendor's roadmap. Requires lock-in. Almost nobody actually does it.
Best of breed
What you actually run, and the right call. But the tools don't talk, so somebody has to be the connective tissue by hand.
Keep both. Add Rallin.
Best of breed, plus the coordination layer that makes it act like one platform. No rip-and-replace, no lock-in.
| System | What it does | Where it stops |
|---|---|---|
| SIEM | Best telemetry you have | Stops at detection — blind to identity, email and SaaS posture |
| SOAR | Executes the runbook you wrote | Can't decide when three tools disagree |
| AI copilot | Explains one tool | You still do the reconciliation work |
| Only Rallin | Reconciles every tool into one truth | Stages the governed action, with your sign-off |
The questions every security lead asks first.
Rallin speaks to the tools you already run.
Reads every tool's view → reconciles to one truth → acts back through the same tools. 98+ connectors live today, and growing. Browse the full catalog, grouped by category →
Give us one cross-tool question you fight today.
Thirty minutes. Live. Read-only.
Aggregate. Authorize. Act.
Governed execution, at the speed of the question. Every query and every action is signed, timestamped and written to a tamper-evident chain — attributable to a named human, by default.
Agentic systems never touch your applications.
The AI plans. A local daemon governs and holds the keys. A human approves. Three separate layers, so no single one of them can act alone.
AI proposes
Reads every connected tool and proposes what should happen. It never sees credentials and never touches a system directly.
Daemon governs
Runs locally, holds the credentials, gates every single action, and signs the record to a tamper-evident audit chain.
Human approves
Acts only through your existing tools' native APIs — never a shadow integration, never a bypass.
Eight commitments that don't move, deal by deal.
Every action is a proposal
Nothing executes on its own. Every fix is a step-by-step proposal — take it yourself, or approve it for Rallin to carry out directly. No switch grants a connector blanket write access.
Human-gated execution
Every proposed action is staged and waits on a named human's sign-off — no autonomous mutation, ever.
Tamper-evident audit chain
Every query and action is signed, timestamped and written append-only. Nothing is ever deleted from the record.
BYO model, BYO key
Bring the AI provider you already have a relationship with. Rallin's governance layer is provider-agnostic.
Retention, your call
Evidence for dashboards and audit reports is purged by default after 30 days, configurable up to a year. Nothing is retained beyond what you choose.
Native APIs only
Every action executes through the tool's own API — never a shadow integration, never a bypass of its own controls.
Fail-safe, not fail-open
Rallin is never in the data path of the tools it reads. If it goes down, your stack runs exactly as it does today — nothing degrades.
Secrets never touch the model
Credentials live in a vault, not a prompt. The AI layer proposes and reasons over data — the governance daemon is the only thing that ever holds a key.
Three tools. Three answers. One truth.
Each tool isn't wrong — it's just narrow. Every source below is reading the exact same CVE, and every one of them is telling the truth about what it can see.
| Source | Says | Because it can only see |
|---|---|---|
| Vulnerability scanner | Critical | The CVSS score of an installed package |
| Patch management | High | Its own remediation backlog and SLA |
| Attack-path analysis | Not reachable | Network topology, not runtime identity |
Exploitable and exposed, with the path. Remediation staged, awaiting approval. Seconds, not a war room.
Five medium-severity signals. One confirmed attack.
A phishing email, an odd login, a strange process, a privileged-access event, unusual outbound traffic — each one looks like ordinary noise alone. Rallin ingests all five simultaneously and reconstructs the timeline before the exfiltration completes.
From proposal to production, every step is a record.
Rallin reads the disagreement
Every connected tool's view of the target is pulled in real time, read-only.
One answer, with evidence attached
The conflicting signals resolve into a single finding, with the source data behind it.
The fix waits for a name, not a timer
Nothing executes automatically — the proposed action sits until a specific human approves it.
Runs through the tool's own API
Approved actions execute natively in the system of record — never a side channel.
Written to the audit chain, permanently
Signed, timestamped, attributable to the human who approved it. Append-only — nothing is ever deleted.
Eight things Rallin actually does today.
Not a roadmap slide — this is what's running in production, orchestrating across the tools you already have.
Resolves the same asset across every tool
Your endpoint tool calls it a computer ID. Your CMDB calls it a CI. Rallin cross-references both into one record with a confidence score, so every downstream workflow already knows they're the same box — the foundation every other cross-tool workflow builds on.
Fixes what the stock connector breaks
Out-of-the-box connectors between your endpoint tool and your CMDB are known to duplicate assets, route software records to the wrong table, and silently mark installed software as absent. Rallin reconciles the roster directly and catches what the stock integration misses.
Auto-closes vulnerabilities that are already patched
A scanner flags a CVE from a network probe; your endpoint tool already proves the patch is installed. Rallin closes the ticket with that evidence attached — recovering the 20–40% of vulnerability-management analyst hours typically lost to stale findings. Anything ambiguous gets flagged for a human, never guessed.
Answers "what does this actually touch" before a change ships
Unions your CMDB relationships, service mapping, and observability topology — Datadog, Dynatrace, ExtraHop, New Relic, whatever you run — into one blast-radius answer, with every edge carrying its own trust and freshness. Read-only: Rallin doesn't build or own the map, it reads the ones you already have.
Learns how your tools translate to each other
Every vendor names the same field differently. Rallin resolves it in three tiers — cache first, then heuristics, then AI only when it has to — and every successful or failed mapping feeds back into the next one's confidence score.
Drives your tools' own rollout mechanism, not a new one
When Tanium, CrowdStrike, or Intune already has a phased-deployment ring, Rallin drives that instead of reinventing it — pilot, canary, everyone, with an automatic abort if the metrics regress mid-rollout.
An audit chain, not an audit log
Every step is appended to a tamper-evident chain, anchored wherever your compliance posture requires it — a local file, ServiceNow, a timestamp authority, Git, even a public blockchain for the cases that need it.
Never marks something fixed without proving it
Every mutation Rallin stages carries its own verification step — deploy a patch, then reconfirm the scan is clean; close a ticket, then reconfirm the finding is actually gone. If the two don't agree, it stays open and flagged, never silently marked done.
The questions that come up in every technical review.
See it reconcile your stack, live.
30-minute technical review · read-only · end-to-end.
Rallin speaks to the tools you already run.
Read-only API into every tool in scope. No agents, nothing ripped out. 98+ connectors live today, growing continuously — browse the full catalog by category, or search across it below.
Every new connector walks the same path — read-only from the first handshake, field-mapped against everything else you run, reconciled into one truth, and fully converged with the rest of your stack. The core is signal from the start; the rest just has to catch up.
No match. Tell us what you run — we're adding connectors continuously.
Don't see your stack?
We onboard new connectors continuously. Tell us what you run.
One product. Every domain you run.
Rallin isn't a shelf of modules to shop between — it's one governed execution fabric, sold as one relationship. These are the functional areas it already reaches, not separate products to pick and choose.
Identity, IT service management, and endpoint visibility that everything else is built on. This is where Rallin lands first in any environment — read-only, before anything else is wired in.
Endpoint detection, SIEM, vulnerability and exposure management, and offensive validation — the tools generating the alerts your team triages every day.
Patch, deployment, provisioning and configuration — the day-to-day work of actually keeping a fleet current once a fix is approved.
What's routing, inspecting and blocking traffic — the perimeter and the segments behind it.
Not just where data lives — whether it's recoverable when an incident forces the question.
Hosts, clusters and hypervisors — infrastructure most tools never look at directly, patched and managed like everything above it.
Access that's supposed to match a role — and the drift that happens the moment nobody's watching.
Controls and evidence tied to the frameworks auditors actually ask about — pulled from what's already true operationally, not assembled by hand every cycle.
Operational technology and industrial control systems — read-only by default here more than anywhere else, because the cost of getting it wrong is physical.
Out-of-band management most tools never touch — the layer that's still reachable even when the OS on top of it isn't.
Run something that's not on this list?
The list keeps growing. Tell us what you run — see the Integrations catalog for the full connector-level view.
Same product. Six different conversations.
Every tool sees one hop. No tool sees the chain. Here's the argument that lands in each room — pick the one you're walking into.
Five ordinary alerts. One attack nobody connected in time.
This is what most breach forensics actually find: the signals were all there, just scattered across tools that never talked to each other. Medium severity, hundreds of times a day, queue too full to connect the dots.
Phishing email lands
Flagged suspicious, not blocked. One alert among hundreds that day.
Credentials harvested, unusual login
Login from an unfamiliar location. Logged as low severity.
Lateral movement begins
Unusual process execution on an endpoint. Medium severity.
Privilege escalation
An unusual privileged-account access event, on its own unremarkable.
Data exfiltration starts
Unusual outbound traffic from a cloud resource. Still, no single tool sees the chain.
Five medium-severity signals become one confirmed incident
Timeline reconstructed automatically across all five tools, detectable roughly 40–60 minutes before the exfiltration completes — full context attached, one incident, not five separate tickets.
Recover millions in wasted team time
For the CFOSecurity and IT ops teams spend roughly 40% of their hours gathering context, normalizing data, and reconciling tools before they can act on anything real. A 20-person team at $150K fully loaded is $3M a year in payroll; 40% of that is $1.2M of pure overhead.
Rallin recovers that time without adding a person — it isn't a headcount argument, it's an arithmetic one. The team keeps every analyst it has; those analysts stop spending their day on reconciliation and start spending it on judgment.
Prevent breaches that cost $10.2M each
For the CISOThe average US breach now costs $10.22M — an all-time high; the global average is $4.44M (IBM, 2025). Modern attacks are multi-vector by design: phishing gets access, a compromised identity moves laterally, a cloud misconfiguration exfiltrates. Each tool sees one hop. No tool sees the chain.
Rallin correlates across the kill chain in real time and surfaces the attack in progress — not in the forensics report three weeks later.
Do more without hiring
For the CEO / COOThere are 4.8 million unfilled cybersecurity roles globally (ISC2, 2025) — and the people who do exist are expensive, hard to retain, and burning out on manual reconciliation work that has nothing to do with judgment.
Rallin's conservative target is an 80% efficiency gain per person — not by working the team faster, but because it handles everything below the threshold of human judgment before it ever reaches a queue.
Unblock the AI adoption that's already stalled
For the CEO — increasingly board-levelEvery large enterprise is deploying Copilot, internal agents, or other AI tooling right now — and most rollouts are held up because security can't see what those tools access, what data they touch, or whether the promised controls actually work.
Rallin sits as the governed gateway between your AI tools and every system they call — every action an agent takes runs through the same permission and approval layer first. Security says yes because they know exactly what's allowed to happen next, not because they audited every model's blast radius by hand.
Satisfy regulators without hiring a compliance team
For General Counsel / CFOSEC disclosure rules, the EU AI Act, SOC 2, HIPAA, HITRUST — regulators want evidence, and evidence requires visibility across every tool in the environment. A single SOC 2 Type II program alone runs $75K–200K a year in audit and consulting fees at enterprise scale; stack multiple frameworks and Rallin's estimate for the combined evidence-assembly spend lands at $300–500K.
Rallin auto-generates the evidence package from its correlation data: every control, detection and remediation action, timestamped and mapped to the relevant framework.
Survive M&A without eighteen months of chaos
For CFO / Board — any acquirerAcquire a business and you instantly have two of everything — two SIEMs, two identity systems, two clouds — and an eighteen-month manual reconciliation staffed by expensive consultants, right in the highest-risk window for a breach.
Rallin sits above both environments on day one and delivers unified visibility before a single system is consolidated.
Board-ready reporting without the prep work
For the CISO — and it lands with the boardCISOs lose two to three days before every board meeting pulling numbers from fifteen tools that don't agree with each other, then translating tool metrics into language a board understands.
Rallin generates it continuously: risk exposure in dollars, remediation velocity in weeks, exposure trends over time, tool ROI against the investment.
Same reconciliation engine, thirteen different shapes of value.
The arguments above are organized by who's in the room. This is the same range organized by what actually happens — a live incident, a compliance ritual nobody has time for, or waste nobody's tracking — across every pack Rallin reaches. (Foundation — ServiceNow, Tanium read/observe, MS Graph, AD — is the plumbing under all of it, which is why it doesn't get its own card.)
Five things a SIEM was never built to do.
Every major SIEM vendor has tried to bolt on ML, SOAR integration, and cloud connectors. The architecture underneath is still twenty years old — designed for five tools and on-prem logs.
1. Correlate across tools that never fed it
Fewer than half of the average stack is ever fully integrated with the SIEM. Cloud posture, identity, endpoint tools all hold data the SIEM never sees. Rallin ingests everything, integrated or not.
2. Understand asset context
A SIEM sees an IP address. Rallin knows it's a payment server, owned by finance, with three known vulnerabilities, accessed by an identity that behaved oddly two weeks ago.
3. Normalize across schemas
A SIEM correlates within its own data. Rallin correlates across tools with different schemas, severity models and definitions of the same asset — making CrowdStrike, Wiz and Okta speak one language.
4. Act, with sign-off
A SIEM fires an alert and stops — a human pivots across six tools to decide and execute manually. Rallin stages the containment action and executes the moment a human approves it.
5. Get smarter without new rules
SIEM detection logic is static until an engineer updates it. Rallin's correlation model learns what normal looks like in each environment as it runs.
The reframe that lands
"Rallin doesn't replace your SIEM — it makes it work the way you thought it would when you bought it."
Which room are you walking into?
Bring your number. We'll show you what Rallin does with it, live.
Rally the troops. Go all in.
Your tools are the troops. Fourteen of them, each one bought for a real reason, each one good at its job — and each one fighting alone. To rally them is to give them a point to converge on: one call, one read, one place they all show up. That's step one. Step two is the one most platforms flinch on: once they're at the table, you don't hold half your hand back "to be safe." You play every capability you paid for — read, reconciled, and governed all the way through. No hedge. No half-connected pilot. No "let's start read-only and see how it goes."
"A rally point is a real thing: the coordinate a dispersed unit converges on when the plan breaks. Once everyone's there, nobody holds back a reserve."
We kept landing in the same room. A security team with fourteen genuinely good tools, a CISO who'd made every one of those purchases for a real reason, and nobody able to answer a simple cross-tool question without a war room and a spreadsheet. The tools weren't the problem. The silence between them was.
Every vendor we talked to wanted the same fix: rip it out, buy their platform, start over. That's not a fix, it's a hostage situation with better branding. The teams doing it right were the ones who'd already assembled the best tool for each job — they just had nobody, and nothing, doing the job of making those tools agree with each other.
So we built the layer instead of the replacement. Something that reads what every tool already sees, reconciles the parts where they disagree, and hands a human one governed decision instead of five browser tabs. We write it the way we'd want a vendor to talk to us — short sentences, real numbers, nothing that survives having the product name swapped out. No "revolutionary." No "seamless." Just the layer that was missing.
Eight arms. One answer. None of them touch prod without permission.
An octopus has eight arms and roughly zero stress about any of them — and that's not just a cute mascot fact, it's the whole pitch drawn as biology. Two-thirds of an octopus's neurons live out in its arms. Each one reaches, tastes and reacts entirely on its own, faster than any central brain could direct it to. And yet the animal still moves as one.
That's what your stack looks like on a good day: fourteen tools, each one making a good local call in real time, adding up to a single decision instead of fourteen separate alarms. Rally wears the mark the same way his arms work — not stamped on top, but grown in, the pattern every arm is already converging toward. Eight arms, one brain, and nothing moves until the brain says so.
