Integration Catalog

Connect the platform to your existing security toolchain. Every integration is configured under Settings → Integrations, takes 2–5 minutes to set up, and uses your existing credentials in the target system — no service accounts to provision separately. The platform pushes findings, scan events, and compliance scores; some integrations (Jira, ServiceNow, GitHub Issues) also sync state back so closures propagate to the right side.

Why integrations matter: the platform is best when its findings show up where your team already lives — in Slack channels, Jira queues, PagerDuty rotations, Splunk dashboards. A finding that gets emailed once and forgotten doesn't get fixed; a finding that lands as a tracked Jira ticket does.

Integration ecosystem

The catalog is grouped into six categories. Teams typically connect 3–5 on first onboarding (Slack, Jira, and Splunk are the most common starter set) and add more over time.

Available integrations

Ticketing and project management

Messaging and alerting

SIEM and observability

SOAR, GRC, and CI/CD

Jira setup

The Jira integration is the most-used integration on the platform. It auto-creates Jira issues for findings that match your filters and bidirectionally syncs status — closing the Jira issue acknowledges the finding, and re-opening the Jira issue re-opens the finding.

Reading the flow left to right:

1. Critical finding detected — for example, an S3 bucket with public access containing PII.
2. Auto-create rule — the integration filter decides whether to create an issue (Critical only, Critical + High, or all findings).
3. Jira issue created — populated with summary, description, priority, labels, and an Onam deep link.
4. Team remediates — standard Jira workflow; move to Done when the cloud config is fixed.
5. Auto-close — the next scan verifies the fix and resolves the finding, which also marks the Jira issue done if it isn't already.

Setup steps:

1. Navigate to Settings → Integrations → Jira → Connect.
2. Enter your Jira base URL (for example, https://yourcompany.atlassian.net).
3. Enter a Jira API token (generate one at id.atlassian.com) and your Jira email address.
4. Click Test Connection, then configure the options below, then Save.

Jira issue fields populated automatically:

• Summary: [Onam] {rule_title} - {resource_uid}
• Description: finding detail, affected resource, remediation steps, and a console deep link
• Priority: mapped from finding severity
• Labels: onam, cloud-security, and the provider name

Slack setup

1. Navigate to Settings → Integrations → Slack → Connect.
2. Click Connect to Slack and authorize the app in your workspace.
3. Map notification channels to severity levels.

Example Slack message:

CRITICAL finding detected
Rule: S3 Bucket Public Access Not Blocked
Resource: arn:aws:s3:::my-bucket
Account: production-aws (123456789012)
Region: us-east-1
First seen: 2026-07-18 10:00 UTC

Remediation: Enable S3 Block Public Access...
[View in Onam] [Create Jira Issue]

Webhooks

The generic webhook sends a POST request to your endpoint for every event that matches your configured filters — the building block for any SOAR playbook or custom automation.

Setup steps:

1. Navigate to Settings → Integrations → Webhook → Add Webhook.
2. Enter the endpoint URL.
3. Configure an optional HMAC secret for payload verification.
4. Set filters: severity, provider, resource type, status.
5. Click Test to send a sample payload.

Payload format:

{
  "event": "finding.created",
  "timestamp": "2026-07-18T10:00:00Z",
  "tenant_id": "your-tenant",
  "finding": {
    "finding_id": "chk-4f9a2c31",
    "rule_id": "AWS-S3-001",
    "rule_title": "S3 Bucket Public Access Not Blocked",
    "severity": "critical",
    "status": "OPEN",
    "resource_uid": "arn:aws:s3:::my-bucket",
    "resource_type": "aws_s3_bucket",
    "provider": "aws",
    "region": "us-east-1",
    "account_id": "123456789012",
    "remediation": "Enable S3 Block Public Access...",
    "first_seen_at": "2026-07-18T10:00:00Z"
  }
}

The finding object follows the Finding Schema.

Verifying the signature:

import hmac, hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)

Always configure the HMAC secret and verify the X-Onam-Signature header before acting on a webhook. Without verification, anyone who discovers your endpoint URL can inject fake findings into your automation.

Webhook event types:

SIEM forwarding

Splunk

1. In Splunk, create an HTTP Event Collector (HEC) token under Settings → Data Inputs → HTTP Event Collector → New Token, with source type onam:findings.
2. In the Onam console, navigate to Settings → Integrations → Splunk → Connect.
3. Enter the HEC URL (https://your-splunk-instance:8088), the HEC token from step 1, and the target index (for example, security).
4. Click Test Connection, then Save.

Findings stream to Splunk in real time after each scan completes. Example search:

index=security sourcetype=onam:findings severity=critical status=OPEN
| table _time, rule_title, resource_uid, provider, region, account_id
| sort -_time

AWS Security Hub

1. Enable Security Hub in your AWS account.
2. In the Onam console: Settings → Integrations → AWS Security Hub → Connect.
3. Select the AWS region where Security Hub is enabled.
4. Enter the account ID and an IAM role ARN with the securityhub:BatchImportFindings permission.
5. Click Save.

Findings are forwarded in ASFF (AWS Security Finding Format) and appear in Security Hub under the custom product name Onam.

Request an integration

Don't see an integration you need?

• In-app: Settings → Integrations → Request Integration
• Email: integrations@onam.io

Integration status changes are announced in the release notes.

Next steps

• API Reference — pull findings programmatically instead of (or alongside) push integrations
• Finding Schema — the exact payload shape webhooks and SIEM streams deliver
• SecOps — the SAST, SCA, and IaC scanning that backs the CI/CD integrations
• RBAC & SSO — who on your team can configure integrations