What connects today
PentestOps ships four outbound integrations. That list is deliberately short: we would rather ship a handful that are genuinely wired up and tested than publish a grid of logos. Three are purpose-built connectors, and the fourth is a generic webhook that lets you wire up anything else yourself.
| Integration | What it does | What you need |
|---|---|---|
| Slack (notifications) | Posts a formatted message to a channel whenever a subscribed event fires, carrying the target, the event type and, where one applies, a link back into the portal. | An incoming webhook URL for the channel you want the alerts in. |
| Jira (ticketing) | Creates an issue in a nominated project for the event, with a PentestOps-prefixed summary and the finding detail in the description. | Your Jira base URL, the account email, an API token, and the destination project key. |
| GitLab issues (ticketing) | Opens an issue in a nominated project, labelled for security triage, with the finding detail in the body. Issue tracking only, not a pipeline integration. | Your GitLab URL, an access token that can create issues, and the project ID. |
| Generic webhook (custom) | POSTs a JSON body to an endpoint you control for every subscribed event, so you can route events into a tool we do not ship a connector for. | An endpoint that accepts a JSON POST. HTTPS is strongly recommended. |
The events you can route
Each integration subscribes to events independently, so the same platform can be noisy in one place and quiet in another. A common pattern is Slack on everything for situational awareness, Jira on critical findings only so the backlog stays meaningful, and a webhook on scan completion feeding an internal reporting job.
- Scan started. A new assessment has begun against an in-scope asset.
- Scan complete. The assessment finished and results are available in the portal.
- Critical finding. A finding was raised at critical severity, scored with CVSS v3.1 and checked against CISA KEV.
- High finding. The same, one severity band down, off by default.
- Exploit complete. A safe, Rules of Engagement gated exploitation attempt finished, so you hear about validated exposure rather than a theoretical one.
Setting one up
Integrations are configured in the portal by users with manager-level access or above. There is no connector runtime to install and nothing inbound to open: every integration is an outbound call from the platform to the system you nominate.
- Choose the type and give it a destination. Only HTTP and HTTPS URLs are accepted, and endpoints that resolve to private, loopback or link-local addresses are rejected, so a mistyped integration cannot be aimed at internal infrastructure.
- Add the credential the destination needs. A Slack webhook URL, a Jira email and API token, or a GitLab access token. It is encrypted before it is written to the database and is never returned by the API afterwards.
- Pick the events. Toggle each of the five event types on or off for that integration.
- Run the test. The test action sends a real request to the destination and stores the result and timestamp against the integration, so you can see whether the last check passed rather than assuming it did.
- Switch it on, or off. Disabling an integration stops delivery immediately without discarding its configuration.
Building your own pipeline with the webhook
The generic webhook exists so that a short connector list is never a hard limit. When a subscribed event fires, PentestOps sends an HTTP POST to your endpoint with a JSON body. That body identifies the event that occurred, identifies PentestOps as the source, carries a timestamp, and includes the detail fields for the event itself such as the target and a summary. The request is sent with a JSON content type and a PentestOps user agent.
That is enough for a small receiver to do useful work: open a ticket in whatever system your organisation actually runs, post into a chat tool we do not connect to directly, or trigger a workflow elsewhere. Because the receiver is yours, you decide the mapping rather than living with ours.
Treat the endpoint as you would any inbound integration hook. Terminate TLS, keep the URL unguessable, validate the body before you act on it, and make your handler idempotent so a retry or a duplicate delivery cannot open the same ticket twice.
Pulling findings instead of receiving pushes
Not every workflow wants to be interrupted. Reports are produced in multiple formats including PDF, CSV and JSON/API, so a scheduled job can pull structured findings on its own cadence and load them into a risk register or an internal dashboard. Use events for the things that need a human now, and the JSON output for everything that needs to be counted later.
How integration credentials are protected
An integration token is a real credential. A Jira or GitLab token can create and modify issues in your project, and a Slack webhook URL can post into your workspace.
- Tokens are encrypted before they are persisted, using the same vault-held encryption key as other tenant secrets, and they are decrypted only at the moment a request is made.
- The API never returns a stored token. It reports only whether one is configured, so a token cannot be read back out of the portal.
- Destination URLs are validated to block internal and private network addresses, which keeps an integration from becoming a path into infrastructure it was never meant to reach.
- Configuration changes are captured in the tamper-evident audit log, retained for 365 days. See the Trust Centre for the wider control set.
- Each customer runs in an isolated namespace with its own database, so integration configuration is never shared between tenants.
Honest scope
Slack, Jira, GitLab issues and the generic webhook are what exists. There is no packaged connector for other chat, ticketing, SIEM, CI/CD or vulnerability management products, and we are not going to imply otherwise on a marketing page. If your destination is not one of the three named systems, the webhook is the supported route.
Integrations are included from the Professional plan and above; they are not part of Starter. Enterprise engagements can include custom integration work as part of the scope, which is a conversation with sales rather than a switch in the portal. Current plan detail lives on pricing.
Slack, Jira and GitLab are trademarks of their respective owners and are named here solely to identify the systems PentestOps connects to.
Why it matters
- Findings that sit in a portal nobody opened do not get fixed. Routing them into the tool a team already lives in shortens the gap between detection and remediation.
- Events fire on validated exposure, not just raw detections, because safe exploitation runs under a signed Rules of Engagement before an exploit-complete event is raised.
- A ticket created automatically carries the evidence and prioritisation the platform already produced, so triage does not start with someone re-typing a summary.
- Continuous coverage only pays off if it is noticed. Integrations are what make continuous penetration testing and exposure management operational rather than reportable.
- Australian-built and operated. The platform is hosted in Australia, customer data is stored in Australia, and Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified.