With New Third-Party Integrations, Cato Improves Reach and Helps Customers Cuts Costs

Consider this: By the end of 2024, Gartner has projected that over 40% of enterprises will have explicit strategies in place for SASE adoption compared to just 1% in 2018. As the “poster child” of SASE (Forrester Research’s words not mine), Cato has seen first-hand SASE’s incredible growth not just in adoption by organizations of all sizes, but also in terms of third-party vendor requests to integrate Cato SASE Cloud into their software.

The Cato API provides the Cato SASE Experience programmatically to third parties. Converging security and networking information into a single API reduces ingestion costs a simplifies data retrieval. It’s this same kind of elegant, agile, and smart approach that typifies the Cato SASE Experience. Over the past year, nearly a dozen technology vendors released Cato integrations including Artic Wolf, Axonius, Google, Rapid7, Sekoia, and Sumo Logic. Cato channel partners, like UK-based Wavenet, have also done their own internal integrations, reporting significant ROI improvements.

“So many of vendors who didn’t give us the time-of-day are now approaching and telling us that their customers are demanding they integrate with Cato,” says Peter Lee, worldwide strategic sales engineer and Cato’s subject matter expert on the Cato API. 

One API To Rule them All

As a single converged platform, Cato offers one API for fetching security, networking, and access data worldwide about any site, user, or cloud resource. A single request allowed developers to fetch information on a specific object, class of events or timeframe – from any location, user, and cloud entity, or for all objects across their Cato SASE Cloud account.

This single “window into the Cato world” is one of the telltale signs of a true SASE platform. Only by building a platform with convergence in mind could Cato create a single API for accessing events related to SD-WAN and networking, as well as security events from our SWG, CASB, DLP, RBI, ZTNA/SDP, IPS, NGAM, and FWaaS capabilities. All are delivered in the same format and structure for instant processing.

By contrast, product-centric approaches require developers to make multiple requests to each product and for each location. One request would be issued for firewall events, another for IPS events, still another for connectivity events for each enterprise location. Multiple locations will require separate requests. And each product would deliver data in a different format and structure, requiring further investment to normalize them before processing.

Channel Partners Realizes Better ROI Due to Cato API

The difference between the two is more than semantic; it reflects on the bottom line. Just ask Charlie Riddle. Riddle heads up product integration for Wavenet, a UK-based MSP offering a converged managed SOC service based on Microsoft and Cato SASE Cloud.  

He had a customer who switched from ingesting data from legacy firewalls to ingesting data from Cato. “Cato’s security logs are so efficient that when ingested into our 24/7 Managed Security Operations Centre (SOC), a 500-user business with 20+ sites saved £2,000 (about $2,500) per month, about 30% of the total SOC cost, just in Sentinel log ingestion charges,” he says.

For Cato customers, Wavenet only needed to push the log data into its SIEM, not the full network telemetry data, to ensure accurate event correlation.  And because Wavenet provides both the Cato network and the SOC, Wavenet’s SOC team is able to use Cato’s own security tools directly to investigate alerts and to respond to them, rather than relying only on EDR software or the SIEM itself. Managing the network and security together this way improves both threat detection and response, while reducing spend.  

Partners Address a Range of Use Cases with Cato

Providing security, networking, and access data through one interface has led to a range of third-party integrations. SIEMs need to ingest Cato data for comprehensive incident and event management. Detection and response use Cato data to identify threats. Asset management systems tap Cato data to track what’s on the network.

Sekoia.io XDR, for example, ingests and enriches Cato SASE Cloud log and alerts to fuel their detection engines. “The one-click “cloud to cloud” integration between Cato SASE Cloud and Sekoia.io XDR allows our customers to leverage the valuable data produced by their Cato solutions and drastically improve their detection and orchestration capabilities within a modern SOC platform,” Georges Bossert, CTO of Sekoia.io, a European cybersecurity company. (Click here for more information about the integration)

Another vendor, Sumo Logic, ingests Cato’s security and audit events, making it easy for users to add mission-critical context about their SASE deployment to existing security analytics, automatically correlate Cato security alerts with other signals in Sumo Logic’s Cloud SIEM, and simplify audit and compliance workflows.

“Capabilities delivered via a SASE leader like Cato Networks has become a critical part of modern organizations’ response to remote work, cloud migration initiatives, and the overall continued growth of SaaS applications required to run businesses efficiently,” said Drew Horn, Senior Director of Technology Alliances, Sumo Logic. “We’re excited to partner with Cato Networks and enable our joint customers the ability to effectively ensure compliance and more quickly investigate potential threats across their applications, infrastructure and digital workforce.” (Click here for more information about the Sumo Logic integration.)

Partners and Enterprises Can Easily Integrate Cato SASE Cloud into Their Infrastructure

To learn more about how to integrate with Cato, check out our technical information about the Cato API here.  For a list of third-party integrations with Cato, see this page.