Out of many, one.
See what one governed decision looks like across your entire stack.
Give us one cross-tool question you fight today.
Thirty minutes. Live. Read-only. We'll connect to a read-only slice of your real stack and show you what Rallin does with it.
Request received.
Someone from the Rallin team will follow up shortly to get your session on the calendar. We read every request personally.
Something didn't go through.
Email us directly instead — open a pre-filled message to sales@rallin.ai.
License Agreement
The governing terms for use of Rallin's software, reproduced here in full. This page is the canonical, current version of the Agreement — reference it by URL in an executed order form or master agreement.
This End User License Agreement (this "Agreement") is entered into by and between Rallin Inc., a Delaware corporation with its principal place of business at 941 Pleasant Ln, Glenview, IL 60025 ("Rallin," "we," "us," or "our"), and the individual or entity that accepts this Agreement or that is identified as the licensee on an applicable Order Form ("Customer," "you," or "your"). Rallin and Customer are each a "Party" and together the "Parties."
BY (A) CLICKING "I ACCEPT" OR ANY SIMILAR BUTTON OR CHECKBOX PRESENTED WITH THIS AGREEMENT, (B) EXECUTING AN ORDER FORM, QUOTE, OR OTHER ORDERING DOCUMENT THAT REFERENCES THIS AGREEMENT, OR (C) ACCESSING, INSTALLING, CONFIGURING, OR USING THE SOFTWARE IN ANY MANNER, CUSTOMER AGREES TO BE BOUND BY THIS AGREEMENT. IF THE INDIVIDUAL ACCEPTING THIS AGREEMENT IS DOING SO ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, SUCH INDIVIDUAL REPRESENTS AND WARRANTS THAT THEY HAVE FULL LEGAL AUTHORITY TO BIND SUCH ENTITY TO THIS AGREEMENT, IN WHICH CASE "CUSTOMER" REFERS TO THAT ENTITY. IF THE INDIVIDUAL ACCEPTING THIS AGREEMENT DOES NOT HAVE SUCH AUTHORITY, OR IF CUSTOMER DOES NOT AGREE TO THESE TERMS, RALLIN IS UNWILLING TO LICENSE THE SOFTWARE TO CUSTOMER AND CUSTOMER MUST NOT ACCEPT THIS AGREEMENT, ACCESS THE SOFTWARE, OR USE THE SOFTWARE IN ANY MANNER.
WHEREAS, Rallin has developed, and owns or licenses, certain proprietary software-as-a-service technology known as "Rallin" that connects to security, information technology, and cloud tools that Customer already operates, correlates and reconciles the data those tools produce into a unified operational view, and, where enabled and configured by Customer, facilitates or executes governed response and remediation actions across Customer's environment and its connected tools;
WHEREAS, Customer desires to access and use the Software for its own internal business purposes, and Rallin is willing to make the Software available, solely on the terms and subject to the conditions set forth in this Agreement and any applicable Order Form;
NOW, THEREFORE, in consideration of the mutual covenants, terms, and conditions set forth herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows.
1. DEFINITIONS
As used in this Agreement, the following capitalized terms have the meanings set forth below. Other capitalized terms are defined where they first appear.
(a) "Affiliate" means, with respect to a Party, any entity that directly or indirectly controls, is controlled by, or is under common control with such Party, where "control" means ownership of fifty percent (50%) or more of the voting equity interests of such entity.
(b) "Actions" means any remediation, response, configuration-change, containment, ticketing, notification, or other operational action that the Software takes, executes, triggers, or facilitates within the Customer Environment or any Connected Tool, whether initiated automatically by the Software or upon Customer's review and approval.
(c) "Authorized User" or "User" means an employee, contractor, or agent of Customer who is authorized by Customer to access and use the Software under Customer's account and for whom Customer has obtained any necessary license or seat entitlement under an Order Form.
(d) "Confidential Information" means any non-public, proprietary, or trade-secret information disclosed by one Party (or its Affiliates) to the other, whether disclosed in written, electronic, oral, or any other form, that is marked or identified as confidential at the time of disclosure, or that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure. Rallin's Confidential Information includes, without limitation, the Software, its architecture, algorithms, and object and source code, non-public product roadmaps, pricing, and security methodologies. Customer's Confidential Information includes, without limitation, Customer Data and the configuration of the Customer Environment. Confidential Information of each Party also includes the terms of this Agreement and any Order Form.
(e) "Connected Tool" means any third-party software, platform, application programming interface, sensor, or service that Customer elects to connect, integrate, or authorize for use with the Software, including any security, identity, cloud, endpoint, ticketing, or information-technology tool operated by Customer or a third party on Customer's behalf.
(f) "Customer Data" means any data, content, or information that Customer or its Users submit to, or that is collected by the Software directly from the Customer Environment or a Connected Tool at Customer's direction, excluding Usage Data.
(g) "Customer Environment" means the systems, networks, accounts, credentials, cloud infrastructure, and data controlled or operated by Customer or on Customer's behalf, including any Connected Tool to the extent Customer has authorized the Software to access it.
(h) "Documentation" means Rallin's then-current user guides, administrator guides, and technical documentation for the Software, as made generally available by Rallin to its customers.
(i) "Feedback" means any suggestion, idea, enhancement request, bug report, or other feedback or information Customer or any User provides to Rallin relating to the Software.
(j) "Order Form" means an ordering document, quote, or online order referencing this Agreement that specifies the Software licensed, applicable fees, and Term, and that is agreed to by the Parties.
(k) "Output" means any recommendation, alert, score, report, correlation, or other output generated by the Software, including any output generated using artificial intelligence, machine learning, or similar automated techniques.
(l) "Software" means Rallin's proprietary software-as-a-service platform, together with the Documentation and any updates, upgrades, or new features Rallin makes generally available to Customer during the Term.
(m) "Term" has the meaning given in Section 16.1.
(n) "Usage Data" means data derived from the operation, configuration, and performance of the Software and its interaction with the Customer Environment and Connected Tools, including telemetry, log data, correlation metadata, performance and reliability metrics, and other technical data, in each case excluding any portion that identifies Customer or any User without aggregation or de-identification as described in Section 9.
2. LICENSE GRANT
Subject to Customer's continuous compliance with this Agreement and timely payment of all Fees due under any applicable Order Form, Rallin grants Customer a limited, non-exclusive, non-transferable, non-sublicensable, revocable right, during the Term, for Customer and its Authorized Users to access and use the Software and Documentation solely for Customer's own internal business purposes and in accordance with the Documentation, this Agreement, and the applicable Order Form.
No rights are granted by implication, estoppel, or otherwise. All rights not expressly granted to Customer in this Section 2 are reserved by Rallin and, as applicable, its licensors. The license granted in this Section 2 is contingent on Customer's continued compliance with this Agreement; any material breach by Customer immediately entitles Rallin to suspend or terminate the license as provided in Section 16.
3. RESTRICTIONS
Customer shall not, and shall ensure that its Users, Affiliates, contractors, and agents do not, directly or indirectly:
(a) copy, modify, translate, or create derivative works of the Software or Documentation, except as expressly permitted by Rallin in writing;
(b) reverse engineer, decompile, disassemble, or otherwise attempt to derive or gain access to the source code, underlying algorithms, or non-public architecture of the Software, except to the extent such restriction is expressly prohibited by applicable law;
(c) sublicense, sell, rent, lease, distribute, transfer, or otherwise make the Software or any Output available to any third party, or use the Software to operate a service bureau, managed service, or outsourcing offering for the benefit of any third party;
(d) access or use the Software for the purpose of building, developing, or supporting a product or service competitive with the Software, or for competitive analysis, or to copy any of its features, functions, workflows, or user interface;
(e) disclose, publish, or otherwise make available to any third party any benchmark, performance test, security evaluation, penetration test result, or other comparative or evaluative analysis of the Software, without Rallin's prior written consent;
(f) remove, alter, or obscure any copyright, trademark, or other proprietary notice appearing in or on the Software or Documentation;
(g) use the Software to access, store, process, or transmit any data that Customer is not authorized to access, store, process, or transmit, or in violation of any applicable law, regulation, or third-party agreement, including any license terms governing a Connected Tool;
(h) attempt to probe, scan, or test the vulnerability of the Software, or breach any security or authentication measure protecting the Software, except through features Rallin makes available for that purpose;
(i) use the Software in, or in connection with, any application in which failure of the Software could reasonably be expected to lead to death, personal injury, or severe property, environmental, or infrastructure damage;
(j) use the Software in a manner that exceeds the scope of use, User count, connector count, or other usage metric specified in the applicable Order Form; or
(k) make any representation or warranty to any third party concerning the performance, availability, security, or capabilities of the Software on Rallin's behalf.
4. AUTHORIZATION; GOVERNED ACTIONS; AI-GENERATED OUTPUT
4.1 Customer Authorization. Customer represents and warrants, on a continuing basis throughout the Term, that it has, and will maintain, all right, title, authority, and consents necessary to: (a) grant Rallin access to the Customer Environment and each Connected Tool; (b) authorize Rallin to collect, ingest, correlate, and otherwise process data from the Customer Environment and each Connected Tool; and (c) authorize the Software to take, execute, or facilitate any Action within the Customer Environment or any Connected Tool, whether such Action is initiated automatically by the Software pursuant to Customer's configuration or is presented to Customer for approval prior to execution. Customer is solely responsible for ensuring that its authorization of each Connected Tool does not violate any agreement Customer has with the provider of that Connected Tool.
4.2 Governed Execution; Customer Configuration. The Software allows Customer to configure the approval policies, permission levels, execution thresholds, and human-review requirements that govern whether and how an Action is taken. CUSTOMER IS SOLELY RESPONSIBLE FOR CONFIGURING SUCH POLICIES AND THRESHOLDS, FOR REVIEWING AND APPROVING ANY ACTION PRESENTED FOR APPROVAL, AND FOR DETERMINING WHICH ACTIONS, IF ANY, SHOULD BE PERMITTED TO EXECUTE WITHOUT ADDITIONAL HUMAN APPROVAL. CUSTOMER ASSUMES ALL RISK ARISING FROM ANY ACTION TAKEN BY THE SOFTWARE IN ACCORDANCE WITH CUSTOMER'S THEN-CURRENT CONFIGURATION, INCLUDING ANY ACTION TAKEN WITHOUT ADDITIONAL HUMAN APPROVAL WHERE CUSTOMER HAS ENABLED AUTOMATED EXECUTION FOR THE RELEVANT ACTION CLASS. RALLIN HAS NO OBLIGATION TO MONITOR, REVIEW, OR OVERRIDE ANY ACTION AND ACCEPTS NO RESPONSIBILITY FOR ANY ACTION TAKEN, OR NOT TAKEN, VIA THE SOFTWARE.
4.3 Acknowledged Risks of Actions. WITHOUT LIMITING SECTION 4.2, CUSTOMER SPECIFICALLY ACKNOWLEDGES AND ASSUMES THE RISK THAT AN ACTION — WHETHER TAKEN AUTOMATICALLY OR UPON CUSTOMER'S APPROVAL — MAY RESULT IN, WITHOUT LIMITATION: SYSTEM OR SERVICE DISRUPTION OR INTERRUPTION; UNINTENDED CHANGES TO CONFIGURATIONS, PERMISSIONS, OR ACCESS CONTROLS; QUARANTINE, MODIFICATION, OR DELETION OF DATA, ACCOUNTS, OR OTHER RESOURCES; CHANGES TO OR REVOCATION OF CREDENTIALS OR ACCESS; LOSS OF ACCESS TO SYSTEMS OR DATA BY CUSTOMER OR ITS USERS; FALSE POSITIVES OR FALSE NEGATIVES IN DETECTION OR SCORING; AND ANY OF THE FOREGOING OCCURRING WITHIN A CONNECTED TOOL AS A RESULT OF AN ACTION ROUTED THROUGH IT. RALLIN IS NOT LIABLE FOR ANY SUCH CONSEQUENCE WHERE THE ACTION WAS TAKEN IN ACCORDANCE WITH CUSTOMER'S CONFIGURATION OR APPROVAL.
4.4 Output Is Advisory. ALL OUTPUT — INCLUDING ANY CORRELATION, SCORE, ALERT, RECOMMENDATION, OR OTHER OUTPUT GENERATED USING ARTIFICIAL INTELLIGENCE, MACHINE LEARNING, OR SIMILAR AUTOMATED TECHNIQUES — IS PROVIDED FOR CUSTOMER'S CONSIDERATION ONLY AND DOES NOT CONSTITUTE A GUARANTEE, WARRANTY, OR ASSURANCE OF ACCURACY, COMPLETENESS, OR APPROPRIATENESS FOR ANY PARTICULAR PURPOSE. OUTPUT MAY CONTAIN INACCURACIES, OMISSIONS, OR ERRORS. CUSTOMER IS SOLELY RESPONSIBLE FOR INDEPENDENTLY EVALUATING ANY OUTPUT AND FOR ANY DECISION OR ACTION TAKEN, OR NOT TAKEN, IN RELIANCE ON IT.
4.5 Not for Safety-Critical or High-Risk Use. The Software is not designed, intended, or authorized for use in any safety-critical system or in connection with any decision affecting an individual's access to essential services, including housing, employment, credit, insurance, healthcare, or government benefits. Customer shall not use the Software for any such purpose.
4.6 No Managed Security, Monitoring, or Incident-Response Obligation. Rallin is a software platform, not a managed security service provider, security operations center, or incident-response provider, and this Agreement does not create any such relationship. Except to the extent expressly purchased under a separate managed-services order, Rallin has no obligation to continuously monitor the Customer Environment or any Connected Tool, to investigate any alert or Output, to detect or respond to any incident, or to act as Customer's security team. Customer remains solely responsible for its own security operations, monitoring, and incident response, and for determining whether and how to act on any Output.
4.7 Beta and Preview Features. Rallin may make features, connectors, or capabilities available on a beta, preview, or early-access basis. Such features are provided "AS IS," without any warranty of any kind, may be modified or discontinued at any time without liability, and may not perform at the level of generally available features.
5. CUSTOMER RESPONSIBILITIES
Customer is solely responsible for:
(a) the Customer Environment and every Connected Tool, and for all actions taken through the Customer Environment or a Connected Tool, whether by the Software, a User, or any other person;
(b) the accuracy, quality, and legality of Customer Data, and of the means by which Customer Data was collected;
(c) implementing and maintaining reasonable data backup, disaster recovery, and business continuity measures independent of the Software, and for protecting against the consequences of data loss, corruption, unauthorized access, or unintended modification;
(d) maintaining the confidentiality of all account credentials, API keys, and access tokens issued in connection with the Software, and for all activity that occurs under Customer's account, whether or not authorized by Customer;
(e) ensuring that its use of the Software, and each User's use of the Software, complies with all applicable laws, regulations, and third-party agreements, including any terms governing a Connected Tool; and
(f) promptly notifying Rallin of any unauthorized access to, or use of, Customer's account or the Software of which Customer becomes aware.
Customer shall not provide Rallin or the Software with access to any: (a) protected health information subject to HIPAA or similar health-privacy laws; (b) payment card data subject to PCI-DSS; (c) classified or export-controlled technical data; or (d) other category of regulated data requiring heightened security or contractual commitments beyond those in this Agreement, in each case unless and until the Parties have entered into a separate written agreement (including any applicable data processing addendum) specifically addressing such data.
