Integrations · 158 connectors

158 integrations. One asset graph.

Bring every scanner, cloud, EDR, SIEM and CMDB you already run. CVEasy AI deduplicates it all onto one asset graph, re-scores every finding with TRIS™ 3 scoring, and keeps the whole thing on your own Mac. One fix-first queue instead of four dashboards.

Consolidate · Re-score · On-box

158 integrations 135 bring findings in 17 push work out One asset graph Mac-native · on-box
00 · The model

Bring every tool. Keep one queue.

CVEasy is the layer on top, not another silo.

Most security teams do not have a scanning problem. They have a consolidation problem: four tools, four dashboards, four severity schemes, and no single answer to "what do we fix first?" CVEasy AI exists to be that single answer. Findings from 158 integrations land on one deduplicated asset graph, are re-scored with the same TRIS™ 3 model, and surface as one fix-first queue.

Of the 158, 135 bring findings and asset context in: 78 through live API connectors, 43 through file imports, and 14 through push endpoints. 17 push work back out: ticketing, patch dispatch and notifications. The last 6 are built-in data feeds such as NVD, CISA KEV and EPSS. Every entry maps to a real, working path in the product, which is a rule the catalog enforces in code. There are no vapor integrations on this page.

The part that matters is where it all runs. CVEasy keeps the asset graph and the AI that reasons over it on your own Apple Silicon Mac, local-first and air-gap capable, so consolidating your tools does not mean handing your findings to another vendor cloud.

  • 135 inbound: 78 live API connectors, 43 file imports, 14 push endpoints
  • 17 outbound: ticketing, patch dispatch and notifications, plus 6 built-in data feeds
  • 15 categories: from scanners and EDR to SIEM, CMDB, identity and mitigating controls
  • One asset graph: a host seen by three tools is one asset, not three
  • One score: TRIS™ re-ranks every source the same way, in your context
  • On-box: consolidation without sending your findings anywhere
01 · Vulnerability scanners

Vulnerability scanners 9

9 integrations in this category. Linked names have a detail page.

  • Tenable Vulnerability Management Tenable
    Live pull from Tenable.io / Nessus cloud APIs with per-asset dedup.
    Live API pull
  • Qualys VMDR Qualys
    Live VMDR host-detection pull; XML report import also supported.
    Live API pull File import
  • Rapid7 InsightVM Rapid7
    Live InsightVM pull with RealContext criticality; Nexpose XML + CSV export import.
    Live API pull File import
  • Nessus Tenable
    Latest scan results pulled live from a Nessus Professional server; .nessus file import also supported.
    Live API pull File import
  • OpenVAS / Greenbone Greenbone
    GVM/OpenVAS XML report import.
    File import
  • Nuclei ProjectDiscovery
    Template-based scanning, built-in engine, plus JSONL import.
    File import Built-in engine
  • Vuls (authenticated scan) Vuls (OSS)
    Credentialed CVE scan of Linux/BSD hosts, import Vuls `report -format=json` output.
    File import
  • CSV (any scanner) CVEasy
    Header-flexible CSV import, hostname/ip/cve/severity/port columns auto-mapped (works with most scanner grid exports).
    File import
  • Kandji Vulnerability Management (beta) Kandji
    CVE detections on Apple devices from Kandji Vulnerability Management, re-scored with TRIS.
    Live API pull
02 · EDR and endpoint

EDR and endpoint 7

7 integrations in this category. Linked names have a detail page.

  • CrowdStrike Falcon Spotlight CrowdStrike
    Spotlight vulnerability pull + Falcon agent inventory feeding EDR control coverage.
    Live API pull
  • SentinelOne Singularity SentinelOne
    Vulnerability pull + agent fleet inventory feeding EDR control coverage.
    Live API pull
  • Microsoft Defender for Endpoint Microsoft
    Defender TVM vulnerability pull + onboarded-machine inventory feeding EDR control coverage.
    Live API pull
  • Cortex XDR Palo Alto Networks
    Endpoint inventory and agent health; only a connected agent counts as EDR coverage.
    Live API pull
  • Sophos Central Sophos
    Managed endpoints and agent health from Sophos Central.
    Live API pull
  • Trend Vision One Trend Micro
    Endpoint inventory from Trend Micro Vision One.
    Live API pull
  • Huntress Huntress
    Huntress agents; only an agent that has called back recently counts as EDR coverage.
    Live API pull
03 · Cloud and CNAPP

Cloud and CNAPP 19

19 integrations in this category. Linked names have a detail page.

