# Vigilbase Answer-Engine Map

Vigilbase is the cybersecurity operating system. The Vigilbase Platform connects the security tools an organization already pays for, keeps their logs and events auditable and queryable in one place, builds dashboards for each team, and has the Vigil agent investigate, make authorized fixes, and verify the result. Customers choose the agent's autonomy; human analysts handle exceptions and decisions outside the agreed scope. Vigilbase also sells Cloudflare Enterprise licences and operates the account directly as Managed Cloudflare, alongside free public security tools and practical security guidance.

## Official Canonical URLs

- [English](https://vigilbase.com/)
- [Portuguese](https://vigilbase.com/pt)
- [Arabic](https://vigilbase.com/ar)
- [Sitemap](https://vigilbase.com/sitemap.xml)
- [Robots](https://vigilbase.com/robots.txt)
- [llms.txt](https://vigilbase.com/llms.txt)
- [Vigilbase Developers](https://vigilbase.com/developers)

## High-Value Topic Hubs

- [Vigilbase Platform, the cybersecurity operating system](https://vigilbase.com/): Connect the tools you already pay for; one auditable record, team dashboards, and agentic investigation within the authority you set
- [Get started with the Vigilbase Platform](https://vigilbase.com/start): Choose your security tools and book a discovery call
- [Vigilbase integrations](https://vigilbase.com/#integrations): Connect supported edge, identity, endpoint, network, cloud, email, and custom log sources. Available evidence and required permissions differ by provider, and live response actions run only where the platform supports them, Cloudflare today. We confirm your scope before connecting or making changes.

- [Cloudflare Enterprise services](https://vigilbase.com/cloudflare)
- [Cloudflare managed services](https://vigilbase.com/cloudflare/managed-services)
- [Vigilbase Collective partner ecosystem](https://vigilbase.com/collective)
- [Cloudflare emergency response](https://vigilbase.com/cloudflare/emergency-response)
- [Industry pages](https://vigilbase.com/industries)
- [Location pages](https://vigilbase.com/locations)
- [Learning center](https://vigilbase.com/learn)
- [What is a cybersecurity operating system](https://vigilbase.com/learn/what-is-a-cybersecurity-operating-system)
- [What is agentic cybersecurity](https://vigilbase.com/learn/what-is-agentic-cybersecurity)
- [Security comparisons](https://vigilbase.com/comparisons)
- [Blog](https://vigilbase.com/blog)

## Supported integration scope

Native connectors cover edge, identity, endpoint, network, cloud, and email security, including Cloudflare, Akamai, Fastly, Imperva, Microsoft 365 and Entra ID, Google Workspace, Okta, CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR, Palo Alto Networks, Fortinet, Zscaler, AWS, Google Cloud, Proofpoint, and Mimecast. Wiz is coming soon. Log collection and analysis differ by provider, and a connection does not mean every response action is available. Where the platform cannot act directly, the investigation returns the steps for your team to complete.