6. FEES AND PAYMENT
Customer shall pay all fees set forth in the applicable Order Form ("Fees"). Except as otherwise stated in an Order Form, Fees are due within thirty (30) days of invoice, are non-cancelable and non-refundable once paid, and are exclusive of all applicable taxes, levies, or duties, which Customer is responsible for (excluding taxes based on Rallin's net income).
Rallin may suspend Customer's access to the Software if any undisputed amount remains unpaid more than fifteen (15) days after Rallin's written notice of non-payment. Late payments accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law.
7. INTELLECTUAL PROPERTY
7.1 Rallin IP. As between the Parties, Rallin and its licensors retain all right, title, and interest in and to the Software, the Documentation, and all intellectual property rights therein, including any improvement, modification, derivative work, or enhancement thereto, whether or not developed using or informed by Feedback or Usage Data. The Software is licensed, not sold, and no title is transferred to Customer under this Agreement.
7.2 Customer Data. As between the Parties, Customer retains all right, title, and interest in and to Customer Data. Customer hereby grants Rallin a non-exclusive, worldwide, royalty-free right to access, use, copy, process, transmit, and display Customer Data solely as necessary to provide, support, secure, and improve the Software and to otherwise perform Rallin's obligations under this Agreement.
7.3 Trademarks. "Rallin" and Rallin's related logos and marks are trademarks of Rallin. Customer shall not use any Rallin trademark without Rallin's prior written consent, except as expressly permitted under Section 18.
8. FEEDBACK
Customer may, but is not obligated to, provide Feedback to Rallin. Customer hereby grants Rallin and its Affiliates a perpetual, irrevocable, non-exclusive, worldwide, royalty-free, fully paid-up, sublicensable, and transferable license to use, reproduce, modify, distribute, and otherwise exploit any Feedback for any purpose, without restriction, compensation, or attribution. Customer represents and warrants that it has all rights necessary to grant the foregoing license and that its Feedback does not infringe or misappropriate the rights of any third party.
9. DATA; USAGE DATA; AGGREGATED AND DE-IDENTIFIED DATA
9.1 Usage Data. Rallin owns all right, title, and interest in and to Usage Data. Rallin may use Usage Data to operate, secure, support, and improve the Software and Rallin's other products and services, to develop new features, to conduct research, to train and improve Rallin's own algorithms and machine-learning models (including models used across Rallin's customer base), and for benchmarking and reporting, in each case in a manner that does not identify Customer or any User to any third party.
9.2 Aggregation and De-Identification. Where Rallin uses Customer Data in aggregated or de-identified form for the purposes described in Section 9.1, Rallin will not attempt to re-identify Customer or any User from such data and will not disclose such data in a manner that identifies Customer as its source without Customer's prior written consent.
9.3 Threat Intelligence. Customer acknowledges that correlation logic, detection rules, and threat-intelligence signals developed using Usage Data or de-identified Customer Data may benefit Rallin's other customers, and Customer consents to Rallin's use of such derived intelligence across its customer base on a de-identified basis.
9.4 AI Model Training; Third-Party Models. Rallin's use of Customer Data to train or fine-tune Rallin's own product-specific models is limited to aggregated or de-identified Customer Data and Usage Data as described in Sections 9.1 and 9.2. Rallin will not input identifiable Customer Data into, or use identifiable Customer Data to train, any general-purpose or foundation artificial intelligence model operated by a third party. Where the Software uses a third-party AI or machine-learning service provider to process Customer Data in order to generate Output, that provider acts as a Subprocessor under Section 9.6 and is prohibited by Rallin's agreement with that provider from using Customer Data to train models for the benefit of other customers of that provider.
9.5 Data Processing Addendum. If Customer Data includes personal data subject to applicable data protection law, the Parties will, upon Customer's request, enter into a data processing addendum consistent with such law, which will be incorporated into this Agreement by reference upon execution.
9.6 Subprocessors. Rallin may use its Affiliates and third-party service providers, including cloud-infrastructure and artificial intelligence or machine-learning service providers (each, a "Subprocessor"), to deliver the Software. Rallin will bind each Subprocessor to confidentiality and data-protection obligations materially consistent with this Agreement and remains responsible for each Subprocessor's performance of the delegated obligations to the same extent as if performed by Rallin directly.
9.7 Security Addendum. Rallin maintains administrative, technical, and physical safeguards designed to protect Customer Data. Additional detail regarding Rallin's security program is available on request and, where the Parties agree to one, will be set forth in a separate security addendum or exhibit incorporated into this Agreement by reference, which the Parties may update from time to time to reflect Rallin's then-current security practices without amending this Agreement.
10. THIRD-PARTY PRODUCTS AND CONNECTED TOOLS
The Software may interoperate with, or allow Customer to connect, third-party products and services, including Connected Tools not provided by Rallin ("Third-Party Products"). Customer's use of any Third-Party Product is governed solely by Customer's agreement, if any, with the relevant third party, and not by this Agreement. RALLIN DOES NOT WARRANT, SUPPORT, OR ASSUME ANY RESPONSIBILITY OR LIABILITY FOR ANY THIRD-PARTY PRODUCT, INCLUDING ITS AVAILABILITY, ACCURACY, SECURITY, OR THE DATA IT PROVIDES TO OR RECEIVES FROM THE SOFTWARE. Customer is solely responsible for maintaining any license or subscription required to use a Connected Tool and for any consequences of Rallin's access to, or interaction with, a Connected Tool that Customer has authorized.
11. CONFIDENTIALITY
11.1 Obligations. Each Party shall: (a) hold the other Party's Confidential Information in confidence; (b) use it solely to perform its obligations and exercise its rights under this Agreement; (c) protect it using at least a reasonable degree of care, consistent with industry standards; and (d) not disclose it to any third party except as permitted below.
11.2 Permitted Disclosure. A receiving Party may disclose Confidential Information to its employees, contractors, and Affiliates who have a need to know such information for purposes of this Agreement and who are bound by confidentiality obligations at least as protective as those in this Section 11. The receiving Party is responsible for any unauthorized use or disclosure by such persons.
11.3 Exclusions. Confidentiality obligations do not apply to information that: (a) is or becomes publicly available through no fault of the receiving Party; (b) was rightfully known to the receiving Party before disclosure without an obligation of confidence; (c) is independently developed without use of or reference to the disclosing Party's Confidential Information; or (d) is rightfully obtained from a third party without restriction.
11.4 Compelled Disclosure. If compelled by law or legal process to disclose Confidential Information, the receiving Party shall, where legally permitted, give the disclosing Party prompt written notice and reasonable cooperation, at the disclosing Party's expense, to seek a protective order or other appropriate relief, and shall disclose only the portion legally required.
11.5 Injunctive Relief. Each Party acknowledges that unauthorized use or disclosure of Confidential Information may cause irreparable harm for which monetary damages would be an inadequate remedy, and that the non-breaching Party is entitled to seek injunctive or other equitable relief in addition to any other available remedy, without the requirement to post a bond.
11.6 Survival. The obligations in this Section 11 survive termination or expiration of this Agreement for five (5) years, except that obligations with respect to trade secrets survive for as long as the information remains a trade secret under applicable law.
12. DISCLAIMER OF WARRANTIES
12.1 Limited Warranty. Rallin warrants that, during the Term, the Software will materially conform to the Documentation. Customer's sole and exclusive remedy, and Rallin's entire liability, for any breach of this warranty is for Rallin, at its option, to use commercially reasonable efforts to correct the non-conformity or to replace the affected component; if Rallin determines such correction or replacement is not commercially feasible, Rallin may terminate the affected license and refund any prepaid, unused Fees for the terminated portion of the Term. This warranty does not apply to any non-conformity caused by Customer's misuse, unauthorized modification, or use of the Software other than as permitted by this Agreement or the Documentation, or by any Connected Tool, Customer Environment, or Third-Party Product.
12.2 Disclaimer. EXCEPT FOR THE LIMITED WARRANTY IN SECTION 12.1, THE SOFTWARE, DOCUMENTATION, AND ALL OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. RALLIN, ON BEHALF OF ITSELF AND ITS AFFILIATES, LICENSORS, AND SUPPLIERS, EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE, OR USAGE OF TRADE.
12.3 No Security Guarantee. RALLIN DOES NOT WARRANT OR GUARANTEE THAT THE SOFTWARE WILL DETECT, PREVENT, OR REMEDIATE ALL, OR ANY PARTICULAR, THREATS, VULNERABILITIES, MISCONFIGURATIONS, OR SECURITY INCIDENTS, OR THAT CUSTOMER'S USE OF THE SOFTWARE WILL PREVENT A SECURITY BREACH, DATA LOSS, OR UNAUTHORIZED ACCESS. NO SECURITY PRODUCT OR SERVICE CAN GUARANTEE COMPLETE PROTECTION, AND CUSTOMER ACKNOWLEDGES THAT IT REMAINS RESPONSIBLE FOR MAINTAINING ITS OWN COMPREHENSIVE SECURITY PROGRAM, INDEPENDENT OF THE SOFTWARE.
12.4 No Warranty of Uninterrupted Operation. RALLIN DOES NOT WARRANT THAT THE SOFTWARE WILL OPERATE UNINTERRUPTED, ERROR-FREE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY OUTPUT WILL BE ACCURATE, COMPLETE, OR RELIABLE. NO ORAL OR WRITTEN STATEMENT BY RALLIN OR ITS PERSONNEL SHALL CREATE ANY WARRANTY NOT EXPRESSLY SET FORTH IN THIS AGREEMENT.
13. LIMITATION OF LIABILITY
13.1 Exclusion of Consequential Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL RALLIN, ITS AFFILIATES, OR THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, SHAREHOLDERS, AGENTS, LICENSORS, OR SUPPLIERS (COLLECTIVELY, THE "RALLIN PARTIES") BE LIABLE FOR ANY: (A) LOSS OF REVENUE, PROFITS, BUSINESS, GOODWILL, OR ANTICIPATED SAVINGS; (B) LOSS, CORRUPTION, OR UNAUTHORIZED ACCESS TO DATA; (C) BUSINESS INTERRUPTION OR OPERATIONAL DOWNTIME; (D) COST OF SUBSTITUTE GOODS OR SERVICES; OR (E) INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES OF ANY KIND, ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE SOFTWARE, REGARDLESS OF THE THEORY OF LIABILITY, AND EVEN IF A RALLIN PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
13.2 Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL CUMULATIVE LIABILITY OF THE RALLIN PARTIES ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE, SHALL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO RALLIN UNDER THE APPLICABLE ORDER FORM IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. IF THE SOFTWARE IS PROVIDED TO CUSTOMER AT NO CHARGE, INCLUDING ANY TRIAL OR EVALUATION USE, RALLIN'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS (USD $100).
13.3 Essential Basis. The Parties acknowledge that the limitations in this Section 13 are an essential element of the bargain between them, that the Fees reflect these limitations, and that Rallin would not enter into this Agreement without them. Multiple claims shall not expand any limitation set forth in this Section 13.
13.4 Exceptions. The limitations in Sections 13.1 and 13.2 do not apply to: (a) Customer's payment obligations; (b) Customer's indemnification obligations under Section 14.1; (c) Customer's breach of Section 3 (Restrictions), Section 4 (Authorization; Governed Actions), or Section 11 (Confidentiality); or (d) either Party's liability for fraud, gross negligence, or willful misconduct, or any other liability that cannot be limited or excluded under applicable law.
14. INDEMNIFICATION
14.1 Customer Indemnification. Customer shall defend, indemnify, and hold harmless Rallin, its Affiliates, and their respective officers, directors, employees, and agents (collectively, the "Rallin Indemnitees") from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees) ("Losses") arising out of or related to: (a) Customer's or any User's access to or use of the Software, including any Action taken within the Customer Environment or any Connected Tool; (b) any breach of Customer's representations, warranties, or obligations under this Agreement, including Sections 3, 4, 5, or 11; (c) Customer's violation of any applicable law or third-party right, including any right of a Connected Tool provider; (d) any dispute between Customer and the provider of a Connected Tool arising from Rallin's access to that Connected Tool at Customer's direction; or (e) any claim by a third party, including Customer's own employees, contractors, customers, or end users, arising from Customer's use of the Software.
14.2 Rallin's Limited IP Indemnification. Rallin shall defend Customer against any third-party claim alleging that the unmodified Software, used in accordance with this Agreement and the Documentation, infringes or misappropriates such third party's United States patent, copyright, or trade secret rights, and shall indemnify Customer for any resulting adverse final judgment or settlement approved by Rallin. This obligation does not apply to any claim arising from: (a) use of the Software in combination with any product, service, data, or Connected Tool not provided by Rallin; (b) modification of the Software not made by Rallin; (c) use of the Software other than as permitted by this Agreement or the Documentation; (d) Customer Data; or (e) continued use of an allegedly infringing version after Rallin provides a non-infringing replacement or modification at no additional cost. If the Software becomes, or Rallin reasonably believes it may become, the subject of an infringement claim, Rallin may, at its option and expense: (i) procure for Customer the right to continue using the Software; (ii) modify or replace the Software to be non-infringing without material reduction in functionality; or (iii) terminate the affected license and refund any prepaid, unused Fees for the terminated portion of the Term. THIS SECTION 14.2 STATES RALLIN'S SOLE AND ENTIRE LIABILITY, AND CUSTOMER'S SOLE AND EXCLUSIVE REMEDY, FOR ANY CLAIM OF INFRINGEMENT OR MISAPPROPRIATION OF INTELLECTUAL PROPERTY RIGHTS, AND RALLIN HAS NO OTHER OBLIGATION TO INDEMNIFY CUSTOMER UNDER THIS AGREEMENT FOR ANY CLAIM OF ANY NATURE.
14.3 Procedure. The indemnified Party shall: (a) promptly notify the indemnifying Party in writing of any claim (provided that a delay in notice relieves the indemnifying Party of its obligations only to the extent it is materially prejudiced); (b) grant the indemnifying Party sole control of the defense and settlement of the claim, provided that any settlement admitting fault by, or imposing a non-monetary obligation on, the indemnified Party requires the indemnified Party's prior written consent, not to be unreasonably withheld; and (c) provide reasonable cooperation at the indemnifying Party's expense.
15. EXPORT CONTROL; GOVERNMENT END USERS
15.1 Export Control. The Software may be subject to U.S. export control and economic sanctions laws, including regulations administered by the U.S. Department of Commerce and the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"). Customer shall not, directly or indirectly, export, re-export, or make the Software available in or to any country, entity, or person subject to U.S. embargo or sanctions (including, as of the Effective Date, Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions), or to any party on OFAC's Specially Designated Nationals list or the U.S. Department of Commerce's Denied Persons or Entity List. Customer represents that it is not located in, organized under the laws of, or ordinarily resident in any such country, and is not identified on any such list. Customer shall not use the Software in connection with any nuclear, chemical, biological, or missile end use prohibited under applicable law.
15.2 Government End Users. If the Software is accessed or used by or on behalf of the U.S. Government, the Software is "commercial computer software" and "commercial computer software documentation" as those terms are used in 48 C.F.R. § 12.212 and 48 C.F.R. §§ 227.7202-1 through 227.7202-4, as applicable, and is licensed to such end users only with the rights granted to all other end users under this Agreement.
16. TERM AND TERMINATION
16.1 Term. This Agreement commences on the date Customer first accepts it and continues until all Order Forms issued under it have expired or been terminated (the "Term"), unless earlier terminated as set forth below. Each Order Form has its own term as specified therein and, unless stated otherwise, renews automatically for successive periods equal to the initial term unless either Party gives written notice of non-renewal at least thirty (30) days before the end of the then-current term.
