Why the method matters
Every investigation is a series of questions to your tools: who is this user, what ran on this host, what did this mailbox receive. If the platform cannot ask one of those questions, the investigation stops early or hands the alert back to a person. For a lean team, the alerts that come back are the ones that cost time.
Method 1: query each tool by API
The platform calls your EDR, identity provider, mail platform and cloud accounts directly, using their APIs, at investigation time. Dropzone AI describes this approach: it says it queries tools by API, so no data normalisation is needed. The advantages are speed of setup and less data copied out. The limits are the APIs themselves: rate limits, missing fields and tools with weak APIs.
Method 2: federated search across data stores
The platform searches data where it already lives: in one or more SIEMs, data lakes or cloud platforms. 7AI announced its Federated SIEM in July 2026 on this idea. This suits teams with data spread across several stores, and it avoids paying to move logs. It depends on the query performance and retention of the stores you already run.
Method 3: ingest into the platform
Some products copy data into their own store before working on it. That allows fast correlation and history the source tools do not keep, but it moves data, raises storage cost questions and changes your data handling review. Ask where the copy lives, for how long, and under which subprocessors.
Most platforms mix methods
In practice a platform may query some tools live, read others from a SIEM and keep its own memory of past cases. Mate Security, for example, describes a Security Context Graph of memories and decision traces built from your environment, alongside named integrations with tools such as Microsoft, Google Workspace, CrowdStrike and SentinelOne.
How to read an integration list
A number such as Torq's 300 pre-built integrations tells you breadth. It does not tell you depth: whether an integration only receives alerts, or can also query for evidence, or can also take actions. Ask for each of your top ten alert sources which of the three it supports.
Questions for the vendor
- For each of our alert sources, do you read, query or act?
- Which of our data is copied into your platform, and where is it stored?
- What happens to an investigation when a source is slow or unavailable?
- Which of our tools are not supported today?
Write the answers into a simple table: alert source, method, read or query or act, and gaps. That table becomes the checklist for the first week of any pilot, and it shows quickly where a platform will hand alerts back to your team.