  • Amazon Web Services AWS
    Agentless CSPM (CIS-aligned rules) + Amazon Inspector findings across accounts/regions.
    Live API pull
  • Microsoft Azure Microsoft
    Agentless CSPM over ARM: misconfigurations, exposure, identity risk.
    Live API pull
  • Google Cloud Platform Google
    Agentless CSPM over GCP APIs: misconfigurations and asset inventory.
    Live API pull
  • Wiz Wiz
    Wiz Security Graph over GraphQL: vulnerability findings with cloud resource id, internet exposure and environment. JSON export also supported.
    Live API pull File import
  • Orca Security Orca Security
    Agentless CNAPP alerts with cloud asset id, internet exposure and environment context.
    Live API pull
  • Prisma Cloud Palo Alto Networks
    Prisma Cloud alerts with resource identity and cloud account context.
    Live API pull
  • Lacework FortiCNAPP Fortinet
    Active host vulnerabilities from Lacework (FortiCNAPP) with machine tags as asset context.
    Live API pull
  • AWS Security Hub AWS
    Aggregated ASFF findings; the resource ARN is a tier-1 asset fingerprint.
    Live API pull
  • Google Security Command Center Google
    Active findings across the GCP organization.
    Live API pull
  • Microsoft Defender for Cloud Microsoft
    Security assessments across an Azure subscription.
    Live API pull
  • Aqua Security Aqua Security
    Image vulnerabilities pulled live from an Aqua Security console.
    Live API pull
  • Sysdig Secure Sysdig
    Runtime vulnerability results pulled live from Sysdig Secure.
    Live API pull
  • Prowler Prowler (OSS)
    Prowler AWS/multi-cloud audit JSON import.
    File import
  • Harbor Registry CNCF
    Harbor artifact scan results (Trivy JSON) import for registry images.
    File import
  • Checkov Prisma Cloud (Palo Alto)
    Checkov IaC scan JSON (Terraform/CFN/K8s/ARM).
    File import
  • tfsec Aqua Security
    tfsec Terraform scan JSON.
    File import
  • KICS Checkmarx
    KICS IaC scan via SARIF export.
    File import
  • Terrascan Tenable
    Terrascan IaC scan via SARIF export.
    File import
  • kube-bench Aqua Security
    CIS Kubernetes benchmark JSON results.
    File import
04 · AppSec and code

AppSec and code 40

40 integrations in this category. Linked names have a detail page.