16.2 Termination for Convenience. Either Party may decline to renew an Order Form as set forth in Section 16.1. Where an Order Form expressly permits termination for convenience, the terminating Party may terminate that Order Form on the notice period stated therein.
16.3 Termination for Cause. Either Party may terminate this Agreement or any Order Form immediately upon written notice if the other Party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receiving written notice of the breach (or ten (10) days in the case of a breach of Section 3, Section 4, or Section 11).
16.4 Emergency Suspension. Rallin may suspend or terminate Customer's access to all or part of the Software immediately and without prior notice if Rallin reasonably believes that: (a) Customer's use of the Software poses a security or operational risk to Rallin, any Rallin customer, the Software, or any Connected Tool, or threatens the integrity or availability of the Software; (b) Customer's account credentials or access have been or may have been compromised; (c) Customer's use is not authorized by, or exceeds the scope of, this Agreement or the applicable Order Form; (d) suspension or termination is necessary to comply with applicable law, a regulatory request, or a court order; or (e) Customer's use otherwise involves suspected fraud or abuse. Rallin will lift a suspension made under this Section 16.4 promptly once the condition giving rise to it has been resolved to Rallin's reasonable satisfaction.
16.5 Effect of Termination. Upon expiration or termination of this Agreement or the applicable Order Form: (a) all licenses granted under the terminated Order Form immediately end; (b) Customer shall immediately cease all access to and use of the Software; (c) Customer remains liable for all Fees accrued through the effective date of termination, and, in the case of termination by Rallin for Customer's uncured breach, for all Fees that would have become due through the end of the then-current term; and (d) Rallin will make Customer Data available for export for thirty (30) days following termination, after which Rallin may delete Customer Data in accordance with its standard data retention practices, except as required to be retained by law.
16.6 Survival. Sections 1 (Definitions), 3 (Restrictions), 7 (Intellectual Property), 8 (Feedback), 9 (Data; Usage Data), 11 (Confidentiality), 12 (Disclaimer of Warranties), 13 (Limitation of Liability), 14 (Indemnification), 16.5, 16.6, 17 (Compliance Verification), and 20 (Miscellaneous) survive any termination or expiration of this Agreement.
17. COMPLIANCE VERIFICATION
Upon Rallin's written request, not more than once every six (6) months, Customer shall provide a written certification, signed by an authorized officer, confirming that Customer's use of the Software is consistent with this Agreement and the applicable Order Form, including applicable User, connector, or volume limits. If such verification reveals usage in excess of the limits purchased, Customer shall promptly pay the additional Fees applicable to such excess usage at Rallin's then-current rates.
18. PUBLICITY
Customer grants Rallin the right to identify Customer as a Rallin customer, and to use Customer's name and logo, in Rallin's customer lists, website, and marketing materials. Customer may revoke this right at any time by written notice to Rallin, after which Rallin will remove Customer's name and logo from materials it controls within a reasonable time.
19. GOVERNING LAW; DISPUTE RESOLUTION
19.1 Governing Law. This Agreement is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
19.2 Venue. Any dispute arising out of or relating to this Agreement shall be brought exclusively in the state or federal courts located in New Castle County, Delaware, and each Party irrevocably consents to the exclusive jurisdiction and venue of such courts and waives any objection to such venue.
19.3 Jury Trial Waiver. EACH PARTY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ANY RIGHT IT MAY HAVE TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.
19.4 Attorneys' Fees. If Rallin is the prevailing party in any dispute arising under this Agreement, Rallin shall be entitled to recover its reasonable attorneys' fees, expert fees, and court costs from Customer, in addition to any other relief awarded.
20. MISCELLANEOUS
20.1 Entire Agreement; Order of Precedence. This Agreement, together with all Order Forms and any data processing addendum entered into by the Parties, constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior or contemporaneous agreements, communications, and understandings, whether oral or written. In the event of a conflict, the following order of precedence applies unless an Order Form expressly states otherwise: (a) the applicable Order Form; (b) this Agreement; and (c) the Documentation.
20.2 Amendment. Rallin may update this Agreement from time to time to reflect changes in the Software or applicable law; Rallin will provide reasonable advance notice of any material change, and Customer's continued use of the Software after the effective date of such change constitutes acceptance of the updated Agreement. If Customer does not agree to a material change, Customer's sole remedy is to stop using the Software and terminate the affected Order Form. No other amendment, modification, or waiver of this Agreement is effective unless made in writing and signed by an authorized representative of each Party.
20.3 Assignment. Customer may not assign or transfer this Agreement, in whole or in part, without Rallin's prior written consent. Rallin may assign this Agreement without Customer's consent to an Affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of the assets relating to the Software. Any attempted assignment in violation of this Section is void.
20.4 Force Majeure. Except with respect to Customer's payment obligations, neither Party is liable for any delay or failure in performance caused by circumstances beyond its reasonable control, including acts of God, war, terrorism, civil unrest, government action, labor disputes, cyberattacks, or internet, telecommunications, or utility failures.
20.5 Independent Contractors; No Third-Party Beneficiaries. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship. Except as expressly stated in Section 14.1 with respect to the Rallin Indemnitees, this Agreement does not confer any right or remedy on any person or entity other than the Parties.
20.6 Severability; No Waiver. If any provision of this Agreement is held invalid or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will remain in full force and effect. A Party's failure to enforce any provision is not a waiver of that or any other provision.
20.7 Notices. Notices under this Agreement must be in writing and are deemed given: (a) upon personal delivery; (b) one (1) business day after deposit with a nationally recognized overnight courier; (c) five (5) business days after deposit in the mail, postage prepaid, certified or registered; or (d) upon transmission by email with confirmation of receipt, in each case to the addresses set forth on the signature page or such other address as a Party designates by notice under this Section.
20.8 Compliance with Laws. Each Party shall comply with all applicable laws in connection with its performance under this Agreement, including anti-corruption and anti-bribery laws.
20.9 Counterparts; Electronic Signatures and Acceptance. This Agreement may be executed in counterparts, each of which is deemed an original. Electronic signatures, and acceptance by the electronic means described in the preamble to this Agreement, are deemed valid and binding to the same extent as an original signature.
IN WITNESS WHEREOF, the Parties, intending to be legally bound, have executed this Agreement, or have accepted it by the electronic means described above, as of the Effective Date.
Mutual Non-Disclosure Agreement
Read the Agreement below in full. Once you reach the end, the acknowledgments unlock so you can accept.
This Mutual Non-Disclosure Agreement (this "Agreement") is entered into as of _________________ (the "Effective Date") by and between Rallin Inc., a Delaware corporation with its principal place of business at 941 Pleasant Ln, Glenview, IL 60025 ("Rallin"), and _______________________________________, a _______________ [corporation / LLC / other entity] with its principal place of business at _______________________________________ ("Client"). Rallin and Client are each a "Party" and together the "Parties."
WHEREAS, the Parties wish to explore a potential business relationship involving Rallin's software platform (the "Proposed Relationship"), and in connection with that discussion each Party may disclose to the other certain confidential and proprietary information; and
WHEREAS, each Party wishes to protect the confidentiality of, and its rights in, such information;
NOW, THEREFORE, in consideration of the mutual promises set forth herein, the Parties agree as follows.
1. Confidential Information
This Agreement applies to all written, electronic, or oral information disclosed by either Party (the "Disclosing Party") to the other Party or its Representatives (as defined below) (the "Receiving Party"), whether before or after the Effective Date, in connection with the Proposed Relationship, that is designated confidential at the time of disclosure or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure ("Confidential Information"). Without limiting the foregoing, Rallin's Confidential Information includes, without limitation, its software, source code, object code, system architecture, algorithms and machine-learning models, security and detection methodologies, and non-public product roadmap and pricing, in each case whether disclosed directly or observed by Client in a demonstration, trial, or evaluation of Rallin's software. Confidential Information also includes the existence and terms of this Agreement and the fact that the Parties are discussing the Proposed Relationship.
Confidential Information does not include information that: (a) is or becomes publicly available other than as a result of a breach of this Agreement; (b) was rightfully known to the Receiving Party, without an obligation of confidentiality, before disclosure by the Disclosing Party; (c) is rightfully received from a third party without restriction and without breach of any obligation to the Disclosing Party; (d) is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; or (e) the Disclosing Party approves for release by written authorization.
2. Nondisclosure and Use
The Receiving Party shall use Confidential Information solely to evaluate, negotiate, or carry out the Proposed Relationship, shall hold it in confidence, and shall not disclose it except to its employees, contractors, and advisors ("Representatives") who have a need to know it for that purpose and who are bound by confidentiality obligations at least as protective as those in this Agreement. The Receiving Party shall protect Confidential Information using at least a reasonable degree of care, consistent with industry standards, and is responsible for any act or omission of its Representatives with respect to Confidential Information as if it were the Receiving Party's own.
3. Compelled Disclosure
If the Receiving Party is compelled by law, regulation, or legal process to disclose Confidential Information, it shall, where legally permitted, give the Disclosing Party prompt written notice before disclosure and reasonable cooperation, at the Disclosing Party's expense, in seeking a protective order or other appropriate relief, and shall disclose only the portion of Confidential Information legally required to be disclosed.
4. No License; Protection of Rallin's Technology
All Confidential Information remains the property of the Disclosing Party. No license or other right in or to any Confidential Information is granted or implied by this Agreement or by any disclosure made hereunder. Without limiting the foregoing, nothing in this Agreement or in any discussion, demonstration, or evaluation of the Proposed Relationship grants Client any license, right, or interest in Rallin's software or other intellectual property, and Client shall not use any access to or observation of Rallin's software to reverse engineer, copy, benchmark, or build a competing product or service, or disclose any benchmark or evaluation of Rallin's software to any third party, without Rallin's prior written consent.
5. Return or Destruction
Upon the Disclosing Party's written request, the Receiving Party shall promptly return or destroy all Confidential Information in its possession, including all copies, and shall certify such destruction in writing if requested, except that the Receiving Party may retain copies required by law, regulation, or its standard archival or backup practices, subject to this Agreement's continuing confidentiality obligations.
6. Injunctive Relief
Each Party acknowledges that unauthorized use or disclosure of Confidential Information may cause irreparable harm for which monetary damages would be an inadequate remedy, and that the Disclosing Party is entitled to seek injunctive relief and specific performance, in addition to any other available remedy, without the requirement to post a bond or prove actual or irreparable harm.
7. Term
This Agreement is effective as of the Effective Date and continues for three (3) years thereafter, provided that each Party's confidentiality and use obligations survive with respect to any Confidential Information disclosed during the term until the earlier of (a) three (3) years after such disclosure, or (b) such information ceasing to qualify as Confidential Information under Section 1, except that obligations with respect to trade secrets survive for as long as the information remains a trade secret under applicable law.
8. No Obligation
Nothing in this Agreement obligates either Party to proceed with the Proposed Relationship, to disclose any particular information, or to enter into any further agreement, and this Agreement does not create a partnership, joint venture, agency, or other business relationship between the Parties.
9. Miscellaneous
9.1 Governing Law; Venue. This Agreement is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles, and each Party submits to the exclusive jurisdiction and venue of the state and federal courts located in New Castle County, Delaware. EACH PARTY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ANY RIGHT IT MAY HAVE TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.
9.2 No Waiver; Amendment. No delay in enforcing any right under this Agreement is a waiver of that right, and no waiver of any provision is a waiver of any other provision or a continuing waiver. No amendment or waiver is binding unless in writing and signed by an authorized representative of the waiving or amending Party.
9.3 Assignment; Affiliates. Neither Party may assign this Agreement without the other Party's prior written consent, except to an Affiliate or in connection with a merger, acquisition, or sale of substantially all of its assets. This Agreement binds and benefits the Parties and their permitted successors and assigns. Each Party's Affiliates are express third-party beneficiaries of this Agreement solely with respect to the confidentiality of their own Confidential Information.
9.4 Entire Agreement; Severability. This Agreement constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior discussions and agreements on that subject. If any provision is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions remain in full force and effect.
9.5 Authority; Counterparts. Each Party represents that this Agreement has been duly authorized and executed and constitutes its valid and binding obligation. This Agreement may be executed in counterparts, including by electronic or digital signature, each of which is deemed an original and all of which together constitute one instrument.
IN WITNESS WHEREOF, the Parties have executed this Agreement, or accepted it by electronic signature, as of the Effective Date.
Agreement accepted.
Thanks — we've recorded your acceptance and sent a copy to our team. A member of Rallin will follow up if anything further is needed.
Something didn't go through.
Email us directly instead — sales@rallin.ai — and we'll get this recorded manually.
Get a custom quote.
One annual platform license, sized to your organization — not to how many tools you connect. Tell us a bit about your environment and we'll follow up with numbers.
How Rallin is priced
Rallin is sold as one annual license, sized to your organization by employee count. Every tier gets the full platform — pricing scales with headcount, not with how many tools you connect or how much data flows through them.
Request pricing
Get a custom quote based on your organization.
Request received.
Someone from the Rallin team will follow up with a custom quote shortly.
Something didn't go through.
Email us directly instead — open a pre-filled message to sales@rallin.ai.
Frequently asked questions.
Environment & tool inventory.
Ten minutes, read-only scoping — no access granted yet. Fill in whatever you have handy; exact versions aren't necessary. This tells us which read-only connectors to enable and lets us scope the evaluation to the tools that matter to you. Leave a row blank if it doesn't apply.
Request received.
Someone from the Rallin team will follow up to scope the evaluation.
Something didn't go through.
Email us directly instead — open a pre-filled message to sales@rallin.ai.
Documentation
Everything for running Rallin day to day — first-connection setup, what an admin needs to know, how the governed-execution workflow actually works, and the full connector catalog.
New to Rallin, or just need to find something fast? Start with Getting Started if you haven't connected a tool yet. Already running — Admin Guides covers credentials, approvals, and risk tiers; Workflows explains the Read → Reconcile → Validate → Stage loop in depth; Connectors is the full per-tool setup catalog.
Getting Started
Connect your first tool and approve your first staged action.
Admin Guides
Credentials and the vault, approving staged actions, and reading risk tiers.
Workflows
How Read → Reconcile → Validate → Stage actually works, end to end.
Use Cases
14 real scenarios Rallin resolves, organized by pack.
Connectors
98+ connectors — setup guide for every one, grouped by category.
Can't find something, or stuck on a connector that isn't here yet? sales@rallin.ai gets you a straight answer, no ticket queue.
Docs / Connectors
Connectors
Setup guides for connecting your tools to Rallin — written for whoever's doing the configuring, not just the person who bought it.
More connector guides are on the way. Need one sooner, or stuck on a connector that isn't here yet? sales@rallin.ai gets you a straight answer, no ticket queue.
Docs / Getting Started
Getting Started
The same four steps every Rallin deployment goes through, from zero tools connected to a first approved action.
1. Connect your first tool
Pick whichever tool in your stack you'd get the most value from reading first — most teams start with their EDR, their IdP, or their ticketing system. Open that tool's guide under Connectors, issue the credential it asks for, and paste it into Rallin. Every connector is read-only on first connection; nothing is staged or changed until you explicitly enable mutations for it later.
2. Rallin reads, on its own schedule
Once connected, Rallin starts pulling from that tool's API on a regular cycle — no agent installed on the tool itself, no change to how your team already uses it. If you connect more than one tool that has a view of the same asset, Rallin automatically cross-references what each one reports.
