FileDNA Connect
Plug CADR into what you already run.
FileDNA Connect is a growing catalog of connectors that bring CADR verdicts into the tools your team already uses — network monitors, threat-intel platforms, EDR, MDR, and identity systems — without asking anyone to change their workflow.
How It Works
Every connector follows the same shape: extract or detect a file, hand it to FileDNA, translate the verdict into the destination platform’s own model.
1
Detect or extract
The connected platform identifies a file worth checking — a network monitor extracting a file from traffic, a CTI platform tracking an indicator, an EDR or RMM agent flagging a download.
2
Hand off to FileDNA
The connector passes the file, or its reference, to a FileDNA engine — Core, Server, or Cloud — using the same wire protocol every FileDNA integration shares.
3
Get a structured verdict back
Clean, reconstructed, or malicious, plus any indicators FileDNA extracted along the way — hashes, embedded URLs, disarmed construct types.
4
Feed it back into the platform’s own model
A Zeek connector logs the verdict as a Notice next to files.log and weird.log. An OpenCTI connector turns it into a STIX 2.1 File and Indicator object. An EDR, SIEM or RMM connector raises it as a native alert.
Key Capabilities
Two tracks — commercial and open source — built from real integration work, not a spec sheet.
Two tracks, one catalog
Commercial and Open Source connectors for supported enterprise EDR, MDR, cloud, RMM and identity platforms; open-source connectors — FileDNA Connect Community — for platforms like Zeek, OpenCTI and MeshCentral, maintained in the open.
Verdicts that speak the destination’s language
Every connector translates FileDNA’s verdict into the receiving platform’s native model — a Zeek Notice, a STIX bundle, a SIEM or RMM alert — instead of asking analysts to learn a new console.
No re-architecture required
Connectors sit alongside your existing detection and monitoring stack as an additional signal source, not a replacement for it.
Built from working integrations, not specs
The Zeek, OpenCTI and MeshCentral connectors in FileDNA Connect Community come directly out of real integration work — a Zeek script and bridge process that extracts files from monitored traffic and returns verdicts over Broker, and a STIX 2.1 producer that turns FileDNA disarm events into File and Indicator objects.
Who It’s For
Security operations and threat-intel teams who want content-security-layer signal inside the platforms they already monitor, instead of one more standalone console.
Organizations running Zeek, OpenCTI, MeshCentral or similar open infrastructure who want file-level verdicts without waiting on a vendor roadmap.
Teams evaluating an EDR/MDR/identity-platform pairing where install-time or delivery-time file verification is currently a gap.