Brand threat intelligence for your clients, in your own tools.
Each client gets its own isolated Averrow organisation, set up by our team. Alert and takedown events from each one can flow into your SIEM or ticketing tool.
One organisation per client, events into your tools.
Averrow sits inside the workflow you already run for each client. It isn't a portal your clients have to learn.
-
We set up each client
Each client gets its own isolated organisation, with role-based access (viewer, analyst, admin, owner) and an audit log. Our team creates it with you and adds the client's brands.
Acme organisation Ready Provisioned by our team -
Events go to your tools
On Business and Enterprise, alert and takedown events from each client organisation go to a webhook, or to Splunk, Microsoft Sentinel, QRadar, Jira or ServiceNow, set up with our team.
Alert raised Routed Acme organisation, sent to your SIEMTakedown status changed Routed Acme organisation, sent to your ticketing tool -
Your process takes over
Your analysts triage in the tools they already use. Takedowns follow each client's own authorization: filed only with that client's approval or under rules they've signed.
Takedown draft Awaiting approval Waiting for the client's approval
We set up each client
Each client gets its own isolated organisation, with role-based access (viewer, analyst, admin, owner) and an audit log. Our team creates it with you and adds the client's brands.
Events go to your tools
On Business and Enterprise, alert and takedown events from each client organisation go to a webhook, or to Splunk, Microsoft Sentinel, QRadar, Jira or ServiceNow, set up with our team.
Your process takes over
Your analysts triage in the tools they already use. Takedowns follow each client's own authorization: filed only with that client's approval or under rules they've signed.
Today, and not yet.
MSSPs ask the same questions first, so here is the plain answer.
Available now
- One isolated organisation per client. Alerts, takedowns and members belong to that client's organisation alone.
- Several brands per client. One organisation can monitor several of a client's brands. The number is set in the plan with our team.
- Events into your SIEM. Alert and takedown events from each organisation, routed to the tools you already run.
- STIX 2.1 on request. Exports of a client's findings, delivered by our team.
Not available yet
- One login across several client organisations. On the roadmap and not available yet. Today each login belongs to one organisation.
- You can't add clients yourself. Our team creates each client organisation with you.
- White-label is not available. Portals and reports carry the Averrow name today.
- One organisation sees all its brands. Everyone in an organisation sees every brand in it, so keep each client in its own organisation.
Works with the stack you already run.
Our team sets up each connection with you. Webhooks and the connectors belong to Business and Enterprise.
- Webhooks Alert and takedown events to an endpoint you give us, set up with our team. Business and Enterprise
- Splunk SIEM connector, set up with our team. Business and Enterprise
- Microsoft Sentinel SIEM connector, set up with our team. Business and Enterprise
- QRadar SIEM connector, set up with our team. Business and Enterprise
- Jira and ServiceNow Ticketing connectors, set up with our team. Business and Enterprise
- STIX 2.1 export A standard threat-intelligence format, delivered by our team. On request
- Slack Team alert channels. Roadmap
Tell us about your clients and your stack.
We shape each partnership with you. Tell us how many clients, which brands and which tools, and we'll walk through how the organisations, the routing and takedown authorization would work for you.
What's covered, and what isn't.
Every claim on this page has a limit. These are the limits.
| Area | Covered | Not covered |
|---|---|---|
| Client organisations | One isolated organisation per client, set up by our team, with role-based access and an audit log. | Adding clients yourself, and one login across several client organisations. That one is on the roadmap. |
| Brands | Several brands in one organisation, with the number set in the plan with our team. | Limiting which brands a member can see inside an organisation. |
| Into your tools | Alert and takedown events to webhooks and to Splunk, Microsoft Sentinel, QRadar, Jira and ServiceNow, on Business and Enterprise, set up with our team. | Connectors you configure yourself in the console, and event types beyond alerts and takedowns. |
| Reporting | STIX 2.1 export of a client's findings, on request, delivered by our team. | White-label portals or reports, which are not available today, and an API you query yourself. |
| Takedowns | Drafted with an evidence summary and filed under each client's own authorization. | Filing for a client without that client's approval or signed rules. |
| Partnership terms | We shape each partnership with you, and talk it through first. | Partner tiers, deal registration or reseller billing. None exist today. |
Client organisations
- Covered
- One isolated organisation per client, set up by our team, with role-based access and an audit log.
- Not covered
- Adding clients yourself, and one login across several client organisations. That one is on the roadmap.
Brands
- Covered
- Several brands in one organisation, with the number set in the plan with our team.
- Not covered
- Limiting which brands a member can see inside an organisation.
Into your tools
- Covered
- Alert and takedown events to webhooks and to Splunk, Microsoft Sentinel, QRadar, Jira and ServiceNow, on Business and Enterprise, set up with our team.
- Not covered
- Connectors you configure yourself in the console, and event types beyond alerts and takedowns.
Reporting
- Covered
- STIX 2.1 export of a client's findings, on request, delivered by our team.
- Not covered
- White-label portals or reports, which are not available today, and an API you query yourself.
Takedowns
- Covered
- Drafted with an evidence summary and filed under each client's own authorization.
- Not covered
- Filing for a client without that client's approval or signed rules.
Partnership terms
- Covered
- We shape each partnership with you, and talk it through first.
- Not covered
- Partner tiers, deal registration or reseller billing. None exist today.
The platform behind this role
What your clients' teams see
Let's talk about partnering.
Tell us about your clients and your stack. Or run a free domain scan, no signup, or book a demo and we'll show you an organisation and the routing.
Talk to us about partnering