3. Reconciled answers show up where you'd expect
Where two or more connected tools disagree, Rallin resolves it to one answer and keeps the underlying evidence attached — you can always see which source said what, and why one won out. This is the same reconciliation shown in the home page demo and detailed in Workflows.
4. Approve your first staged action
When Rallin has a fix to propose — a patch deployment, a session kill, a credential rotation, whatever the finding calls for — it stages it and waits. Nothing executes without a named human's approval; see Approving Staged Actions for how that review works and what gets logged.
Stuck partway through, or something here doesn't match what you're seeing? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Admin Guides / Credentials & the Vault
Credentials & the vault
Every credential you give Rallin — an API token, a service-account key, a client secret — goes through the same encrypted vault, no matter which of the 81 connectors it's for.
One vault, one pattern, every connector
Every connector guide under Connectors follows the same shape for a reason: a field table telling you what to generate in the vendor's own console, and a second table telling you what to paste into Rallin. Whatever that second table asks for — a static API token, an OAuth client ID and secret, a service-account JSON key, a username and password exchanged for a session token — it lands in the same encrypted vault entry, scoped to that one connector.
What never happens
- A credential is never written to a log, an audit record, or a chat transcript — operations are logged by name and outcome, not by the secret that authorized them.
- A credential is never shared across connectors, even for the same vendor — Strobes RBVM and Strobes VI, for instance, each get their own vault entry even though they're the same company.
- A credential never leaves your deployment to reach Rallin's own infrastructure — Rallin isn't in the data path between you and the vendor's API.
Where your AI provider fits in
Rotating or removing a credential
Rotate a credential the same way you issued it — generate a new one in the vendor's console, then replace the stored value in Rallin. The old value is overwritten, not retained. Removing a connector entirely removes its vault entry; nothing lingers once a tool is disconnected.
Questions about a specific connector's credential shape? Its own guide under Connectors has the exact fields. Anything else: sales@rallin.ai.
Docs / Admin Guides / Approving Staged Actions
Approving staged actions
Rallin reads freely. It never writes without a named human saying yes first — this is how that approval actually works.
Staged means staged, not executed
Every one of the 49 connector guides under Connectors ends with a "What Rallin can act on" table, ranking each mutating capability from info up through critical. A mutation reaching that table doesn't mean it ran — it means Rallin built the proposal, attached the evidence that justifies it, and is waiting on you.
What's in a staged action
| Field | What it tells you |
|---|---|
| What it does | The exact capability being proposed — e.g. "Deploy KB5034765 → 94 hosts," "Kill session + rotate credential" |
| Why | The reconciled evidence behind it — which tools agreed, which were overridden, and why |
| Risk tier | Info through critical — see Understanding Risk Tiers |
| Target | Exactly what it touches — a host count, an account, a firewall rule, a VM — never a vague "affected systems" |
Who can approve what
Approval authority scales with risk tier. A medium-risk action might be approvable by any admin on the connected tool; a critical-risk action — rotating a privileged credential, sealing a vault, deleting a user — is built to require a named approver whose identity is permanently attached to the decision in the audit record.
After approval
Once approved, the action executes through the connector that owns it, and the result — success, failure, or partial — is written back to the same audit record as the original proposal. Nothing about a staged action is edited or deleted after the fact; a rejected proposal stays in the record as rejected, not removed.
Want to see this in motion first? The home page demo plays out a full propose-and-stage cycle for 14 real scenarios. Questions: sales@rallin.ai.
Docs / Admin Guides / Understanding Risk Tiers
Understanding risk tiers
The same five-tier scale appears on every connector's "What Rallin can act on" table, from Active Directory to Zscaler. Here's what each tier actually means.
The five tiers
| Tier | What it means | Typical example |
|---|---|---|
| Info | Read-only. No approval needed — reads run continuously and freely. | List devices, search logs, query asset inventory |
| Low | A reversible, narrow write — tagging, labeling, non-destructive metadata changes. | Update a vulnerability's tags, export an asset list |
| Medium | A real change with limited or recoverable blast radius. | Create a user, add a group member, launch a report |
| High | A change with meaningful operational or security impact — interrupts a live system, discloses sensitive data, or alters a production control. | Isolate an endpoint, launch an active scan, list storage account keys |
| Critical | Destructive, irreversible, or capable of disclosing a live privileged credential. No lower tier exists for this class of action. | Retrieve a privileged credential, run an arbitrary command on a VM, delete a user, seal a vault |
Why credential retrieval is always critical
Across CyberArk, Delinea, BeyondTrust, and HashiCorp Vault, pulling the actual value of a privileged credential is rated critical with no lower tier — not because the connectors are stricter than necessary, but because there's no context in which disclosing a live password or key is anything less than maximum-impact. The same pattern holds for Active Directory's privileged-group mutations and Fortinet's firewall-policy writes: the tier reflects the action's actual blast radius, not how often it's used.
Escalating tiers
A handful of connectors escalate a mutation's tier based on its target, not just its type. Active Directory's group-membership changes are high risk in general, but escalate to critical the moment the target is a privileged group like Domain Admins, or the object being moved is a domain controller. The risk table on each connector's guide documents these escalations explicitly where they exist.
Looking for one connector's specific risk table? Every guide under Connectors ends with one. Questions: sales@rallin.ai.
01 — Read
Rallin calls each connected tool's own read-only API on a regular cycle — no agent installed on the tool itself, no change to how your team already uses it. Reads never require approval and never touch write scopes; a connector with no mutating capabilities at all, like SentinelOne or Veza, is just as fully connected as one with a long risk table.
02 — Reconcile
When two or more connected tools have a view of the same thing — the same CVE, the same host, the same identity — and they disagree, Rallin resolves it to one answer. This isn't a majority vote: a live query from a ground-truth source (Tanium's real-time KB state, for instance) outweighs an 11-day-old authenticated scan, even if the scan is the louder signal. The home page demo plays this out across all 14 scenarios.
03 — Validate
The reconciled answer keeps its evidence attached — which source said what, how current each view was, and why one won out over another. This is what turns "the tools disagree" into a defensible, auditable claim rather than an educated guess. Every "Reconciled truth" or "Rallin:" verdict shown anywhere on this site carries this evidence, not just a conclusion.
04 — Stage
If the reconciled answer points to a fix, Rallin builds the proposal — what it would do, through which connector, at what risk tier — and stops. See Approving Staged Actions for what happens from here; nothing in this step executes without a named human's sign-off.
Curious how staging decides what's safe to propose at all? See Approval-Gated Mutations. Questions: sales@rallin.ai.
Docs / Workflows / Approval-Gated Mutations
Approval-gated mutations
The pattern behind every "Pending approval" chip on this site: bi-directional, evidence-attached, and gated by a risk tier that's part of the connector's own capability declaration — not a setting an operator can quietly lower.
Bi-directional, not fire-and-forget
A staged mutation isn't a one-way command queued for later — it's a proposal with a response built in. An admin can approve it as written, reject it with a reason that's logged alongside the proposal, or in some workflows counter-propose a narrower version (patch the 3 hosts under active attack now, stage the other 337 for next week's window, rather than all-or-nothing).
The risk tier travels with the capability
Risk isn't assigned per customer or per deployment — it's declared once, on the capability itself, the same for every Rallin install. Retrieving a credential from Delinea is critical risk whether you're a five-person startup or a regulated enterprise, because the action's blast radius doesn't change with company size. See Understanding Risk Tiers for the full scale.
What gates execution
- The risk tier itself — higher tiers require more explicit, more identifiable approval before anything executes.
- The connector's own scope — Rallin executes through the credential you issued it, so a mutation it can't actually perform on the downstream tool fails there, not silently.
- A named approver — every approval is attributed to a specific person, permanently, in the audit record covered in Approving Staged Actions.
See this pattern across 14 real examples in the home page demo, or jump back to The Core Workflow. Questions: sales@rallin.ai.
Docs / Connectors / Microsoft Entra ID
Connect Microsoft Entra ID
Rallin reads Entra ID through Microsoft Graph — the same API Microsoft's own admin tools use. This covers registering the app, granting the right permissions, and plugging the credentials into Rallin.
What this connects
Microsoft Graph is the unified API behind Entra ID (Azure AD), Intune, and the rest of Microsoft 365 — Rallin's connector covers the identity and device surface: users, groups, devices, and conditional access policies. Like every connector, it's read-only by default. Any action Rallin could take through it — adding a user to a group, changing a device's compliance state — goes through the same staged, human-approved execution path as every other tool, not a separate trust model for Microsoft.
Before you start
1. Register an app in Entra ID
- In the Azure portal, go to Microsoft Entra ID → App registrations → New registration.
- Give it a name you'll recognize later — Rallin is fine.
- Leave the default (single tenant) account type unless you specifically need otherwise.
- Register it. You'll land on the app's overview page.
2. Note your IDs
From the app's overview page, copy two values — you'll need both in a minute:
| Value | Where it is |
|---|---|
| tenant_id | Directory (tenant) ID, on the same overview page |
| client_id | Application (client) ID, on the same overview page |
3. Create a client secret
- In the app, go to Certificates & secrets → Client secrets → New client secret.
- Set an expiry that matches your organization's rotation policy.
- Copy the secret value immediately — Azure only shows it once. If you navigate away before copying it, you'll need to create a new one.
4. Grant API permissions
Still in the app, go to API permissions → Add a permission → Microsoft Graph → Application permissions (not Delegated — Rallin authenticates as itself, not as a signed-in user). Add the permissions below, then click Grant admin consent for your tenant. Without that last step, the permissions are requested but not active.
| Permission | What it grants |
|---|---|
| User.Read.All | Read user profiles — names, emails, group membership, sign-in activity. |
| Device.ReadWrite.All | Read device records (Intune-managed devices, compliance state); write access is only exercised through Rallin's own approval-gated actions, never automatically. |
These are Rallin's defaults, not a fixed requirement — scope them down to match what you want Rallin to see and do, and grant consent only for what you've actually reviewed.
5. Connect it in Rallin
In Rallin, open the Microsoft Graph connector setup and enter the three values from above:
| Field | Value |
|---|---|
| Azure tenant ID | The Directory (tenant) ID from step 2 |
| App registration client ID | The Application (client) ID from step 2 |
| App registration client secret | The secret value from step 3 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
Sovereign clouds
If your tenant is in US Government or Germany sovereign cloud rather than Microsoft's public cloud, Rallin's connector supports both — the API and token endpoints differ by cloud, so let your Rallin contact know which one you're on before connecting.
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Okta
Connect Okta
Rallin reads Okta through its REST API using a standard SSWS API token — the same mechanism Okta's own documentation recommends for service integrations. This covers issuing the token and plugging it into Rallin.
What this connects
Rallin's Okta connector covers users, groups, applications, policies, the System Log (your audit trail), and user-lifecycle actions — suspend, unsuspend, password reset, deactivate. Reads run freely; every lifecycle action is staged and waits for a named human to approve it, same as every other connector.
Before you start
1. Find your tenant's base URL
Your Okta org has one of three base URLs, depending on which cell it lives in:
| Cell | Base URL pattern |
|---|---|
| Production | https://<org>.okta.com |
| Preview / sandbox | https://<org>.oktapreview.com |
| FedRAMP Moderate | https://<org>.okta-gov.com |
2. Create an API token
- In the Okta Admin Console, go to Security → API → Tokens.
- Click Create Token, give it a name you'll recognize later — Rallin is fine.
- Copy the token value immediately — Okta only shows it once.
3. Connect it in Rallin
| Field | Value |
|---|---|
| Okta tenant URL | The base URL from step 1, e.g. https://yourorg.okta.com |
| API token (SSWS) | The token value from step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List/get users, groups, applications, policies; read the System Log | Info — read-only |
| Unsuspend a user | Medium |
| Suspend a user | High |
| Force a password reset | High |
| Deactivate a user | Critical — ends every session and preps the account for deletion |
Anything above read-only is staged and requires an explicit approval before it executes — nothing in this list runs on its own.
Stuck, or something above doesn't match what you're seeing in your org? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / CrowdStrike Falcon
Connect CrowdStrike Falcon
Rallin reads Falcon through CrowdStrike's own OAuth2 API — detections, hosts, IOCs, sensors, prevention policies, and more. This covers issuing an API client, picking the right region, and connecting it.
What this connects
Rallin's Falcon connector authenticates with OAuth2 client-credentials — it mints a Bearer token at startup and re-mints it near expiry (Falcon's tokens run roughly 30 minutes). The token is held in memory only and never written to disk.
Before you start
1. Confirm your region
Falcon tenants are provisioned into a specific cloud region, and the API base URL has to match it exactly — this is the single most common setup mistake.
| Region | Base URL |
|---|---|
| US-1 | https://api.crowdstrike.com |
| US-2 | https://api.us-2.crowdstrike.com |
| EU-1 | https://api.eu-1.crowdstrike.com |
| US-GOV-1 | https://api.laggar.gcw.crowdstrike.com |
If you're not sure which region your tenant is on, check the URL you use to log into the Falcon console itself — it carries the same regional subdomain.
2. Issue an API client
- In the Falcon console, go to Support and resources → API Clients and Keys.
- Click Add new API client, give it a name you'll recognize later — Rallin is fine.
- Grant the scopes for the capabilities you want Rallin to use. Sensor Download: Read is the minimum for a basic health check; add scopes for detections, hosts, IOCs, or RTR as needed.
- Copy the client ID and client secret immediately — Falcon only shows the secret once.
3. Connect it in Rallin
| Field | Value |
|---|---|
| CrowdStrike region | The region from step 1 |
| API client ID | The client ID from step 2 |
| API client secret | The client secret from step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / ServiceNow
Connect ServiceNow
ServiceNow is usually the deepest connection Rallin makes — CMDB, Incident, Change, Knowledge, and Vulnerability Response all read through the same account. This covers creating that account and connecting your instance.
What this connects
For most Rallin deployments, ServiceNow's CMDB is the canonical external graph — where asset identity, classifications, and evidence get written back, not just read from. Rallin connects over HTTP Basic auth today; OAuth2 is supported as an alternative where your instance requires it. After the first connect, Rallin runs a lightweight customization probe automatically to learn your tenant's specific table deviations — nothing to configure for that part.
Before you start
1. Create the service account
- In ServiceNow, go to User Administration → Users → New.
- Give it a name you'll recognize later — rallin.integration is a reasonable convention.
- Assign the role(s) covering the tables in scope for your deployment, and set a strong password.
2. Connect it in Rallin
| Field | Value |
|---|---|
| Instance URL | e.g. https://yourcompany.service-now.com |
| ServiceNow username | The service account from step 1 |
| ServiceNow password | The service account's password |
Save, and Rallin will confirm the connection and begin reading on the next sync.
Optional fields
Two fields in the connector setup are for the Vulnerability Response integration specifically — leave both blank unless you know you need them:
| Field | When to set it |
|---|---|
| VR plugin version | Leave blank — Rallin detects the installed Vulnerability Response plugin version automatically. |
| Audit-witness scoped-app namespace | Only if you've installed Rallin's optional audit-witness package in your instance; defaults to x_borg. |
Stuck, or something above doesn't match what you're seeing in your instance? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Wiz
Connect Wiz
Wiz's API is GraphQL-only, authenticated with a service-account OAuth2 client-credentials flow — there's no username/password and no static API key. This covers provisioning the service account and connecting it.
