Integrations
Antemure connects to the rest of your stack in three ways: it ingests alerts from identity, EDR and SIEM products for correlation; it acts through SOAR response adapters and provider APIs; and it reasons through an LLM gateway you control. Secrets are always vault references, never inline.
Inbound integration catalog
The hub ingests alerts and context from enterprise products (~29 providers) and correlates them with endpoint telemetry. Configure them under the dashboard's Integrations tab.
| Category | Providers |
|---|---|
| Identity | Okta, Microsoft Entra ID |
| EDR | CrowdStrike Falcon, SentinelOne |
| SIEM | Splunk, Microsoft Sentinel |
| Ticketing | ServiceNow, Jira (Atlassian) |
| Notification | Slack, PagerDuty, Google Chat |
Where a provider supports it, remediation can route directly through its API — e.g. suspend a user or revoke sessions via Okta/Entra, or contain a host via CrowdStrike.
Correlation alerts
Ingested identity/EDR events are correlated into higher-order detections — MFA fatigue, password spray, impossible travel, credential exfiltration — reasoned to a verdict and offered one-click (or playbook-driven) remediation through the relevant provider. A live event feed and the resulting alerts appear under Integrations.
SOAR response adapters
SOAR playbooks act through typed integration adapters that resolve secrets from the vault and enforce a destination policy (host/CIDR allowlist, SSRF protection, response-size caps):
- Jira —
ticket.create(base URL, account email, API-token ref, project/issue type, summary, labels). - Signed webhook —
webhook.signed, HMAC-SHA256 signed (x-aura-signature), secret via vault ref, host allowlist. - Google Chat —
notify.google_chat, threaded detection/resolution cards, queued through a durable outbox.
SOAR also carries built-in endpoint/identity/network capabilities (isolate host, kill process, block network, quarantine file, revoke sessions, firewall block CIDR, enrich IOC, notify Slack/PagerDuty) — see SOAR & Playbooks.
Notifications
Beyond SOAR, the hub posts incident and resolution cards to Google Chat via a webhook URL (stored only in a 0600 settings file, never logged or returned), drained from a durable outbox with backoff and SSRF validation. A per-incident Slack-compatible alert_webhook_url can also be set on a node.
LLM gateway & BYOK
Reasoning talks to an OpenAI-compatible gateway. The default is the hosted Aura Portal Gateway (gateway.secureinsights.ai), which holds provider keys centrally — the node authenticates with its license key as the bearer. For BYOK / on-prem / air-gapped, set llm.provider: custom and point llm.base_url at your own endpoint (vLLM, Ollama, LM Studio, LocalAI) with a pushed api_key. The hub pushes the model choice and spend caps to every node. No provider SDK is bundled — everything goes through the gateway abstraction.
Cloud & control plane
- S3 archive — encrypted long-term telemetry archive to any S3-compatible store (see SIEM & Telemetry).
- Control plane (
control.secureinsights.ai) — license validation and delta software updates: the updater checks for changes, downloads only the components whose hash changed, verifies, installs and restarts services, with version-pin and rollback. Driven from the hub's Settings → Updates.
Secret handling
Integration credentials live in the encrypted vault (AES-256-GCM) and are referenced by name (*_ref / vault:<name>) wherever a playbook or config needs them. Secret values are write-only: never returned over the API, never sent to the LLM, never written to logs, and resolved only inside SOAR activities so plaintext never enters workflow history. See Tokens, Auth & RBAC.