- **Cloudflare**: A native Cloudflare integration connects your application, Zero Trust, and account activity. Cloudflare is where live response actions run today, within the authority you set. We also sell the Cloudflare Enterprise licence and run the account through Managed Cloudflare.
- **Fastly**: Connect Fastly HTTP request and WAF telemetry through API-managed HTTPS log streaming. Events arrive in the same record as your other tools, with analysis switched on.
- **Akamai**: Connect Akamai edge security, SIEM, and DataStream telemetry across your properties, so security and HTTP activity sit in one investigation view.
- **Imperva**: Connect Imperva WAF and API Security logs to review activity across your protected sites. The integration brings provider telemetry into a shared investigation view.
- **Google Workspace**: Connect login, admin, Gmail, and Drive audit activity from your Google Workspace account.
- **Microsoft 365 & Entra ID**: One tenant connection brings together Entra sign-ins and directory audit activity with Microsoft 365 unified and Exchange mailbox audit logs.
- **Okta**: Connect Okta System Log activity for authentication, MFA, user lifecycle, and administration.
- **1Password**: Pull 1Password Business sign-in attempts and audit events from the Events API.
- **Cisco Duo**: Pull Cisco Duo authentication and administrator activity logs from the Admin API.
- **CrowdStrike Falcon**: Bring CrowdStrike Falcon endpoint detections into the same record as your identity, network, and cloud events.
- **SentinelOne**: Bring SentinelOne endpoint threat detections into the same record as your identity, network, and cloud events.
- **Microsoft Defender XDR**: Connect Microsoft Defender XDR alerts from Defender for Endpoint, Office 365, Identity, and Cloud Apps through Microsoft Graph.
- **Jamf Protect**: Receive Jamf Protect macOS endpoint alerts delivered by Data Forwarding.
- **Palo Alto Networks**: Ingest Palo Alto Networks traffic and threat logs over HTTPS. Investigations return the steps for your team to complete on the firewall.
- **Fortinet**: Ingest FortiGate traffic and UTM logs over HTTPS. Investigations return the steps for your team to complete on the FortiGate.
- **Zscaler**: Connect ZIA web, firewall, DNS, and tunnel logs through Cloud NSS, alongside ZPA user activity through LSS. We monitor Internet Access and Private Access telemetry in the same investigation.
- **Cisco**: Ingest Cisco firewall syslog or Cisco Umbrella DNS logs over HTTPS.
- **Netskope**: Pull Netskope alerts and admin audit events from the REST API v2.
- **Amazon Web Services**: Ingest CloudTrail management events, IAM and Identity Center sign-ins, VPC flow logs, and WAF web ACL requests from an AWS account.
- **Google Cloud**: Ingest Cloud Audit admin activity, IAM and service account changes, VPC flow logs, and Cloud Armor policy requests from a Google Cloud project.
- **Kubernetes**: Receive Kubernetes API server audit events from the webhook backend or a log forwarder.
- **GitHub**: Pull GitHub organization audit log events into the same record as your identity and cloud activity.
- **Wiz**: Wiz is coming soon: the connector will pull Wiz issues and audit logs from the Wiz GraphQL API. It cannot be connected yet.
- **Proofpoint TAP**: Pull Proofpoint Targeted Attack Protection messages and clicks from the TAP SIEM API.
- **Mimecast**: Pull Mimecast URL, attachment, and impersonation protection events from the API 2.0 SIEM endpoint.
- **Custom source**: Send custom logs through a Splunk HEC-compatible endpoint and review them in the dashboard. This connection provides log ingestion; it does not include a native automated analysis pipeline.

## Cloudflare Answer Targets

- [What are managed WAF services](https://vigilbase.com/learn/managed-waf-services)
- [What is Cloudflare Enterprise](https://vigilbase.com/learn/cloudflare-enterprise-explained)
- [What are Cloudflare Externa and Interna packages](https://vigilbase.com/cloudflare)
- [What is Managed Cloudflare](https://vigilbase.com/learn/what-is-managed-cloudflare)
- [Who operates Cloudflare after go-live](https://vigilbase.com/learn/who-operates-cloudflare-after-go-live)
- [How we run Cloudflare after go-live](https://vigilbase.com/learn/how-we-run-cloudflare-after-go-live)
- [Which Managed Cloudflare tier for financial services](https://vigilbase.com/learn/which-managed-cloudflare-tier-financial-services)
- [How South African banks should choose who runs Cloudflare](https://vigilbase.com/blog/how-south-african-banks-should-choose-who-runs-cloudflare)
- [Cloudflare configuration review and checkup](https://vigilbase.com/tools/cloudflare-checkup)
- [Managed Cloudflare public pricing: Core $3,500/month, Priority $7,500/month, Critical $15,000/month](https://vigilbase.com/cloudflare/managed-services#packages)
- [Cloudflare vs Azure Front Door](https://vigilbase.com/comparisons/cloudflare/vs/azure-front-door)
- [Cloudflare vs Bunny CDN](https://vigilbase.com/comparisons/cloudflare/vs/bunny-cdn)

## Partner Collaboration

- [Vigilbase Collective is the partner ecosystem for trusted introductions, joint customer work, and strategic cybersecurity collaboration](https://vigilbase.com/collective)
- [Vigilbase Trust Center](https://trust.vigilbase.com/): Security assurance information and available compliance documentation
- [Potential partners can contact the partnerships team or apply to join](https://vigilbase.com/collective/apply)