What this connects
Rallin's Wiz connector covers cloud inventory, prioritized issues, vulnerability findings, compliance posture, DSPM data findings, exposed-secret findings, and the free-form graph search that powers Wiz's attack-path views. Reads run freely; mutations like updating an issue's status or triggering a cloud-resource rescan are staged and wait for a named human to approve them.
Before you start
1. Provision a service account
- In the Wiz console, go to Settings → Service Accounts → Create Service Account.
- Set the type to Custom Integration (GraphQL API).
- Grant scopes for what you want Rallin to read and do — least privilege. read:projects, read:issues, read:vulnerabilities, read:cloud_resources, read:findings, and read:graph cover the read surface; add update:issues only if you want Rallin staging issue-status changes.
- Copy the client secret immediately — Wiz shows it once.
- Note your tenant's regional API URL from Settings → Tenant Info — e.g. https://api.us17.app.wiz.io.
2. Confirm your region
| Region | API base URL |
|---|---|
| US (e.g. us1, us17) | https://api.us17.app.wiz.io |
| EU (e.g. eu1, eu5) | https://api.eu1.app.wiz.io |
| GovCloud | https://api.gov.wiz.io |
3. Connect it in Rallin
| Field | Value |
|---|---|
| Wiz tenant API URL | The regional URL from step 2 |
| Wiz service-account client ID | The client ID from step 1 |
| Wiz service-account client secret | The client secret from step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Cloudflare
Connect Cloudflare
Rallin reads Cloudflare through a scoped API token — accounts, zones, DNS, firewall rules, and Zero Trust apps and identity providers. This covers creating that token and connecting it.
What this connects
Rallin's Cloudflare connector covers accounts, zones, DNS records, firewall rules, Zero Trust Access apps and identity providers, and audit logs — all read-only. Cache purging and creating an edge block rule are the two mutations it can stage; both wait for a named human's approval before they run.
Before you start
1. Create a scoped API token
- In the Cloudflare dashboard, go to My Profile → API Tokens → Create Token.
- Scope it to the smallest set of zones and accounts you want Rallin reading — start read-only, and add the cache-purge or firewall permissions only if you want Rallin staging those actions.
- Copy the token value immediately — Cloudflare only shows it once.
2. Connect it in Rallin
| Field | Value |
|---|---|
| Cloudflare API base URL | Defaults to https://api.cloudflare.com/client/v4 — leave as-is unless you're on a US-Government tenant with a different endpoint |
| API token | The scoped token from step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| Verify token; list accounts, zones, DNS records, firewall rules, Zero Trust apps and identity providers; read audit logs | Info — read-only |
| Purge cache | Medium — brief origin load spike |
| Create an edge block rule | High — denies traffic at the edge |
Stuck, or something above doesn't match what you're seeing in your account? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / AWS
Connect AWS
Rallin reads AWS through the standard SDK auth chain — an IAM access key and secret, with an optional session token for assumed-role credentials. This covers issuing the credentials and connecting your account.
What this connects
Rallin's AWS connector covers the security-relevant surface of an account: EC2 instances and security groups, S3 buckets, IAM users and roles, CloudTrail event lookups, and aggregated findings. It authenticates with AWS's own request-signing (SigV4) — the same mechanism every AWS SDK uses, not a custom auth layer.
Before you start
1. Issue credentials
Two supported paths, depending on how your org manages AWS access:
- Long-lived IAM user: create an IAM user with a read-only policy, then generate an access key under Security credentials → Access keys.
- Assumed-role (STS): if your org uses role assumption rather than long-lived keys, Rallin also accepts a session token alongside the access key and secret — pass the triple your STS flow issues.
2. Connect it in Rallin
| Field | Value |
|---|---|
| AWS region | e.g. us-east-1 — must match the region your resources actually live in |
| AWS access key ID | From step 1 |
| AWS secret access key | From step 1 |
| STS session token | Only if you're using assumed-role credentials — leave blank for a long-lived IAM user |
Save, and Rallin will confirm the connection and begin reading on the next sync.
Stuck, or something above doesn't match what you're seeing in your account? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / CyberArk
Connect CyberArk
CyberArk manages your organization's most sensitive credentials, so Rallin treats it with the most conservative posture of any connector — pass-through only, nothing cached, every retrieval classified critical. This covers connecting the PVWA API.
What this connects
Rallin connects to CyberArk's PVWA (Privileged Vault Web Access) REST API — safe inventory, account metadata, audit records and session lists on the read side; account and safe-permission changes on the write side. Reading a privileged credential's actual password is classified critical with no lower tier, and is never cached — it passes through to the requester and nowhere else.
Before you start
1. Confirm your authentication method
CyberArk's login endpoint differs by how your organization authenticates:
| Method | Login path |
|---|---|
| CyberArk (default) | /PasswordVault/API/Auth/CyberArk/Logon |
| LDAP | /PasswordVault/API/Auth/LDAP/Logon |
| RADIUS | /PasswordVault/API/Auth/RADIUS/Logon |
| Windows | /PasswordVault/API/Auth/Windows/Logon |
2. Connect it in Rallin
| Field | Value |
|---|---|
| CyberArk PVWA URL | e.g. https://pvwa.corp.local |
| CyberArk username | The account from "before you start" |
| CyberArk password | That account's password |
| Authentication method | From step 1 — defaults to cyberark |
| Verify SSL | Turn off only for on-prem PVWA with an internal CA your environment doesn't trust |
Save, and Rallin will confirm the connection and begin reading on the next sync.
Stuck, or something above doesn't match what you're seeing in your environment? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Rubrik
Connect Rubrik
Rallin reads Rubrik's protection state, snapshots, and Radar anomaly signals — the data that answers "could we actually recover this" before an incident forces the question. This covers issuing a token and connecting your cluster or tenant.
What this connects
Rallin's Rubrik connector covers protected objects, snapshots, SLA domains, Radar threat activity, and cluster health on the read side; on-demand snapshots, SLA assignment, and live mount as staged mutations; and full-object restore — the most destructive action in the catalog, since it rolls back live state — classified critical with no lower tier.
Before you start
1. Issue a credential
| Product | How to issue it |
|---|---|
| CDM | In the CDM UI, go to Access Management → API Tokens and create a long-lived API token. |
| Polaris / Rubrik Security Cloud | Provision an OAuth2 service account in the Polaris console and note its client ID and secret. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Rubrik URL | Your CDM cluster address or Polaris tenant URL, e.g. https://<tenant>.my.rubrik.com |
| Auth mode | Leave as auto — Rallin detects CDM vs. Polaris from the URL — or set it explicitly if you'd rather not rely on detection |
| CDM bearer token | Only if auth mode is cdm — the token from step 1 |
| Polaris client ID / secret | Only if auth mode is polaris — the service account from step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List protected objects, snapshots, SLA domains; read threat activity and cluster health | Info — read-only |
| Trigger an on-demand snapshot, assign an SLA, live-mount a snapshot | Medium |
| Unprotect an object, expire a snapshot, restore files | High |
| Restore a full object — rolls back live state | Critical |
Stuck, or something above doesn't match what you're seeing in your environment? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Microsoft Defender for Endpoint
Connect Microsoft Defender for Endpoint
Rallin authenticates to MDE as an Azure AD app registration using OAuth2 client-credentials — the same service-principal pattern as Entra ID, with its own API scope. This covers registering the app and connecting it.
What this connects
Rallin's MDE connector covers device inventory, alerts, and vulnerability exposure on the read side, plus AV scans, custom indicators, and forensic evidence collection as staged mutations; isolating or unisolating a machine and quarantining a running file are classified high risk since they interrupt a live endpoint.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Azure Portal, go to Azure AD → App registrations → New registration and create a service principal. |
| 2 | Under API permissions, add an Application permission (not Delegated) for the WindowsDefenderATP API, then click Grant admin consent. |
| 3 | Under Certificates & secrets, create a client secret and copy it immediately. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Azure AD tenant ID | From the app registration's Overview page |
| Client ID | The application (client) ID from the same page |
| Client secret | The secret from step 3 |
| Cloud | public unless you're on GCC/GCC High/DoD — those route through different login and API hosts |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List devices, alerts, and vulnerability exposure | Info — read-only |
| Run an antivirus scan, create a custom indicator, collect a forensic investigation package | Medium |
| Isolate or unisolate a machine, stop and quarantine a running file, delete an indicator | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Microsoft Sentinel
Connect Microsoft Sentinel
Microsoft Sentinel authenticates the same way as every other Azure-hosted connector — an app registration with client-credentials OAuth2 — but needs three levels of Azure hierarchy (subscription, resource group, workspace) to locate your actual Sentinel instance.
What this connects
Rallin's Sentinel connector covers incidents and alert rules on the read side; updating an incident's status is a staged medium-risk mutation, and disabling an alert rule is classified high risk since it silently reduces detection coverage.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Azure Portal, register an app the same way as the MDE/Entra guides and grant it a role on your Sentinel workspace's resource group. |
| 2 | Under Access control (IAM) on that resource group, assign the service principal at least Microsoft Sentinel Reader — add Microsoft Sentinel Responder if you want Rallin updating incident status. |
| 3 | Note the subscription ID, resource group name, and Log Analytics workspace name — all three are required to locate the workspace. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Azure AD tenant ID / client ID / client secret | From the app registration |
| Subscription ID | The Azure subscription containing the workspace |
| Resource group | The resource group containing the workspace |
| Workspace | The Log Analytics workspace name |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List incidents and alert rules | Info — read-only |
| Update an incident's status, classification, or owner | Medium |
| Disable an alert rule | High — silently reduces detection coverage |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / SentinelOne
Connect SentinelOne
SentinelOne authenticates with a long-lived API token tied to a service user — no OAuth exchange. This covers creating that service user and connecting your tenant's console.
What this connects
Rallin's SentinelOne connector is observability-only by design: agent/endpoint inventory, installed applications, and threat detections. There are no isolate, quarantine, or resolve actions in the current catalog — every one of its 22 capabilities is a plain read.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Management Console, go to Settings → Users → Service Users and create a new service user — this is preferred over a personal API token since it won't expire when someone leaves. |
| 2 | Scope the service user's role to at least Endpoint, Threat, and Site/Account/Group read access. |
| 3 | Generate and copy the API token — SentinelOne shows it once. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your tenant's management console URL |
| API token | The service user token from step 3 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List agents, applications, and threat detections | Info — read-only (the entire current catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Splunk
Connect Splunk
Rallin connects to Splunk's management port with a pre-issued session token — the cleanest of three supported auth shapes, avoiding storing a Splunk user's actual password. This covers issuing that token and connecting your instance.
What this connects
Rallin's Splunk connector covers search, saved searches, and alerts on the read side; creating an alert, ingesting an event, and updating a notable event (Enterprise Security) are staged medium-risk mutations; deleting a saved search, creating or deleting a user, and deleting a token are classified high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Splunk, go to Settings → Tokens → New Token. |
| 2 | Set the audience to something identifiable (e.g. rallin-relay) and an expiration matching your rotation policy. |
| 3 | Copy the generated token — this replaces sending a username and password on every request. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your Splunk REST URL, e.g. https://splunk.corp.local:8089 |
| Session token | The token from step 3 — leave username/password blank |
| Verify SSL | Off is common for self-signed Splunk certificates |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| Search events, poll search jobs, read results | Info — read-only |
| Create an alert, ingest an event, update a notable event (Enterprise Security app required) | Medium |
| Delete a saved search, create or delete a user, delete a token | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Google Chronicle
Connect Google Chronicle
Chronicle (now branded Google SecOps) authenticates with a GCP service-account JSON key, the same shape as Borg's generic GCP connector — but every call is strictly regional, with no global API host.
What this connects
Rallin's Chronicle connector covers alerts, detections, and detection rules on the read side; disabling a rule is the connector's one mutation, classified high risk for the same reason as Sentinel's equivalent — it silently reduces detection coverage.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Google Cloud Console, confirm the Chronicle API is enabled on your project, then go to IAM & Admin → Service Accounts. |
| 2 | Create or select a service account, then under Keys, add a new JSON key and download it. |
| 3 | Ask your Chronicle admin to grant that service account the SecOps roles it needs — Rallin doesn't provision these. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Service account JSON | The full downloaded key file, pasted whole |
| Project | The GCP project ID |
| Location | Your Chronicle region, e.g. us |
| Instance | Your Chronicle instance ID |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List alerts, detections, and detection rules | Info — read-only |
| Disable a detection rule | High — silently reduces detection coverage |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Cisco XDR
Connect Cisco XDR
Cisco XDR (the rebrand of SecureX Threat Response) authenticates with an OAuth2 API client scoped at creation time in the Cisco XDR admin console. This covers creating that client and connecting it.
What this connects
Rallin's Cisco XDR connector covers incidents, threat-intel sightings, and observable enrichment on the read side; updating an incident's status or a module instance are staged medium-risk mutations; triggering a response action and deleting a module instance are classified high risk — a response action dispatches to whatever downstream product (Secure Endpoint, Umbrella, a firewall) is actually connected, and its outcome depends on that product's own health.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Cisco XDR admin console, go to API Clients and create a new client. |
| 2 | Configure its scopes at creation time — common ones are casebook, enrich:read, private-intel, inspect:read, and integration; add response and response/trigger:write only if Rallin should stage response actions. |
| 3 | Copy the client ID and secret. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your region's API URL, e.g. https://api.us.security.cisco.com |
| Client ID / secret | From step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List incidents, sightings, and enrich observables | Info — read-only |
| Update an incident's status or a module instance | Medium |
| Trigger a response action on a connected product, delete a module instance | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Palo Alto Networks
Connect Palo Alto Networks
PAN-OS authenticates with a static API key, generated once from an admin account and inherited by that account's role-based permissions from then on. This covers generating the key and connecting your firewall or Panorama instance.
What this connects
Rallin's PAN-OS connector covers security rules, address objects, interfaces, and active sessions on the read side; creating an address object, editing an address group, and tagging or untagging a registered IP are staged medium-risk mutations; committing the candidate configuration — applying every pending policy change firewall-wide — is classified high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | From an admin account with API access enabled, call the firewall's keygen endpoint (or generate a key from the web UI's API key management page). |
| 2 | The resulting key inherits that admin account's role — scope the admin account's role to read-only first if Rallin should only observe. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your firewall or Panorama URL |
| API key | The key from step 1 |
| Verify SSL | Off is typical for the management interface's self-signed certificate |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List security rules, address objects, interfaces, active sessions, rule hit counts | Info — read-only |
| Create an address object, edit an address group, register or unregister an IP tag | Medium |
| Commit the candidate configuration | High — applies every pending policy change firewall-wide |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Datadog
Connect Datadog
Datadog splits its API credential into two parts — an API key and an application key — and almost every endpoint needs both together. This covers generating the pair and connecting your organization.
What this connects
Rallin's Datadog connector covers security signals, log search, incidents, and metrics on the read side; most mutations — unmuting a host, creating or updating an incident, triaging a security signal — are staged medium-risk; muting a monitor or a host is classified high risk, since it can mask a real incident in progress.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Datadog, go to Organization Settings → API Keys and generate an API key. |
| 2 | Go to Organization Settings → Application Keys and generate an application key, ideally under a dedicated least-privilege service-account user rather than a real person's account. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your region's API URL, e.g. https://api.datadoghq.com |
| API key | From step 1 |
| Application key | From step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List security signals, search logs, list incidents, query metrics | Info — read-only |
| Unmute a host, create or update an incident, triage a security signal, mute a finding | Medium |
| Mute a monitor, mute a host | High — can mask a real incident in progress |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Sumo Logic
Connect Sumo Logic
Sumo Logic authenticates with a generated access ID and key pair — not a real user's login — sent as HTTP Basic auth. This covers generating that pair and connecting your deployment.
