Integrations

What is the Integrations page?

Integrations connects Perfai to the tools your engineering and security teams already live in. Instead of requiring everyone to log into another dashboard, Perfai pushes findings, alerts, and reports directly to Slack, GitHub, Jira, and wherever your team works. The integrations page is organized into four categories: Communication, Storage, Issue Tracking, and SIEM.

Communication

Slack Team Activity Stream integration setup

Connect Slack, Discord, or Email and Perfai streams live agent activity, security findings, and fix confirmations directly to your channel — no dashboard required. What gets streamed to your channel:

Agent scan start & completion alerts

Know the moment a scan begins and when results are ready — no need to check the dashboard.

Instant critical vulnerability notifications

Critical findings are surfaced immediately, not buried in an email digest.

Fix Agent PR confirmations

When the Fix Agent opens a PR (e.g., PR #247: Sanitize user ID param in /users/), your team sees it the moment it lands.

Weekly security score digest

A regular summary of your portfolio’s security posture — findings opened, fixed, and trending.

Example activity stream:

# activity-stream                    # security-alerts

perfai vision_agent — Discovery Agent scanned payment_api_v3,
  found 12 new endpoints  · today at 1:21 PM

perfai governance_agent — Critical — SQL injection risk in
  GET /users/{id}/profile  · today at 1:22 PM

perfai fix_agent ✓ — Fix Agent opened PR #247:
  Sanitize user ID param in /users/{id}  · today at 1:24 PM

Slack

Post to any channel · workspace. Best for engineering teams who live in Slack.

Discord

Post to any server channel. Best for engineering communities and teams who coordinate in Discord.

Email

Send alerts to your inbox. Best for executive recipients, auditors, and on-call rotations.

Storage

Auto-sync reports — connect OneDrive, Google Drive, or Dropbox

Connect a cloud storage provider and every report gets synced automatically after each scan — accessible anytime, from anywhere.

Reports are permanently deleted from Perfai after 14 days. Connect a storage provider to keep them forever.

Google Drive

Connected — Automatically save security and privacy reports to a designated Drive folder. Share with stakeholders who don’t have Perfai access.

Dropbox

Available — Sync reports and findings exports to Dropbox for enhanced file management and team collaboration.

OneDrive

Available — Save and share reports within your Microsoft 365 environment via OneDrive.

Storage integrations are especially useful for compliance workflows — automatically depositing a fresh security report after every scan means your audit evidence is always up to date and accessible without manual effort.

Issue Tracking

Jira and GitHub Issues — Single Source of Truth integration setup

Connect Jira or GitHub Issues and Perfai will create, update, and close issues automatically — your board stays accurate without any manual hygiene. How it works:

Vuln found  →  Issue opened  →  Issue closed

A new vulnerability is found → Perfai opens a ticket automatically
The developer fixes it → Perfai re-tests on the next scan
The fix passes → Perfai closes the ticket automatically

Example live issue preview:

● SQL Injection in GET /users/{id}/profile
  auto-created by Perfai   [Critical] [High] [Open]

● Rate limit bypass on GET /api/search
  auto-closed by Perfai    [High] [Fixed] [Closed]

What’s included in every ticket:

Issues opened on each vuln, with full exploit context
Auto-closed when retest passes
Zero manual issue hygiene required

Jira

Cloud · Server · Data Center. Best for teams using Jira for sprint planning and backlog management.

GitHub Issues

Repository · organization. Best for engineering teams whose work lives alongside the codebase.

GitHub MCP

Available — Connect GitHub via the Model Context Protocol for deeper automation alongside your existing tooling.

Linear MCP

Available — Connect Linear via MCP to manage security issues alongside your product roadmap in Linear.

Monday.com

Available — Create an item on a chosen board for each validated finding, so security work sits alongside the rest of your team’s tasks.

HackerOne

Available — File validated findings as structured HackerOne reports — with title, severity, and full vulnerability details — into the program you run.

SIEM

Perfai publishes every security finding through a single, standards-based feed that any SIEM can pull — there’s no per-tool integration to build. Your SIEM polls one endpoint on a schedule and ingests findings as they’re opened, updated, and resolved. Because the feed is a standard HTTP/JSON endpoint, it works with any SIEM that can poll a REST source — including Splunk, Microsoft Sentinel, Elastic, IBM QRadar, and Sumo Logic.

