Why don’t you integrate with [foo]?

This post outlines Expel’s approach to security operations and integrations: prioritize high-quality alert sources, automate contextual enrichment to accelerate triage, and reserve broader data access for deeper investigations. It argues that more integrations and bulk log collection can create noisy “haystacks,” advocating instead for a question-first model and tiered integration levels (accessible, indirect via SIEM, direct uni-directional, and direct bi-directional) based on predictability and urgency. The guidance explains how Expel decides which technologies to integrate and how this benefits customers through faster, higher-confidence detections.