What this connects
Rallin's Sumo Logic connector covers Cloud SIEM insights, signals, and detection rules, plus metrics and monitors, on the read side; creating or deleting a monitor and updating a lookup-table row are staged medium-risk mutations; disabling a Cloud SIEM rule, deleting an access key, decommissioning a log partition, and truncating a lookup table are classified high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Sumo Logic, go to Administration → Security → Access Keys → Add Access Key. |
| 2 | Scope the key to a role covering search/read access plus only the specific Cloud SIEM, monitor, or lookup-table permissions Rallin actually needs. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Deployment | Your region, e.g. us1 |
| Access ID / access key | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List Cloud SIEM insights, signals, and rules; query metrics and monitors | Info — read-only |
| Create or delete a monitor, update a lookup-table row | Medium |
| Disable a Cloud SIEM rule, delete an access key, decommission a partition, truncate a lookup table | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Qualys
Connect Qualys
Qualys authenticates with a dedicated API user's own username and password — there's no separate API key to generate. Picking the right regional platform pod matters more here than almost any other connector.
What this connects
Rallin's Qualys connector covers host detections, the knowledge base, scan results, and web-app findings on the read side; pausing, resuming, or canceling a scan and adding an asset group are staged medium-risk mutations; launching a vulnerability, compliance, or web-app scan, purging hosts, and deploying a patch job are classified high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Qualys, go to the Users module and create a dedicated API user, scoped to only the modules (VM, PC, WAS) Rallin needs. |
| 2 | Note that user's role — Manager, Unit Manager, Scanner, or Reader — since it gates everything the connector can do. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your platform pod's API URL, e.g. https://qualysapi.qualys.com |
| Username / password | The API user from step 1 |
| Gateway URL | Only needed for Patch Management/CSAM on a private platform |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| Read host detections, the knowledge base, scan results, web-app findings | Info — read-only |
| Pause, resume, or cancel a scan; add an asset group or IPs; launch a report | Medium |
| Launch a vulnerability, compliance, or web-app scan; purge hosts; deploy a patch job | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Tenable
Connect Tenable
Tenable.io authenticates with a generated access/secret key pair sent as a single combined header. This covers generating that pair and connecting your instance.
What this connects
Rallin's Tenable connector covers vulnerabilities, assets, scans, and plugin data on the read side; exporting an asset list is a low-risk async mutation; launching a scan is classified high risk, since it has network impact and can trigger IDS/IPS alerts elsewhere in your stack.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Tenable.io, go to your account menu → My Account → API Keys and click Generate. |
| 2 | Copy both the access key and secret key — regenerating later invalidates the prior pair, so any other integration using it breaks too. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://cloud.tenable.com, or your Gov-region URL |
| Access key / secret key | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List vulnerabilities, assets, scans, and plugin data | Info — read-only |
| Export an asset list | Low — async bulk export |
| Launch a scan | High — network impact, can trigger IDS/IPS alerts |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Rapid7 InsightVM
Connect Rapid7 InsightVM
InsightVM authenticates against its on-prem Security Console directly with a console user's username and password — there's no separate API key. This covers that console account and connecting it.
What this connects
Rallin's Rapid7 connector covers sites, scans, assets, and vulnerability findings on the read side; launching a site scan is the connector's one mutation, classified high risk since it's an active scan against an entire site.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In InsightVM, go to Administration → Users and create (or reuse) a console user account. |
| 2 | Grant it a role with API access enabled — a read-only global role is enough unless Rallin should launch scans too. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your console URL, e.g. https://insightvm.corp.local:3780 |
| Username / password | The console user from step 1 |
| Verify SSL | Off is typical for the Security Console's self-signed certificate |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List sites, scans, assets, and vulnerability findings | Info — read-only |
| Launch a site scan | High — active scan against an entire site |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Strobes RBVM
Connect Strobes RBVM
Strobes' risk-based vulnerability management platform authenticates with a scoped API token — whether it's sent as a Bearer or Token header depends on your tenant, so check both if the first one 401s.
What this connects
Rallin's Strobes connector covers vulnerabilities, assets, and CVE search on the read side; creating or updating an asset or vulnerability are staged medium-risk mutations, tag updates are low risk, and starting a scan is classified high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Strobes dashboard, provision a scoped API token for Rallin. |
| 2 | If the connection fails with a 401 using Bearer, switch the auth scheme to Token — which one your tenant uses depends on how it was provisioned. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://app.strobes.co, or your self-hosted/MSSP base URL |
| API token | From step 1 |
| Auth scheme | Bearer or Token — see the callout above |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List and search vulnerabilities, assets, and CVEs | Info — read-only |
| Create or update an asset or vulnerability | Medium |
| Update a vulnerability's tags | Low |
| Start a scan | High — launches active scanning against targets |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Strobes VI
Connect Strobes VI
Strobes Vulnerability Intelligence is a public CVE threat-intel feed — most of it needs no authentication at all. This covers the handful of fields that apply if your organization has a licensed tier.
What this connects
Rallin's Strobes VI connector is a pure read-only knowledge base: CVE lookups, exploit/patch availability, CISA-KEV status, EPSS scores, and a blended priority score, all cross-referenced against findings from your other scanners. It has no mutating capabilities at all.
Before you start
1. What you'll need
| Field | Notes |
|---|---|
| Base URL | https://intel.strobes.co — works with no token for the public tier |
| API token | Only needed for licensed/bulk-query endpoints — contact Strobes if you have a license |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://intel.strobes.co |
| API token | Optional — leave blank for the free public tier |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| Look up a CVE, search vulnerabilities, list recent zero-days | Info — read-only (the entire catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Horizon3.ai
Connect Horizon3.ai
Horizon3's NodeZero platform authenticates with a long-lived API token that Rallin exchanges for a short-lived session JWT — the same token the h3-cli command-line tool uses. This covers finding that token and connecting it.
What this connects
Rallin's Horizon3 connector reads pentest results, weakness findings, and impact/host dashboards — the "is this actually reachable and exploitable" perspective Rallin cross-references against scanner findings from Qualys, Tenable, and Rapid7. Launching or canceling a pentest isn't in the catalog yet — that's held back pending a staged-approval workflow, so today's connector is read-only in practice (its one mutation just switches which client account subsequent calls operate in).
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the NodeZero portal, find your API token — the same one used by the h3-cli tool if your team already has it installed. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://api.horizon3ai.com |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List pentests, weakness findings, host and impact dashboards | Info — read-only (52 of 53 capabilities) |
| Switch the active client account context | Medium |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Vicarius
Connect Vicarius
Vicarius vRx authenticates with a static API token sent in a vendor-specific header, not the standard Authorization: Bearer pattern most connectors use. This covers finding that token and connecting your tenant.
What this connects
Rallin's Vicarius connector reads endpoint vulnerability exposure and patch state across your fleet — all 13 of its capabilities are read-only; there are no mutations in the current catalog.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the vRx console, go to Settings → API Tokens and generate a token. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your tenant URL, e.g. https://yourtenant.vicarius.cloud |
| API token | From step 1 |
| Verify SSL | True for SaaS tenants; false only for self-signed on-prem deployments |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| Search endpoints, vulnerabilities, and risk aggregations | Info — read-only (the entire catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Kaseya vPenTest
Connect Kaseya vPenTest
Kaseya's vPenTest (built on the Vonahi platform it acquired) authenticates with a static bearer token. This covers finding that token and connecting it.
What this connects
Rallin's Kaseya vPenTest connector reads automated pentest assessments, findings, and evidence — a pentest-as-a-service evidence source, mainly useful for MSPs feeding assessment results into the same reconciliation flow as live scanner data. All 16 capabilities are read-only; the published API has no mutating endpoints at all.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | Generate an API token from your vPenTest account (see Kaseya's own vPenTest API documentation for the exact console path). |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://app.vpentest.io/api/v3 |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List assessments, findings, evidence, and reports | Info — read-only (the entire catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Axonius
Connect Axonius
Axonius authenticates with a per-tenant API key and secret pair, both required on every request. This covers generating that pair and connecting your tenant.
What this connects
Rallin's Axonius connector reads the normalized device and user inventory Axonius aggregates across every connected adapter — the asset-truth source Rallin uses to spot coverage gaps (on the network but no EDR, managed but never scanned). Tagging assets is a staged low-risk mutation; triggering a discovery cycle is medium risk; running or triggering an enforcement action, and stopping an in-progress discovery, are classified high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In your Axonius console's API settings, generate an API key and secret pair for Rallin. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your tenant URL, e.g. https://yourtenant.axonius.com |
| API key / API secret | From step 1 |
| Verify SSL | False is common for self-hosted installs with self-signed certificates |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List devices and users, query assets, list adapters and saved queries | Info — read-only |
| Add or remove asset tags | Low |
| Trigger a discovery cycle | Medium |
| Run or trigger an enforcement action, stop an in-progress discovery | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Active Directory
Connect Active Directory
On-prem Active Directory authenticates with a plain LDAP bind — a domain service account's own username and password, not a generated API key. This covers provisioning that account and connecting your domain controller.
What this connects
Rallin's AD connector covers users, groups, computers, OUs, GPOs, trusts, FSMO roles, and privileged-group membership on the read side, plus hygiene signals like locked-out and stale accounts; profile-field updates and group membership changes are staged mutations, and anything touching a privileged group (Domain Admins, Enterprise Admins) or a domain controller object escalates straight to critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | Create (or reuse) a dedicated domain service account — svc-rallin is a reasonable name — with read rights over the directory tree. |
| 2 | For mutations, grant that account modify rights on target objects, and create-child rights on the OU(s) where it should be able to create users or groups. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Domain controller | FQDN or IP of a reachable DC |
| Username | DOMAIN\svc-rallin or its UPN |
| Password | The service account's password |
| Use SSL / Verify SSL | LDAPS (port 636) is the default; verify SSL off is common for a self-signed DC certificate |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List users, groups, computers, OUs, trusts, FSMO roles; surface locked-out and stale accounts | Info — read-only |
| Update an allowlisted profile field | Medium |
| Add or remove group membership, delete a group, move an object | High — escalates to critical for privileged groups or domain controller objects |
| Delete a user | Critical — the SID is unrecoverable outside the Recycle Bin |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / JumpCloud
Connect JumpCloud
JumpCloud authenticates with an administrator API key — there's no separate service-identity concept, so the key is tied to whichever admin account generates it. This covers generating that key and connecting your console.
What this connects
Rallin's JumpCloud connector covers users, managed systems, applications, and system groups on the read side; managing group membership and bulk-creating users are staged medium-risk mutations; suspending a user, resetting MFA, unlocking a user, and deleting an SSH key are high risk, and triggering a remote command on an enrolled system is high risk for the same reason — it's arbitrary execution via JumpCloud's MDM engine. Deleting a user or a system is classified critical and irreversible.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the JumpCloud Admin Portal, go to Settings (gear icon) → API Settings. |
| 2 | Generate the Administrator API Key — consider using a dedicated admin account for this rather than a real person's, since deprovisioning that admin later would break the integration. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Console URL | https://console.jumpcloud.com |
| API key | From step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List users, systems, applications, and system groups | Info — read-only |
| Manage group membership, bulk-create users | Medium |
| Suspend a user, reset MFA, unlock a user, delete an SSH key, trigger a remote command | High |
| Delete a user or a system | Critical — irreversible |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / PingOne
Connect PingOne
PingOne authenticates with an OAuth2 worker application scoped to exactly one environment — Rallin refuses to operate against any environment other than the one configured, even if the worker app's roles would technically reach further.
What this connects
Rallin's PingOne connector covers users, groups, applications, and populations on the read side; creating or updating a user, managing group membership, and risk-evaluation workflows are staged medium-risk mutations; signing off a session, revoking a token, disabling a user, and resetting a password are high risk; deleting a user is classified critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the PingOne Admin Console, open the target Environment → Connections → Applications and add a Worker application (machine-to-machine). |
| 2 | Assign it PingOne admin roles — Identity Data Admin or Environment Admin, scoped to what Rallin needs to read or change. |
| 3 | Copy the client ID and secret, and note the environment's GUID from the console URL or environment properties. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Region | na, eu, asia, or ca |
| Client ID / secret | From step 3 |
| Environment ID | The GUID from step 3 — Rallin only ever operates against this one environment |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List users, groups, applications, and populations | Info — read-only |
| Create or update a user, manage group membership, run a risk evaluation | Medium |
| Sign off a session, revoke a token, disable a user, reset a password | High |
| Delete a user | Critical |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / SailPoint
Connect SailPoint
SailPoint Identity Security Cloud authenticates with an OAuth2 client-credentials API client, scoped by the admin persona it's attached to rather than discrete OAuth scopes. This covers creating that client and connecting your tenant.
What this connects
Rallin's SailPoint connector covers identities, accounts, access profiles, roles, and sources on the read side; starting a certification campaign is a staged medium-risk mutation; submitting an access request, disabling or enabling an account, unlocking an account, executing a workflow, and making an identity decision are all high risk — there's no critical tier on this connector today.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the SailPoint ISC Admin UI, go to Admin → Global → Security Settings → API Management. |
| 2 | Create a new API client with the client-credentials grant type, bound to an admin persona with rights to the object types Rallin needs. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://<tenant>.api.identitynow.com |
| Client ID / secret | From step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List identities, accounts, access profiles, roles, and sources | Info — read-only |
| Start a certification campaign | Medium |
| Submit an access request, disable/enable or unlock an account, execute a workflow, make an identity decision | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Saviynt
Connect Saviynt
Saviynt authenticates with a named service account's own username and password, exchanged for a short-lived session token — not an OAuth client pair. This covers provisioning that account and connecting your tenant.
What this connects
Rallin's Saviynt connector covers users, roles, entitlements, and endpoints on the read side; triggering a job, creating an update trigger, pausing or resuming jobs, and creating or updating an endpoint are staged medium-risk mutations — including exporting a transport package, which is worth noting even at medium risk since it's a data-exfiltration-shaped action; requesting access and disabling an account are high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Saviynt EIC Admin Console, go to Settings → Security and create a dedicated service-account user with API login rights — don't reuse a real admin's personal login. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://<customer>.saviyntcloud.com |
| Username / password | The service account from step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List users, roles, entitlements, and endpoints | Info — read-only |
| Trigger a job, pause or resume jobs, create or update an endpoint, export a transport package | Medium |
| Request access, disable an account | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / One Identity
Connect One Identity
One Identity Manager authenticates with HTTP Basic auth — a service account's username and password, nothing more exotic. The same connector also exposes Safeguard PAM operations (checkout, session init) if that module is in use.
What this connects
Rallin's One Identity connector covers persons, accounts, roles, and attestations on the read side; updating an entity and managing assignments are staged medium-risk mutations, along with Safeguard-side access-request discovery and creation; deleting an entity, running a script, and the Safeguard password-checkout and session-initialization operations are all high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | Provision a service account on the One Identity Manager application server (AppServer) with API access to the object types Rallin needs. |
| 2 | If Safeguard is in use, register that same account (or a distinct one) as a Safeguard user with checkout rights on the target policies. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your AppServer URL, must start with https:// |
| Username / password | The service account from step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List persons, accounts, roles, and attestations | Info — read-only |
| Update an entity, manage assignments, discover or create a Safeguard access request | Medium |
| Delete an entity, run a script, check out a Safeguard password, initialize a PAM session | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Beyond Identity
Connect Beyond Identity
Beyond Identity authenticates with an OAuth2 client-credentials application, scoped to one realm within one tenant. This covers creating that application and connecting it.