One endpoint, any SIEM

GET /v1/siem/findings
Authorization: Bearer <your-org-api-key>

The feed is pull-based: you point your SIEM’s built-in HTTP poller at this URL, and it fetches new and updated findings on your schedule. Access is scoped to your organization by the API key you send.

Formats

The same endpoint serves two formats — pick the one your SIEM ingests best with the format parameter:

OCSF (default)

Open Cybersecurity Schema Framework — each finding is an OCSF Vulnerability Finding. JSON-native and normalized, so modern SIEMs map fields automatically.

CEF

Common Event Format — a compatibility fallback for tools that expect CEF-style events.

Parameters

Parameter	Description
`format`	`ocsf` (default) or `cef`.
`since`	Incremental cursor — return only findings updated after this timestamp. Use the `next_cursor` from the previous response for continuous polling.
`status`	Filter by lifecycle state: `new`, `resolved`, or `suppressed`.
`severity`	Filter by severity: `critical`, `high`, `medium`, `low`, or `info`.
`page` / `pageSize`	Page through large result sets.

Each response includes a next_cursor value — pass it back as since on the next request so you only ever pull what’s changed.

How to connect it

Get your organization API key

Generate a feed API key for your organization. This key both authenticates the feed and scopes it to your data.

Add an HTTP poller in your SIEM

Create a scheduled REST/HTTP polling input pointing at https://<your-perfai-host>/v1/siem/findings. This is the same input type every major SIEM ships with — a Splunk REST input, a Sentinel Logic App, an Elastic Agent HTTP JSON input, a QRadar Universal REST source, or a Sumo Logic scheduled collector.

Set the authorization header

Add Authorization: Bearer <your-org-api-key> to the request headers.

Choose a format and schedule

Append ?format=ocsf (or ?format=cef) and set a polling interval — every 5 minutes is typical. Store the returned next_cursor and send it as since on each subsequent poll for incremental delivery.

One feed covers every SIEM. You don’t need a Perfai-built connector for your specific platform — if your tool can poll an authenticated HTTP endpoint, it can consume the feed.

Why integrations matter

Security tools fail when they create silos. If developers have to log into a separate platform to see security findings, they won’t — and vulnerabilities stay open longer. Perfai’s integrations put findings where your team already is:

A Slack alert the moment a Critical finding is confirmed means your team responds in minutes, not days
A GitHub Issue created automatically from a BOLA finding means it’s already in the sprint backlog with full reproduction details — no translation needed
A Google Drive report deposited after every scan means your compliance folder is always current without manual exports

The integrations page shows which are Connected (active) and which are Available (ready to enable). Click any card to connect.

Connecting an integration

Click the integration card

Each card shows its current status — Connected (green) or Available (grey). Click an Available card to begin the connection flow.

Authorize access

Most integrations use OAuth — you’ll be redirected to the provider (Slack, GitHub, Google, etc.) to authorize Perfai’s access. No API keys to manage manually.

Configure the destination

After connecting, configure where Perfai sends data — which Slack channel, which GitHub repo, which Jira project, which Drive folder.

Test it

Trigger a manual scan on any app and confirm findings appear in the connected tool. Most integrations push within seconds of a finding being confirmed.

Getting Started

Core Concepts

Hybrid Deployment

Changelog

What is the Integrations page?

Communication

Agent scan start & completion alerts

Instant critical vulnerability notifications

Fix Agent PR confirmations

Weekly security score digest

Slack

Discord

Email

Storage

Google Drive

Dropbox

OneDrive

Issue Tracking

Jira

GitHub Issues

GitHub MCP

Linear MCP

Monday.com

HackerOne

SIEM

One endpoint, any SIEM

Formats

OCSF (default)

CEF

Parameters

How to connect it

Why integrations matter

Connecting an integration

​What is the Integrations page?

​Communication

Agent scan start & completion alerts

Instant critical vulnerability notifications

Fix Agent PR confirmations

Weekly security score digest

Slack

Discord

Email

​Storage

Google Drive

Dropbox

OneDrive

​Issue Tracking

Jira

GitHub Issues

GitHub MCP

Linear MCP

Monday.com

HackerOne

​SIEM

​One endpoint, any SIEM

​Formats

OCSF (default)

CEF

​Parameters

​How to connect it

​Why integrations matter

​Connecting an integration

What is the Integrations page?

Communication

Storage

Issue Tracking

SIEM

One endpoint, any SIEM

Formats

Parameters

How to connect it

Why integrations matter

Connecting an integration