--- title: "Integrate Darktrace ActiveAI Security Platform with Red Canary" slug: "integrate-darktrace-activeai-security-platform-with-red-canary" updated: 2026-10-07T17:15:14Z published: 2026-10-07T17:15:14Z canonical: "docs.redcanary.com/integrate-darktrace-activeai-security-platform-with-red-canary" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Darktrace ActiveAI Security Platform with Zscaler MDR Integrate your Darktrace ActiveAI Security Platform to effortlessly forward alert data to Zscaler MDR, enabling our Threat Hunters to utilize it as a valuable alert source. The integration setup includes the following steps: 1. Adding the integration in Zscaler MDR 2. Generating a unique collector 3. Configuring your Darktrace ActiveAI Security Platform settings to forward alerts to Zscaler MDR via the collector 4. Activating the integration ## Prerequisites Before you start the Darktrace integration, please make sure the following requirements are met: - You’re an admin-level user logged into your Darktrace ActiveAI Security Platform ## 1 Zscaler MDR | Add the Integration 1. In your Zscaler MDR portal, go to the **Integrations** page and click **Add Integration**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegation-1_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 2. Search for “Darktrace ActiveAI Security Platform” and click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegrations-1_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 3. From the Ingest Format/Method dropdown, select one of the following options: - **Darktrace ActiveAI Security Platform via Email**: The preferred method, offering enhanced data parsing. - **Darktrace ActiveAI Security Platform via HTTP**: An alternative option, supported but not recommended due to limited support. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-1_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 4. If you selected the email ingestion method, check the **Require alerts to be delivered for ingest over TLS?** box. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-1_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 5. Click **Provision**. This will create a unique collector used to forward your Darktrace alerts to Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-1_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 6. Copy the generated collector. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-1_06.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) ## 2 Darktrace ActiveAI Security Platform | Configure Darktrace Settings 1. In your Darktrace ActiveAI Security Platform, go to **Admin > System Config** and click **Modules**. 2. Scroll down to **Workflow Integrations** and click **Email**. 3. Under the **Settings** tab: - Enable the **Send Alerts** option. - In the **Recipients** field, paste your Zscaler MDR collector email. - In the **Custom Label** field, enter “Zscaler MDR SOC.” - Enable the **JSON Format** option. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegrtion-2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) - Enable the **Send AI Analysts Alerts** option. - In the **Minimum AI Analyst Incident Event Score** field, enter “0.” - In the **Minimum AI Analyst Incident Score** field, enter “20.” ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-2_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) - Enable the **Send Model Breach Alerts** option. - Enable the **Send System Status Alerts** option. - Enable the **Send Resolved System Status Alerts** option. - Enable the **Send RESPOND Alerts** option. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-2_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) ## 3 Zscaler MDR | Activate the Integration 1. In Zscaler MDR, check the **I’ve configured this integration to send data to Zscaler MDR** box and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-3_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 2. (Optional) Check the **Process Correlation** box if appropriate. > [!NOTE] > What is Process Correlation? > > If a third-party alert platform lets you create your own rules to trigger alerts, Zscaler MDR can correlate with the rule metadata when it displays the alerts in the timeline. To conserve API bandwidth and compute cycles, process correlation for user-defined alerts is disabled by default. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-3_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 3. (Optional) If you have a subscription for Zscaler Security Data Lake, check the **Store in the Security Data Lake** box and specify the data retention period. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegration-3_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 4. Click **Save**. To view alert data, click the newly created Darktrace ActiveAI Security Platform at the bottom of the **Integrations** page. You should start seeing new alert data around 15 to 30 minutes after completing steps above. If you’re still not seeing data, [contact Support](https://go.my.redcanary.co/saml/create?RelayState=https%3A%2F%2Fsupport.redcanary.com%2Fhc%2Fen-us%2Frequests%2Fnew&brand_id=360004622793&SAMLRequest=hZFLT8MwEITv%2FArLdydOmr6sJlXUCilSQagFDtxcZ6tG%2BBG8Tmn59aiBSuUA%0AXHfn08zOzuZHo8kBPDbO5jSJOJ0XNzOURrei7MLeruGtAwzkaLRF0S9y2nkr%0AnMQGhZUGUAQlNuXdSqQRF613wSmn6RXyNyERwYfGWUqqZU7PgGdbPkxgNwG2%0A5dMRywaDMZOD7ZRNphnPJtMsqWFMSYXYQWUxSBtymvJ0yPiQpfwxGYmEC569%0AUPJ8uS6NOCXlxWzhLHYG%2FAb8oVHwtF7ldB9CiyKOPdRKWulPe9Bt9AG2BnyN%0AlDOxVAoQ43NGWvQ9iT6DL%2F5lZ%2FG1%2FLvje2mgWj443agTKbV27wsPMkBOg%2B%2BA%0AklvnjQy%2F95dEST9parbrpQKMbHRZ1x4QaVx8uf58ZnHzCQ%3D%3D%0A). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/darktraceintegrations-3_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D)