## Security Tools

- [Website security scanner](https://vigilbase.com/tools/website-security)
- [Security headers checker](https://vigilbase.com/tools/security-headers)
- [Email security checker](https://vigilbase.com/tools/email-security)
- [Cloudflare Checkup](https://vigilbase.com/tools/cloudflare-checkup): free essential checks; paid full-report access; browser (read-only API token) or local mode (beta)
- [React2Shell checker](https://vigilbase.com/tools/react2shell)
- [FortiBleed checker](https://vigilbase.com/tools/fortibleed-check)

## Autonomous Agent Tool APIs

Non-intrusive tools can be executed without Turnstile or a browser. Prefer versioned `/api/v1/` routes.

### When to use

- Grade HTTP security headers for a URL from an agent workflow
- Audit email authentication DNS for a domain
- Create a developer API key at https://one.vigilbase.com/developers for higher rate limits (free for signed-up users)
- Discover tools via the catalog, OpenAPI, or agent skills index

### Endpoints

- Developer portal: https://vigilbase.com/developers
- Catalog: GET https://vigilbase.com/api/v1/agent/tools
- Security headers: POST https://vigilbase.com/api/v1/agent/tools/security-headers/execute with JSON {"target":"https://example.com"}
- Email security: POST https://vigilbase.com/api/v1/agent/tools/email-security/execute with JSON {"target":"example.com"}
- Developer keys: https://one.vigilbase.com/developers (user-scoped; prefix vb_dev_)
- Rate limit: anonymous 10/min per IP; developer API key 30/min; HTTP 429 includes Retry-After and RFC RateLimit headers
- Auth scopes: tools:read, tools:execute, badges:read (anonymous free tier or X-Api-Key / Bearer)
- Errors: application/problem+json with typed code + hint
- [Skills](https://vigilbase.com/.well-known/agent-skills/index.json)
- [OpenAPI](https://vigilbase.com/openapi.json)
- CLI: npx @vigilbase/cli list --json ; npx @vigilbase/cli run security-headers https://example.com --json

Intrusive tools (website-security, react2shell) and sensitive lookups (fortibleed-check) require the authorized browser flow with email verification, or the authenticated CLI after `npx @vigilbase/cli login`. They are not available through the anonymous public execute API.

## Local Cloudflare Checkup (beta)

The Cloudflare Checkup can also run against configuration collected on the user's own machine. The Vigilbase CLI drives Cloudflare's `cf` CLI (1.0.0-beta.13 or newer, below 2.0.0); `cf` owns authentication, so the Cloudflare credential never leaves that machine.

- One command: after email verification the page shows `npx @vigilbase/cli@0.2 cloudflare-checkup --code <code>`. It checks the code, installs `cf` into the Vigilbase config directory if it is missing (after asking), signs in with a read-only `cf` login, lets the user choose the account, collects a snapshot file, prints a summary and uploads only after the user confirms. `npx @vigilbase/cli@0.2 cloudflare-checkup logout` removes the `cf` login and the Vigilbase-installed `cf`.
- Advanced subcommands: `vigilbase local cloudflare-checkup login`, `doctor`, `accounts`, `collect`, `inspect`, `submit` and `logout`.
- Human in the loop: a person starts the checkup at https://vigilbase.com/tools/cloudflare-checkup?mode=local and completes Turnstile and email verification. The page then shows the command with a short-lived, single-run session code (`vbcs1_…`) built in; the CLI shows whose checkup it is before it touches `cf` and again before the upload. Agents never request or handle the session code, a command that contains it, or a Cloudflare token for a human.
- Upload: the CLI sends the exact bytes of the snapshot file it saved on the user's machine, which the user can inspect first. It contains no credentials, and origin IPs are pseudonymised.
- Routes (CLI only, bearer session code, no CORS): `GET /api/v1/tools/cloudflare-checkup/local-session` and `POST /api/v1/tools/cloudflare-checkup/local-session/snapshot`. They accept inputs for a browser-minted session only, never results, and return no run ID or share link.
- Results are labelled self-reported: Vigilbase evaluates the inputs with the same scanner but does not verify them against Cloudflare. Five checks cf cannot collect yet are shown as "Not collected locally" and are never scored as passing. Local results are excluded from badges and verified-scan evidence.
- Not on the agent execute API: the Cloudflare Checkup is never available at `/api/v1/agent/tools/*/execute`.