What this connects
Rallin's Beyond Identity connector covers tenants, realms, identities, and identity groups on the read side; assigning role members is a staged medium-risk mutation; deleting an identity, revoking a credential, and revoking a token are high risk; bulk-deleting identities in a single call is classified critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Beyond Identity Admin Console, create an application within the target realm and generate a client ID and secret for it. |
| 2 | Note the tenant ID, realm ID, and application ID — all three are visible in the console's URL/breadcrumbs for that realm and application. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Region | us or eu |
| Tenant ID / realm ID / application ID | From step 2 |
| Client ID / secret | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List tenants, realms, identities, and identity groups | Info — read-only |
| Assign role members | Medium |
| Delete an identity, revoke a credential, revoke a token | High |
| Bulk-delete identities in a single call | Critical |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Silverfort
Connect Silverfort
Silverfort authenticates with a static bearer API token — the connector is entirely read-only today, so there's no write path to worry about scoping.
What this connects
Rallin's Silverfort connector reads protected resources, authentication events, policies, and risk findings — a unified MFA-coverage and anomalous-auth signal source. All 4 capabilities are read-only; there are no mutations in the current catalog.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Silverfort console's API settings, generate a bearer API token for Rallin. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your Silverfort console URL |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List protected resources, authentication events, policies, and risk findings | Info — read-only (the entire current catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Veza
Connect Veza
Veza authenticates with a static bearer API token against your tenant's own subdomain — there's no shared or regional host, so you'll need your exact tenant URL on hand.
What this connects
Rallin's Veza connector reads identities, assets, data sources, and saved queries — the access-graph perspective answering "who can reach what." Running a saved query is a low-risk read-adjacent action; every other capability is a plain read, and there are no mutations in the current catalog.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In your Veza tenant admin console, generate an API token under account/integration settings. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://<tenant>.vezacloud.com |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List identities, assets, data sources, and saved queries | Info — read-only |
| Run a saved query | Low |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Opal Security
Connect Opal Security
Opal authenticates with a static bearer API token. This covers generating that token and connecting your console.
What this connects
Rallin's Opal connector covers resources, users, groups, and audit events on the read side; adding a user to a resource or group, and creating an access request, are staged medium-risk mutations; removing a user from a resource or group, and revoking an API token, are high risk.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Opal admin console (app.opal.dev), generate a bearer API token under API/Integrations settings. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://app.opal.dev, or your deployment's URL |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List resources, users, groups, and audit events | Info — read-only |
| Add a user to a resource or group, create an access request | Medium |
| Remove a user from a resource or group, revoke an API token | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Lumos
Connect Lumos
Lumos authenticates with a static bearer API token — the connector is entirely read-only today. This covers generating that token and connecting your console.
What this connects
Rallin's Lumos connector reads the app catalog, users, access requests, and access reviews — a SaaS access-visibility source. All 4 capabilities are read-only, and access requests and reviews are list-only today, so this is an inventory and reporting source rather than something that drives review workflows end to end.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Lumos admin console, generate a bearer API token under API/Integrations settings. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your Lumos console URL |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List apps, users, access requests, and access reviews | Info — read-only (the entire current catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Rippling
Connect Rippling
Rippling authenticates with a static API token against its V1 Platform API — a single shared host, not a per-tenant one. This covers issuing that token and connecting it.
What this connects
Rallin's Rippling connector reads employees, departments, teams, and company data — the workforce-of-record source Rallin cross-references against identity providers and AD to catch offboarding gaps (terminated in Rippling, still active somewhere else). All 6 capabilities are read-only; there are no mutations in the current catalog.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | Issue an API token from your Rippling admin console (customers get a static key; partners use an OAuth access token in the same field). |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://api.rippling.com (default — one shared host) |
| API token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List employees, departments, teams, and company data | Info — read-only (the entire current catalog) |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Britive
Connect Britive
Britive authenticates with a static API token, JWT, or federated workload token against your tenant's own subdomain — Rallin auto-detects which scheme you're using. This covers issuing a token and connecting your tenant.
What this connects
Rallin's Britive connector covers privileged-access profiles, users, applications, and audit logs on the read side; scanning an application or environment, and creating a user, are staged medium-risk mutations; checking out a privileged-access profile, disabling a user, resetting a password, and approving a request are high risk; rotating Britive's own Secrets Manager vault keys is classified critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the Britive console, generate an API token (or configure a federated workload token) for Rallin. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Tenant | Your Britive tenant name, e.g. acme — resolves to https://acme.britive-app.com |
| Token | From step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List privileged-access profiles, users, applications, and audit logs | Info — read-only |
| Scan an application or environment, create a user | Medium |
| Check out a privileged-access profile, disable a user, reset a password, approve a request | High |
| Rotate Secrets Manager vault keys | Critical |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Delinea Secret Server
Connect Delinea Secret Server
Delinea Secret Server (formerly Thycotic) authenticates with a dedicated service account's username and password, exchanged for an OAuth2 token — not a generated API key. This covers provisioning that account and connecting your instance.
What this connects
Rallin's Delinea connector covers folders, users, and groups on the read side, plus searching secrets by metadata without exposing their values; checking out a secret is a staged medium-risk mutation; changing a secret's password on the downstream managed target is high risk; retrieving a secret's full record or any individual field — including the password itself — is classified critical with no lower tier, since pulling a privileged credential is always critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | Create a dedicated local or AD service account in Secret Server with API access, scoped to the folders/secrets it needs to reach. |
| 2 | Grant it Remote Password Changing permission if Rallin should be able to rotate credentials on downstream targets. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Cloud: https://<tenant>.secretservercloud.com; on-prem: https://<host>/SecretServer |
| Username / password | The service account from step 1 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List folders, users, and groups; search secrets by metadata | Info — read-only |
| Check out a secret | Medium |
| Change a secret's password on the managed target | High |
| Retrieve a secret's full record or any field value | Critical — no lower tier exists for credential disclosure |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / BeyondTrust Password Safe
Connect BeyondTrust Password Safe
BeyondTrust Password Safe authenticates with an API key registered in BeyondTrust's own admin console, sent in a non-standard header format alongside an optional run-as user. This covers registering that key and connecting your instance.
What this connects
Rallin's BeyondTrust connector covers managed accounts, managed systems, and access requests on the read side; creating a request and checking in a password are staged medium-risk mutations; creating an ISA request, rotating the API key itself, and terminating a privileged remote-access session are high risk; retrieving a credential is classified critical with no lower tier, the same reasoning as Delinea and CyberArk — pulling a live privileged credential is always critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the BeyondTrust Password Safe admin console, go to API Registration and create a new API key. |
| 2 | Set runas to a BeyondTrust user whose Requestor/Approver/Admin role grants cover what Rallin needs to do. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your Password Safe instance URL |
| API key | From step 1 |
| Run-as user | From step 2 (optional, but determines effective permissions) |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List managed accounts, managed systems, and access requests | Info — read-only |
| Create a request, check in a password | Medium |
| Create an ISA request, rotate the API key, terminate a privileged remote-access session | High |
| Retrieve a credential | Critical — no lower tier exists for credential disclosure |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / HashiCorp Vault
Connect HashiCorp Vault
HashiCorp Vault authenticates with a plain Vault token in a vendor-specific header — Rallin consumes a token you've already issued through whatever auth method your organization uses, rather than performing a login flow itself.
What this connects
Rallin's Vault connector covers health, mounts, auth methods, and policies on the read side; writing a KV secret, deleting a KV secret (soft-delete), unsealing Vault, and revoking a lease are high risk; reading a KV secret's value, sealing Vault entirely, and permanently destroying KV secret versions are all classified critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | Issue a Vault token through whichever auth method your organization already uses — vault token create, AppRole, LDAP, or OIDC. |
| 2 | Attach ACL policies to that token covering at minimum sys/health, sys/mounts, and the KV paths Rallin should read; a sudo/root policy is required only if Rallin should be able to seal Vault. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://vault.corp.local:8200 |
| Token | From step 1 |
| Namespace | Only for Vault Enterprise — leave blank otherwise |
| Verify SSL | Off is common for self-signed Vault certificates |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| Check health, list mounts, auth methods, and policies | Info — read-only |
| Write a KV secret, soft-delete a KV secret, unseal Vault, revoke a lease | High |
| Read a KV secret's value, seal Vault entirely, permanently destroy KV secret versions | Critical |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Google Cloud Platform
Connect Google Cloud Platform
GCP authenticates with a service account's JSON key, which Rallin exchanges for a short-lived OAuth2 token — the key itself never goes over the wire. This covers generating that key and connecting your project.
What this connects
Rallin's GCP connector covers projects, IAM policies, service accounts, roles, and VM instances on the read side; disabling or enabling a service account — a key incident-response action for a compromised identity — along with deleting or patching a firewall rule, are staged high-risk mutations.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the GCP Console, go to IAM & Admin → Service Accounts and create or select a service account. |
| 2 | Under the Keys tab, click Add Key → JSON — this downloads the key file you'll paste in whole. |
| 3 | Grant the service account at least Reader (roles/cloudresourcemanager.viewer) on each project it should see; add Compute or IAM roles only if Rallin should mutate. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Service account JSON | The full downloaded key file, pasted whole |
| OAuth2 scope | Defaults to read-only; widen only for the write capabilities you need |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List projects, IAM policies, service accounts, roles, and VM instances | Info — read-only |
| Disable or enable a service account, delete or patch a firewall rule | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Azure Resource Manager
Connect Azure Resource Manager
Azure Resource Manager authenticates with the same app-registration/service-principal mechanism as Microsoft Entra ID — but this is a separate credential and a separate API surface entirely: infrastructure, not identity.
What this connects
Rallin's Azure Resource Manager connector covers subscriptions, resource groups, resources, and VMs on the read side; powering off, deallocating, or patching a VM are staged high-risk mutations, along with listing storage account keys — which discloses the full key material in plaintext; running an arbitrary command on a VM through the Azure VM Agent is classified critical, since it's arbitrary code execution.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In Azure Portal, go to Azure AD → App registrations → New registration to create a service principal. |
| 2 | Under Certificates & secrets, create a client secret and copy it immediately. |
| 3 | Assign the service principal at least the Reader role on each subscription Rallin should enumerate — Virtual Machine Contributor or similar only if it should mutate VMs. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Azure AD tenant ID / client ID / client secret | From the app registration |
| Cloud | public or usgov — USGov routes through different management and login hosts entirely |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List subscriptions, resource groups, resources, and VMs | Info — read-only |
| Power off, deallocate, or patch a VM; list storage account keys (discloses key material) | High |
| Run a command on a VM via the Azure VM Agent | Critical — arbitrary code execution |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / F5 BIG-IP
Connect F5 BIG-IP
F5 BIG-IP authenticates with an admin account over iControl REST — token-based, with the management UI's own role and partition-access model gating what that account can reach.
What this connects
Rallin's F5 BIG-IP connector covers virtual servers, pools, and pool members on the read side; creating or deleting a virtual server, pool, node, or iRule, installing a certificate, deploying an AS3 declaration, and syncing config are all high risk; forcing a failover to the peer device, wiping every AS3-managed app in one call, and running an arbitrary bash command are classified critical.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the BIG-IP management UI, go to System → Users → User List → Create. |
| 2 | Set a role — Operator for read-only plus safe actions, Resource Administrator for most LTM mutations, Administrator only if Rallin needs partition/cert/AS3 changes — and scope Partition Access to what it should reach. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | Your BIG-IP management URL, e.g. https://10.0.1.1 |
| Username / password | The user from step 1 |
| Verify SSL | Off by default — self-signed certs are the norm on BIG-IP management interfaces |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List virtual servers, pools, and pool members | Info — read-only |
| Create/delete a virtual server, pool, node, or iRule; install a cert; deploy AS3; sync config | High |
| Force failover to the peer device, delete all AS3-managed apps, run a bash command | Critical |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Fortinet FortiGate
Connect Fortinet FortiGate
FortiGate authenticates with a static API token, issued per device rather than per fleet — onboarding several firewalls means a separate token, and a separate Rallin connection, for each one.
What this connects
Rallin's FortiGate connector covers firewall policies across every IPv4/IPv6 policy variant on the read side. This is the largest mutating surface of any connector in the catalog: creating, updating, or deleting a firewall policy — in any of its variants — is classified critical, since a fat-fingered bulk change here has real, immediate blast radius on live traffic.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the FortiGate GUI, go to System → Administrators and create an administrator bound to a REST API Admin profile. |
| 2 | Generate the API token — FortiGate shows it once, so copy it immediately. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | e.g. https://fortigate.local |
| API token | From step 2 |
| VDOM | Defaults to root |
| Verify SSL | Off by default — self-signed certs are common in the field |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List firewall policies across all IPv4/IPv6 variants | Info — read-only |
| Most other reads and lower-impact config lookups | Medium |
| Create, update, or delete a firewall policy, in any variant | Critical |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Zscaler Internet Access (ZIA)
Connect Zscaler Internet Access
Zscaler Internet Access authenticates with a legacy session exchange — an obfuscated API key plus your admin username and password, which gets you a session cookie rather than a bearer token.
What this connects
Rallin's ZIA connector covers users, URL categories, and filtering rules on the read side; adding or removing entries from the deny list are staged medium-risk mutations that only take effect once activated; activating pending changes is high risk, since a single activation commits every staged change across the organization at once — not just the ones Rallin proposed.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the ZIA Admin Portal, go to Administration → API Key Management to get your API key. |
| 2 | Find your ZIA cloud name (e.g. zscalerthree) embedded in the admin console's own URL — you'll need it for the base URL. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | e.g. https://zsapi.zscalerthree.net — must match your specific ZIA cloud |
| API key | From step 1 |
| Username / password | Your existing ZIA admin login |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List users, URL categories, and filtering rules | Info — read-only |
| Add or remove deny-list entries (staged, reversible until activated) | Medium |
| Activate pending changes — commits everything staged, org-wide | High |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.
Docs / Connectors / Zscaler Private Access (ZPA)
Connect Zscaler Private Access
Zscaler Private Access authenticates with OAuth2 client credentials — a completely different scheme from Zscaler Internet Access's session-cookie login, despite sharing a vendor name. Treat these as two unrelated setups.
What this connects
Rallin's ZPA connector covers application segments, segment groups, server groups, and app connector groups on the read side; creating or deleting an application segment is high risk, since it changes which internal applications are reachable through the zero-trust fabric.
Before you start
1. Issue a credential
| Step | What to do |
|---|---|
| 1 | In the ZPA Admin Console, go to Administration → API Keys and create an API client. |
| 2 | Find your customer ID under Administration → Company. |
2. Connect it in Rallin
| Field | Value |
|---|---|
| Base URL | https://config.private.zscaler.com (default) |
| Client ID / secret | From step 1 |
| Customer ID | From step 2 |
Save, and Rallin will confirm the connection and begin reading on the next sync.
What Rallin can act on
| Capability | Risk |
|---|---|
| List application segments, segment groups, server groups, and app connector groups | Info — read-only |
| Create or delete an application segment | High — changes what's reachable through the ZTNA fabric |
Stuck, or something above doesn't match what you're seeing in your tenant? sales@rallin.ai — a real person answers, not a ticket queue.