How the products connect

Each link below runs only when both products are installed. The products authenticate to each other with service credentials the sign-in service issues, so there are no shared passwords to set up.

VectorFlow to Sigmatic

A VectorFlow pipeline can end in a Sigmatic sink. Pick the Sigmatic data source on the sink, and at delivery VectorFlow fetches that data source’s ingest token from Sigmatic and the agent posts events to Sigmatic’s ingest API. Nobody copies tokens between the two.

VectorFlow’s schema normalization can also export its field mappings to Sigmatic, so Sigma rules resolve against the fields VectorFlow produces. The normalization guide under Guides covers it.

Sigmatic to Warden

Sigmatic sends alerts to Warden in two ways. Automatic delivery lets Warden’s intake decide whether an alert opens a case or joins an existing one. Manual escalation from an alert always produces a case. Warden deduplicates on a correlation key and tells Sigmatic which case the alert landed in, so the alert links to its case.

Warden is the only place cases live. From an alert in Sigmatic, analysts can pull the related Warden cases.

Warden to Sigmatic

Runbook actions write back to Sigmatic: comment on an alert, snooze it, or add a rule exception. Warden also records each case reference on the Sigmatic alert through an outbox, so a brief outage doesn’t lose it.

Walkthroughs

• The demo sandbox tour runs all three links end to end with synthetic data.
• The Pangolin guide under Guides follows access logs from a Pangolin edge through Sigmatic to a block in Warden.