Cato Integration Map — Discovery Model

The Cato Networks third-party integration ecosystem across 11 Discovery domains. Each family carries its mechanism, data direction, support model, licence, validation status and Discovery questions, so the map drives Discovery → requirements → HLD → LLD rather than just cataloguing vendors.

Every vendor chip is a link. Click any vendor to open its specific Knowledge Base configuration article; click a card title for the family's primary article. Where no vendor-specific article exists, the chip falls back to the family article and the tooltip says so. All links were resolve-checked on 20 August 2026.

This is not a definitive list of every Cato integration. It reflects the Cato Knowledge Base and public Integration Hub as read on 20 August 2026. Availability changes frequently — reconfirm before committing to a customer design. Entries are marked Verified (confirmed in a KB article or the licence matrix), Needs Validation (single source, typically the marketing Integration Hub, with no confirming KB article) or Conflict (authoritative Cato sources disagree). Hover a chip for its caveat.

Source conflicts found during validation — read before using this map

Area	Conflict	How this map treats it
Licence matrix is stale	The License and Apps matrix omits Google Labels, Cyera, Microsoft Defender device management, and at least six SaaS connectors (Citrix ShareFile, Miro, DocuSign, Gmail, and several Interconnected Apps sources) that have live, dedicated KB articles.	Where a dedicated article and the matrix disagree, the dedicated article wins. Matrix-omitted entries are flagged in their tooltip.
Integration Hub runs ahead of docs	catonetworks.com/integrations lists AI Runtime Protection platforms, AI Usage & Adoption sources and "Cyera DSPM" branding with no corresponding KB documentation.	Hub-only entries are marked Needs Validation, never presented as shipped and documented.
Microsoft 365 Data Protection API	The matrix lists a single "Microsoft Office 365" Data Protection connector. The KB has no such article — it is split into three per-service connectors.	Listed as OneDrive, SharePoint and Exchange separately, each linked to its own article.
Directory Service IdP list	Licence matrix: 4 IdPs. Using an Identity Provider: 6, adding OneWelcome and DTS as SCIM-only, OneWelcome gated behind "contact Support".	Both listed; the two extras carry a per-vendor caveat rather than being silently merged in.
Axonius miscategorised (fixed)	Axonius appears under "Asset Management" on the Hub, which reads like a Device Inventory connector. It is not — it pulls Cato data via the Cato GraphQL API with Viewer access.	Filed under Vendor-Supported Cato Data Integrations (Cato → Axonius).
SSO is OIDC only	Cato does not support SAML for SSO. The KB states verbatim: "Cato supports OIDC for SSO only. SAML-based authentication is currently not supported." Every supported IdP is integrated via its OIDC implementation.	SAML removed from the mechanism vocabulary entirely. A customer on SAML-based remote-access SSO today needs a new OIDC app registration — a real migration task that belongs in the plan, not an assumption.
Two dead links found	No standalone article exists for RSA SSO, and the Azure Storage event article uses the shorter slug variant.	Both repointed to working articles. No link in this map is unverified.
No "Alerts" KB article	The matrix lists an Alerts integration type (Jira, ServiceNow, Slack) but the KB index has no standalone Alerts article.	Family retained, linked to the matrix only, marked Needs Validation for LLD purposes.

Taxonomy crosswalk — common shorthand → Cato's naming

Shorthand	Cato integration families	Why it matters for design
SaaS	App Activities · Data Protection API · SaaS Posture · Interconnected Apps · Security Checks	Five families, not one. Slack appears in four of them with different scopes, consents and licences. Discovery must ask per family.
IdP	Directory/Provisioning · User SSO · Admin SSO · Sign-In Activities · Sign-In Anomalies · Adaptive Access	Same vendor, six different relationships. Provisioning is not SSO; admin SSO has a smaller supported list.
EDR	EDR → XOps	Events are included in the base licence; correlated stories require XOps. A commercial decision, not a technical one.
Assets	Device Inventory (Device Management Connectors)	Distinct from Endpoint Security. A vendor feeding asset context is not necessarily feeding threat detections.
CNAPP	Cloud Security → XOps	One vendor (Wiz). Security telemetry — not to be confused with vSocket/Interconnect, which are connectivity.
Data classification	Sensitivity Labels · Data Posture · DLP Forensic Storage	MIP labels work in inline DLP policy; Google Labels only via the out-of-band Data Protection API. Different enforcement points.
UCaaS	Experience Monitoring connectors · Certified connectivity pattern	An API DEM connector and a SIP/QoS config playbook are different deliverables with different owners.
DR (Detection & Response)	XOps · EDR ingest · SIEM export · MDR	Cato's own D&R is native. Third-party D&R is ingest in, export out, or a managed service wrap.
DR (Disaster Recovery)	— no integration family —	Delivered natively (HA Sockets, dual-PoP, cloud vSocket), not through a connector. Do not scope it as an integration.

Nothing matches those filters.