What does a SecurityVault integration do?

Each integration brings data in or sends decisions out: source control and CI/CD for scans and gates, clouds and clusters for posture and runtime binding, registries for images, ticketing and chat for remediation, SIEM for streaming, identity providers for people and groups, and security platforms for imported findings. Inbound integrations add context; outbound integrations deliver findings, notifications or decisions to the systems your teams use.

Do imported findings from Wiz, Prisma Cloud or Tenable create duplicates?

Matching imported findings can corroborate existing results. Correlation depends on the identifiers and asset context supplied by each source; missing or different identifiers can require review. See risk-based vulnerability management.

How are integration credentials protected?

Provider credentials are encrypted at rest and decrypted only inside the component that needs them. Rotation is a first-class API with version tracking, and cloud onboarding grants only the least-privilege role the enabled collectors require.

What if the tool we use is not listed?

The generic webhook sends signed JSON that receivers can verify, and the API exposes documented platform operations. If you need a dedicated connector, tell us what it must do.

Security integrations,
built into the platform.

Connect the systems where your teams write, build, deploy and fix software. Bring source and asset context into investigations, then send findings and decisions to your existing workflows. Review supported operations and permissions for each connector during onboarding.

Request a demo View the platform

Catalogue

Which tools does SecurityVault integrate with?

29 built-in connectors in the connector framework, plus native source-control, cloud, cluster and registry integrations. Everything below ships in the product today.

Source control & CI/CD

GitHubGitLabBitbucketAzure DevOpsJenkins

Push and pull-request webhooks, pull-request scans that supersede earlier runs, SARIF upload, gate results, rate-limited annotated comments, CI OIDC principals and pipeline templates. See deployment gates.

Cloud providers

AWSMicrosoft AzureGoogle Cloud

Agentless collectors for posture, identity and entitlements, serverless, drift and attack paths, onboarded with least-privilege roles you control. See cloud security posture management.

Kubernetes

EKSGKEAKSAny conformant cluster

Register clusters for inventory, topology and admission checks. A fully self-hosted deployment is available on request. See Kubernetes security.

Container registries

Amazon ECRAzure ACRGoogle Artifact RegistryJFrog ArtifactoryHarborSonatype NexusDocker HubGitHub Container RegistryQuayAny OCI registry

Registry watchers bind image digests to repositories and workloads; each digest carries its own scan results and base-image recommendation. See container security.

Ticketing

Jira CloudJira ServerServiceNowLinearZendeskAzure DevOps BoardsGeneric webhook

Two-way sync. Inbound webhooks are signature-verified with a per-organisation, per-provider key and a replay guard. See remediation SLAs.

Chat & on-call

SlackMicrosoft TeamsPagerDuty

Bots and commands for Slack and Teams; escalation through PagerDuty.

SIEM & logging

Splunk HECMicrosoft SentinelGoogle ChronicleIBM QRadarElasticsearchSyslog

Findings, audit events and security events streamed in each SIEM's native format.

Identity

OktaMicrosoft Entra IDGoogle WorkspaceCyberArkSCIM 2.0 (outbound)

Single sign-on and group sync from your IdP, outbound SCIM push, and privileged-account context for attack paths. See identity and entitlements.

Security platforms

CrowdStrike FalconMicrosoft DefenderSentinelOneWizPrisma CloudTenableRapid7 InsightVM

Import findings and asset context from platforms you already run. Matching results can corroborate existing findings.

Developer platforms

Argo CDBackstageStatus page feed

Deployment provenance from Argo CD, service ownership from Backstage and status publication for your operators.

How connectors behave

How does every connector behave?

The same contract for every integration, so none becomes a blind spot.

Health is visible

A connector that stops reporting shows up on the dashboard and in alerts, not in a support ticket weeks later.

Credentials protected

Provider credentials are encrypted at rest and decrypted only where they are needed. Rotation is a first-class API with version tracking.

Least privilege

Cloud onboarding produces the minimum role for the collectors you enable. Registry and source-control tokens are scoped to read, plus write only for pull-request comments and gate status.

Inbound verified

Every inbound webhook is verified with the provider's signature scheme in constant time, with replay protection. Malformed input is rejected, never processed.

Outbound signed

The generic webhook signs its payload with HMAC-SHA256 over canonical JSON, so receivers can verify and de-duplicate.

Imported findings corroborate

Findings from Wiz, Prisma Cloud, Tenable or Rapid7 resolve into the same model as native results. Matching identifiers allow corroboration; ambiguous matches need review.

FAQ

Integration questions

What does a SecurityVault integration do?: Each integration brings data in or sends decisions out: source control and CI/CD for scans and gates, clouds and clusters for posture and runtime binding, registries for images, ticketing and chat for remediation, SIEM for streaming, identity providers for people and groups, and security platforms for imported findings. Inbound integrations add context; outbound integrations deliver findings, notifications or decisions to the systems your teams use.
Do imported findings from Wiz, Prisma Cloud or Tenable create duplicates?: Matching imported findings can corroborate existing results. Correlation depends on the identifiers and asset context supplied by each source; missing or different identifiers can require review. See risk-based vulnerability management.
How are integration credentials protected?: Provider credentials are encrypted at rest and decrypted only inside the component that needs them. Rotation is a first-class API with version tracking, and cloud onboarding grants only the least-privilege role the enabled collectors require.
Can SecurityVault send findings to our SIEM?: Yes. Findings, audit events and security events stream to Splunk HEC, Microsoft Sentinel, Google Chronicle, IBM QRadar, Elasticsearch or syslog in each destination's native format.
What if the tool we use is not listed?: The generic webhook sends signed JSON that receivers can verify, and the API exposes documented platform operations. If you need a dedicated connector, tell us what it must do.

See it on your stack

Connect the tools you already run.

Tell us which source-control, cloud and ticketing systems you use. We will demonstrate the workflow and help define an evaluation with the permissions it needs.

Request a demo Read the docs