Module · connect & monitor
The connectors read the relevant events from your tools and intelligence sources. Each signal can be qualified, attached to a scenario or an incident and turned into a tracked action.
Understand the risk. Take back control. Stay the course.
Read-only connectors · frequent polling + real-time display · hosted in France with Scaleway, Mistral AI (EU).
A connector is useless if it adds yet another console. With Galyct Pro, every source feeds the same facts: the signal goes where a decision can be made, linked to the right scenario and the right incident.
Read-only connectors that feed the console: EDR/XDR (CrowdStrike, SentinelOne, Microsoft Defender, HarfangLab, Sophos), firewalls (Stormshield, Clavister), identity (Microsoft Entra, Google Workspace), backup (Acronis), intelligence (MISP, CERT-FR watch), each filtered on your actual exposure. You bring your access, read-only.
All the connectors below are available: you plug in your read-only access.
Your existing detection tools feed into the cockpit, read-only: 5 EDR/XDRs (CrowdStrike, Microsoft Defender, SentinelOne, Sophos and HarfangLab, a French EDR) and 2 firewalls (Stormshield, a French vendor, and Clavister, a Swedish vendor). Few players in the SME market connect this many sources; fewer still French ones.
Microsoft 365 / Entra ID and Google Workspace: the actual posture of your information system (MFA, forwarding rules, sessions, backup) reported as evidence.
Acronis: backup and protection alerts, polled at short intervals, trigger the right event.
MISP (indicator sharing) and the CERT-FR watch (official French bulletins): filtered on your actual exposure rather than on the noise.
Encrypted DNS resolution (DNS-over-HTTPS): an observation component in which only the domain being checked is transmitted, never any case data.
You bring your own access (BYO), read-only. No Galyct agent is required for the connectors: Galyct reads your tools’ API, it controls nothing remotely and carries out no offensive action.
A raw signal is only worth something if it lands where it can serve a decision. The connector captures, the console qualifies, routes and links: nothing is entered twice, nothing gets lost between two tools.
The connector pushes the alert; the console turns it into a dated event; the event opens an action and an indicator of compromise; the indicator is linked to the risk scenario and, if needed, to the crisis cell.
Plugging in sources does not replace analysis. We prefer to say so: what the module brings is signals in the right place, not infallible detection.
Galyct Pro reads your sources and reports their alerts. It does not write, does not control your tools and carries out no offensive action: observation remains observation.
We do not connect the console to threat databases hosted outside the European Union. The sources are controlled and French, even if that means narrower coverage, a choice we stand by.
A feed reports signals; it does not draw conclusions for you. No result is guaranteed: qualification and decision remain in your hands, recorded in the console.
We look for the signal that matters in your context rather than for volume. A connector that floods you with unprioritised alerts helps no one decide.
When a connector signal is confirmed (ransomware, compromised critical account, data leak): stabilise without destroying the evidence, and get support. We open a crisis cell and keep the thread of decisions.
A 30-minute live demo: we plug in a read-only connector and follow the signal all the way to the decision. No commitment, your data processed in the European Union.
