Appearance
Integration Catalogue
Where to find it: Integrations, then Integration Catalogue (/integrations/catalogue).
The Integration Catalogue is the authoritative, named directory that answers the question: "Does OrviQ integrate with X, and how?"
It provides a transparent, read-only disclosure of exactly 22 catalogued integrations:
- 20 available (backed by active native adapters, collectors, or file parsers in the build)
- 2 planned (
splunkandmicrosoft_sentinel— catalogue-only in current release, method: push)
Requires the integrations_catalogue entitlement and integration.read permission.
Read-Only Catalogue Behavior
The Integration Catalogue is designed as an honest disclosure interface:
- Statuses cannot be inflated: Availability is computed dynamically at runtime from the adapter modules compiled into the application build. If an adapter module is missing or marked planned, the platform refuses to display it as operational, regardless of tenant configuration.
- Read-only disclosure: The catalogue displays integration methods, telemetry types, supported formats, and active connection counts across your tenant without requiring credentials to be entered in the catalogue itself.
- Direct navigation to connection workflows: Each entry links to its operational configuration area:
- Vulnerability scanners and ITSM tools link to Security Tool Integrations (
/integrations/security-tools?tab=connections). - Cloud platforms and identity providers link to Cloud & Identity Discovery (
/integrations/discovery?tab=connections). - Webhooks and programmatic access link to Administration Settings (
/settings/integrations).
- Vulnerability scanners and ITSM tools link to Security Tool Integrations (
Complete Integration Inventory
The catalogue covers 22 named integrations across seven functional categories:
| Vendor Key | Vendor Label | Category | Integration Method | Status | Inbound / Outbound Mechanism |
|---|---|---|---|---|---|
entra_id | Microsoft Entra ID | Identity & access | Native connector | Available | Microsoft Graph API (users, MFA registration, privileged roles, apps) |
active_directory | Active Directory (on-premises) | Identity & access | Webhook / push evidence | Available | Customer-hosted PowerShell collector pushing over HTTPS; or manual JSON file import |
okta | Okta | Identity & access | Native connector | Available | Okta Management API (users, groups, admin roles, MFA factors) |
azure | Microsoft Azure | Cloud & infrastructure | Native connector | Available | Azure Resource Graph inventory across subscriptions |
microsoft_365 | Microsoft 365 | Cloud & infrastructure | Native connector | Available | Microsoft Secure Score controls converted to configuration evidence |
aws | Amazon Web Services | Cloud & infrastructure | Native connector | Available | Resource Explorer inventory; AWS Config for configuration state |
gcp | Google Cloud | Cloud & infrastructure | Native connector | Available | Cloud Asset Inventory searchAllResources across org, folders, or projects |
vmware | VMware vSphere | Cloud & infrastructure | Native connector | Available | vCenter REST API inventory (ESXi hosts, virtual machines, datastores) |
tenable_sc | Tenable Security Center | Vulnerability management | Native connector | Available | Documented REST API (x-apikey); plus governed .nessus and CSV file import |
nessus | Tenable Nessus | Vulnerability management | Native connector | Available | Governed .nessus file import; REST API export pull where network reachable |
tenable_io | Tenable Vulnerability Management | Vulnerability management | Native connector | Available | Cloud Vulnerability Export API |
qualys | Qualys VMDR | Vulnerability management | Native connector | Available | Host List Detection API; plus governed XML and CSV report import |
rapid7 | Rapid7 InsightVM / Nexpose | Vulnerability management | Native connector | Available | Security Console API v3 (assets and vulnerabilities); plus CSV report import |
microsoft_defender | Microsoft Defender | Vulnerability management | Native connector | Available | Defender for Endpoint API (devices and machine vulnerabilities) |
crowdstrike | CrowdStrike Falcon Spotlight | Vulnerability management | Native connector | Available | Falcon Spotlight combined vulnerabilities API grouped per sensor host |
nipper | Titania Nipper | Configuration & benchmarks | Native connector | Available | Governed report import (Nipper Studio XML/CSV/JSON); REST pull for Nipper Enterprise |
prowler | Prowler | Configuration & benchmarks | CSV / file import | Available | OCSF / CSV report import — cloud security checks mapped to evidence and findings |
splunk | Splunk | SIEM | Webhook / push evidence | Planned | Catalogue-only in current release (status: planned, method: push) |
microsoft_sentinel | Microsoft Sentinel | SIEM | Webhook / push evidence | Planned | Catalogue-only in current release (status: planned, method: push) |
servicenow | ServiceNow | ITSM / ticketing | Native connector | Available | Table API ticket write-back (incidents / vulnerable items) from findings; signed webhooks |
jira | Jira | ITSM / ticketing | Native connector | Available | Jira Cloud REST / Data Center API issue write-back from findings; signed webhooks |
github | GitHub / GitLab | DevOps | Native connector | Available | Repositories as application assets; branch protection, secret alerts as config evidence |
Planned integrations are catalogue-only and not operational
Splunk and Microsoft Sentinel are catalogued with status Planned and method push. In the current release, they are catalogue-only entries without operational adapters and must not be documented, configured, or treated as operational.
Semantic Doctrine
Semantic Doctrine: Integrations & Compliance
Enterprise compliance in OrviQ enforces clear distinctions between technical integration and regulatory status:
- Integration connection != compliance: Establishing a connection to an external tool demonstrates telemetry flow; it does not satisfy a compliance obligation or certify adherence to any framework.
- Scanner finding != confirmed control failure: Ingested vulnerabilities or configuration deviations are technical observations. They require triage, contextual risk evaluation, and human review before becoming governed findings or control deficiencies.
- Evidence != effectiveness: Automated evidence collection (via collectors, push API, or scanner sync) yields point-in-time observation records. Operating effectiveness is established only through indicator rules, threshold validation, and formal assessment by control owners and auditors.
Permissions & Access
| Action | Permission Key | Required Entitlement | Human Session Required? |
|---|---|---|---|
| Browse Integration Catalogue | integration.read | integrations_catalogue | No |
| Configure operational scanner connections | integration.manage | integrations_security_tools | Yes |
| Configure cloud/identity discovery | discovery.manage | cloud_discovery | Yes |