Ticketing
Findings become tickets with owner, heat and evidence attached. Closing the ticket triggers a retest.
finding.verified → ticket · ticket closed → retest
- Jira
- ServiceNow
- Linear
- GitHub Issues
Integrations
Fits the way your team already works.
Findings go where your team already looks. Alerts go where they already talk. Everything is available over the API.
01Works with
Chat
Hot findings and retest results post to the channel you choose, with the evidence a click away.
finding.verified → channel · retest.passed → channel
- Slack
- Microsoft Teams
SIEM & SOAR
Verified findings and surface changes stream as events, ready for your playbooks.
finding.* and surface.changed → event stream
- Splunk
- Microsoft Sentinel
- Google SecOps
- Elastic
Cloud providers
Read-only connections enrich discovery with what is actually deployed.
read-only inventory → Sight
- AWS
- Azure
- Google Cloud
Identity providers
Single sign-on for access, and identity context for discovery.
SSO → access · directory → Sight
- Okta
- Microsoft Entra ID
CI/CD
Gate releases on open hot findings, and trigger retests from your pipeline.
pipeline → retest · open hot findings → gate
- GitHub Actions
- GitLab
- Azure DevOps
On-call
A critical finding verified at 03:00 pages the person on call, with the evidence in the alert.
finding.verified (critical) → page
- PagerDuty
- Opsgenie
API & webhooks
Everything in the platform, available to your own tooling.
every event → your endpoint
- REST API
- Webhooks
02Routing rules
Findings route themselves.
A rule reads like a sentence: when a finding is verified, if it is hot and belongs to Platform, create the ticket, tell the channel and retest when the ticket closes. You write the rules once. The platform runs them on every finding, and logs every action it takes.
Routing rules
3 of 4 enabledNew rule01Hot findings to PlatformEnabled When- A finding is verified
If- Heat ≥ 80
- Owner is Platform
Then- Create a Jira ticket
- Notify #sec-platform in Slack
- Retest when the ticket closes
02Critical findings page on-callEnabled When- A finding is verified
If- Severity is Critical
- Outside working hours
Then- Page the on-call engineer in PagerDuty
- Post to #sec-oncall in Microsoft Teams
03Surface changes to the SIEMEnabled When- The surface changes
If- Zone is Acquired brand or Suppliers
Then- Send surface.changed to Splunk
- Open a Linear issue for Vendor management
04Gate releases on open hot findingsDraft When- A pipeline runs
If- Repository owns an asset with heat ≥ 70
- Finding is open
Then- Fail the GitHub Actions check
- Trigger a retest on merge
Every action a rule takes is logged with the finding it acted on.
03API & webhooks
Events go out. Closure comes back.
Every verified finding leaves the platform as an event and lands in the tool that owns the next step. When that tool closes the ticket, the platform hears it, retests the finding and only then calls it fixed.
Every event, on the wire.
Six event types cover the loop end to end. Subscribe a webhook, or pull anything in the platform over the API.
finding.verifiedPursuit reproduced a finding and an operator cleared it.finding.routedA ticket was raised and an owner assigned.finding.fixedA retest passed and the finding closed.surface.changedSight found, lost or re-classified an asset.operation.startedA red team operation, campaign or retest batch began.retest.passedA retest ran from a clean session and the path no longer works.
{"event": "finding.verified","heat": 91,"severity": "critical","title": "Admin panel reachable from the internet","asset": "vpn-02.brackwell.example","owner": "Platform team","evidence": "https://app.saluki.example/f/PR-0917"}