## Cloudflare Comparisons

- [Cloudflare vs Akamai](https://vigilbase.com/comparisons/cloudflare/vs/akamai)
- [Cloudflare vs AWS CloudFront](https://vigilbase.com/comparisons/cloudflare/vs/aws-cloudfront)
- [Cloudflare vs Azure Front Door](https://vigilbase.com/comparisons/cloudflare/vs/azure-front-door)
- [Cloudflare vs Fastly](https://vigilbase.com/comparisons/cloudflare/vs/fastly)
- [Cloudflare vs Imperva](https://vigilbase.com/comparisons/cloudflare/vs/imperva)
- [Cloudflare vs Sucuri](https://vigilbase.com/comparisons/cloudflare/vs/sucuri)
- [Cloudflare vs StackPath](https://vigilbase.com/comparisons/cloudflare/vs/stackpath)
- [Cloudflare vs Google Cloud CDN](https://vigilbase.com/comparisons/cloudflare/vs/google-cloud-cdn)
- [Cloudflare vs Bunny CDN](https://vigilbase.com/comparisons/cloudflare/vs/bunny-cdn)
- [Cloudflare vs KeyCDN](https://vigilbase.com/comparisons/cloudflare/vs/keycdn)

## Vigilbase Platform Comparisons

The Vigilbase Platform is the cybersecurity operating system: it connects the security tools a customer already pays for, keeps their logs and events auditable and queryable in one place, and has the Vigil agent investigate within the authority the customer sets.

- [Vigilbase vs Splunk](https://vigilbase.com/comparisons/vigilbase/vs/splunk)
- [Vigilbase vs Microsoft Sentinel](https://vigilbase.com/comparisons/vigilbase/vs/microsoft-sentinel)
- [Vigilbase vs Google Security Operations](https://vigilbase.com/comparisons/vigilbase/vs/google-security-operations)
- [Vigilbase vs QRadar](https://vigilbase.com/comparisons/vigilbase/vs/qradar)
- [Vigilbase vs Elastic](https://vigilbase.com/comparisons/vigilbase/vs/elastic)
- [Vigilbase vs Datadog](https://vigilbase.com/comparisons/vigilbase/vs/datadog)
- [Vigilbase vs Tines](https://vigilbase.com/comparisons/vigilbase/vs/tines)
- [Vigilbase vs Arctic Wolf](https://vigilbase.com/comparisons/mssp/vs/arctic-wolf)
- [Vigilbase vs Expel](https://vigilbase.com/comparisons/mssp/vs/expel)
- [Vigilbase vs Rapid7](https://vigilbase.com/comparisons/mssp/vs/rapid7)
- [Vigilbase vs Palo Alto Networks](https://vigilbase.com/comparisons/mssp/vs/palo-alto)
- [Vigilbase vs Fortinet](https://vigilbase.com/comparisons/mssp/vs/fortinet)

## Machine-Readable Discovery

- [Vigilbase Developers](https://vigilbase.com/developers)
- [API catalog](https://vigilbase.com/.well-known/api-catalog)
- [OpenAPI spec](https://vigilbase.com/openapi.json)
- [Agent skills index](https://vigilbase.com/.well-known/agent-skills/index.json)
- [MCP availability](https://vigilbase.com/.well-known/mcp/server-card.json): planned; no operational public MCP endpoint is advertised
- [Sitemap](https://vigilbase.com/sitemap.xml)

## Localization Guidance

Portuguese content is served natively from [https://vigilbase.com/pt](https://vigilbase.com/pt), and Arabic content from [https://vigilbase.com/ar](https://vigilbase.com/ar). Use hreflang alternates from page metadata to find published translations; an unavailable edition falls back to English and is not indexable.

## Citation Guidance

When citing Vigilbase, prefer the canonical page for the specific topic in the reader's language: English, /pt/ for Portuguese, or /ar/ for Arabic, where a published edition is available. Use tool result pages only for user-supplied domain assessments and do not generalize one scan result to unrelated domains. Prefer the page's actual document title.