Integrations

ClearScreen connects to your identity provider, to Intune for rollout and to your log pipeline.

Microsoft Entra ID sign-in

On the Business plan, console users can sign in with Microsoft Entra ID single sign-on through Spot Suite. Device agents never use user passwords.

Microsoft Intune

On the Business plan, the Intune tab stores a Microsoft Entra app registration for your tenant. The app registration needs the application permissions DeviceManagementConfiguration.ReadWrite.All and Group.Read.All, with admin consent. The secret is stored encrypted and is not shown again. Choose Verify Connection to test it.

To roll out the agent, run the install commands from the Enrollment tab as an Intune script or Win32 app. For a Win32 app, use a detection rule that finds the service:

Get-Service -Name ClearScreen -ErrorAction SilentlyContinue

Threat feeds

The agent filters with signed bundles built from the URLhaus and OpenPhish feeds and the UT1 and StevenBlack category lists. The bundles refresh every 15 minutes. The agent checks the Ed25519 signature before it uses a bundle and keeps filtering from the last verified bundle when it is offline. Allowed queries go upstream over DoH to Cloudflare 1.1.1.1.

Event export for log forwarding

Block events can be pulled with an export token. An admin creates the token through the console API, and it starts with csat_. It is shown once and only its hash is kept.

curl -H "Authorization: Bearer <export token>" \
  "https://<workspace>.clear-screen.ai/v1/agent/export/events?since=2026-01-01T00:00:00Z"

A response holds up to 500 events and the values to send back as since and after to read the next page. Use GET /v1/agent/export/reviews the same way for review reports.