Integrations¶
Edition: Community and Enterprise Offering: Self-managed
Every integration is off until you configure it, and the admin console lists each one as configured or not configured. None of them ever carries a value, masked or not.
| Integration | Service | What it gives you |
|---|---|---|
| Notifications | notifier |
Each role hears what waits for it |
| SIEM | siem |
The audit chain in your SIEM |
| Git | gitsync |
A signed record of every fix in your repository |
| Metrics and traces | every process | OpenTelemetry metrics and traces, Prometheus /metrics |
Notifications¶
Prerequisites: the notifications profile is on (Install),
and the channels' secrets are in notifier.env.
Channels: e-mail, Microsoft Teams, Slack and signed webhooks. Each event is routed to the roles that must act on it: a fix waiting for review goes to the DBA reviewers, a fix waiting for approval to the business approvers.
A notification carries the request, the event, the state, the target, the environment, the counts and a link. Webhooks are signed, and never follow a redirect.
SIEM¶
Prerequisites: the siem profile is on, and a client certificate for your syslog receiver is
in ./siem-tls.
Every audit event arrives as one OCSF 1.3 event over syslog with TLS, authenticated by sealfix's client certificate, with only the fields on that event's allowlist. Receivers: rsyslog, syslog-ng, or any SIEM that accepts syslog over TLS.
Git¶
Prerequisites: the git profile is on, and gitsync's signing and deploy keys are in
./git-keys.
gitsync commits a record of every fix that is reviewed, approved and executed: the template, the parameter kinds, the approvals and the counts, as signed commits. It also commits the audit checkpoints. Optionally, executions can be bound to Git: an edit made in the repository stops the executions bound to it.
Metrics and traces¶
Each process can export OpenTelemetry metrics and traces over OTLP/HTTP, and serve Prometheus
/metrics on its own port, never on the API listener. Both are off by default, and a failing
collector never affects a fix. The repository ships alert rules in deploy/observability.