ShieldGate Academy

Curriculum / Deployment and advanced topics

Extending ShieldGate with plugins

Use the plugin SDK to add threat feeds, notifications, SIEM outputs, and custom challenges.

Goal

Know what the plugin system can extend, which plugins ship in the box, and how to build your own with the SDK.

Extension points

The plugin SDK defines contracts for the places teams most often need custom behavior:

  • Threat intelligence feeds — bring your own indicator sources
  • Notifications — route alerts to chat, ticketing, or paging systems via webhooks
  • SIEM outputs — ship events to any HTTP/JSON collector
  • Challenges — custom bot-verification flows via webhook

Bundled plugins

ShieldGate ships reference implementations you can use directly or copy as templates:

  • Static threat feed (great for testing reputation rules)
  • Webhook notifications
  • HTTP/JSON SIEM output
  • Webhook challenge

Building your own

  1. Reference the ShieldGate.PluginSdk package.
  2. Implement the contract interface for your extension point.
  3. Ship the assembly to the plugins directory; it is discovered at startup.
  4. Configure the plugin instance in the console.

Keep plugins stateless and fast — they sit on hot paths. Anything slow (an external API call) must be async and time-boxed.

Verify

  • A test event reaches your notification plugin's destination.
  • Plugin failures are logged but do not break request processing.

Pitfalls

  • A plugin that blocks for 5 seconds on the request path will take your p99 latency with it. Time-box everything.
Sign in to track progress