  • JFrog Xray JFrog
    Dependency and container security violations from JFrog Xray.
    Live API pull
  • Veracode Veracode
    Static and SCA findings from the Veracode platform; SARIF export import also supported.
    Live API pull File import
  • Checkmarx One Checkmarx
    SAST and SCA results from Checkmarx One.
    Live API pull
  • Mend.io Mend.io
    Open-source vulnerability findings from Mend.io; SARIF export import also supported.
    Live API pull File import
  • GitHub GitHub
    Dependabot alerts + Code Scanning + Secret Scanning across your org's repos.
    Live API pull
  • GitLab GitLab
    Vulnerability findings pull per project (Dependency/SAST/Secret scanning).
    Live API pull
  • Snyk Snyk
    Org-wide issues pull via Snyk REST API; SARIF file import also supported.
    Live API pull File import
  • SonarQube Sonar
    Vulnerability issues + security hotspots via Web API; SARIF import supported.
    Live API pull File import
  • SonarQube Cloud Sonar
    Open issues pulled live from a SonarQube Cloud project.
    Live API pull
  • Dependency-Track OWASP
    Portfolio findings pull across projects from your Dependency-Track server.
    Live API pull
  • DefectDojo OWASP
    Findings pull from your DefectDojo vulnerability-management server.
    Live API pull
  • npm audit npm
    npm audit --json (v2) dependency vulnerabilities.
    File import
  • Yarn audit Yarn
    yarn audit --json advisories.
    File import
  • pip-audit PyPA
    pip-audit JSON: Python dependency vulnerabilities.
    File import
  • cargo-audit RustSec
    cargo audit --json: Rust crate advisories.
    File import
  • Composer audit PHP Foundation
    composer audit --format=json PHP advisories.
    File import
  • govulncheck Go Team
    govulncheck -json Go vulnerability findings.
    File import
  • OSV-Scanner Google
    OSV-Scanner JSON across ecosystems.
    File import
  • Grype Anchore
    Grype JSON: container/filesystem dependency vulnerabilities.
    File import
  • Retire.js RetireJS
    retire --outputformat json: vulnerable JS libraries.
    File import
  • Dependency-Check OWASP
    OWASP Dependency-Check JSON report.
    File import
  • Semgrep Semgrep
    Open findings pulled live from the Semgrep AppSec Platform; native JSON import also supported.
    Live API pull File import
  • Bandit PyCQA
    Bandit JSON: Python SAST findings.
    File import
  • CycloneDX SBOM/VEX OWASP
    CycloneDX BOM with vulnerabilities[] (Syft, cdxgen, Trivy SBOM outputs).
    File import
  • Trivy Aqua Security
    Container/filesystem/repo scanning, built-in engine, plus JSON report import.
    File import Built-in engine
  • Gitleaks Gitleaks
    Gitleaks JSON: exposed secrets in repos (values redacted on import).
    File import
  • TruffleHog Truffle Security
    TruffleHog JSONL: verified secret detections (values redacted on import).
    File import
  • GitHub Advanced Security (CodeQL) GitHub
    Open code-scanning alerts pulled live for an org or repo; SARIF export import also supported.
    Live API pull File import
  • Checkmarx SAST Checkmarx
    Checkmarx One / CxSAST results via SARIF export.
    File import
  • Fortify OpenText
    Issues pulled live from Fortify SSC for a project version; SARIF export import also supported.
    Live API pull File import
  • Contrast Security Contrast
    IAST vulnerabilities pulled live from Contrast Security; SARIF export import also supported.
    Live API pull File import
  • Qwiet AI (ShiftLeft) Qwiet AI
    Qwiet preZero scan via SARIF export.
    File import
  • ESLint OpenJS
    ESLint security findings via @microsoft/eslint-formatter-sarif.
    File import
  • Brakeman Brakeman
    Rails SAST via brakeman --format sarif.
    File import
  • njsscan OpenSecurity
    Node.js SAST via --sarif output.
    File import
  • DevSkim Microsoft
    DevSkim linter findings via SARIF.
    File import
  • PSScriptAnalyzer Microsoft
    PowerShell analyzer findings via SARIF (ConvertTo-SARIF).
    File import
  • Bearer CLI Bearer
    Bearer security/privacy scan via --format sarif.
    File import
  • Codacy Codacy
    Codacy analysis via SARIF export.
    File import
  • Hadolint Hadolint
    Dockerfile lint findings via --format sarif.
    File import
05 · SIEM

SIEM 4

4 integrations in this category. Linked names have a detail page.

  • Rapid7 InsightIDR Rapid7
    Attacker-telemetry closed loop: IDR detections auto-pulled with each InsightVM sync and matched to your CVEs as observed exploitation.
    Live API pull
  • Splunk Enterprise Security Splunk (Cisco)
    Run a saved search or SPL query and ingest matching notable events.
    Live API pull
  • Microsoft Sentinel Microsoft
    Pull Sentinel incidents for a Log Analytics workspace.
    Live API pull
  • Elastic Security Elastic
    Pull open detection alerts from an Elastic Security cluster.
    Live API pull
06 · Threat intelligence

Threat intelligence 11

11 integrations in this category. Linked names have a detail page.

  • MISP MISP (OSS)
    Pull attributes from your MISP instance and correlate them against your estate.
    Live API pull
  • OpenCTI Filigran
    Pull indicators from OpenCTI over GraphQL and correlate them against your estate.
    Live API pull
  • Anomali ThreatStream Anomali
    Pull active intelligence from Anomali ThreatStream.
    Live API pull
  • AlienVault OTX LevelBlue
    Pull indicators from your subscribed OTX pulses.
    Live API pull
  • STIX / TAXII 2.1 Any TAXII server
    Pull a STIX 2.x bundle from any TAXII 2.1 collection.
    Live API pull
  • NVD NIST
    CVE metadata + CVSS enrichment with resilient daily sync.
    Built-in engine
  • CISA KEV CISA
    Known Exploited Vulnerabilities catalog, drives the KEV scoring layer.
    Built-in engine
  • EPSS FIRST.org
    Exploit Prediction Scoring System, probability layer in TRIS.
    Built-in engine
  • Exploit Intelligence CVEasy
    Public PoC / exploit-reference aggregation per CVE.
    Built-in engine
  • CVEasy Threat-Intel Bundles CVEasy
    Signed air-gapped .cvtab bundles: briefings, actors, CVE updates.
    Built-in engine
  • Signed IoC Bundles CVEasy
    Signed .btab IoC packs imported into the intel board.
    Built-in engine
07 · Assets and CMDB

Assets and CMDB 12

12 integrations in this category. Linked names have a detail page.

  • JumpCloud JumpCloud
    Managed systems from the JumpCloud directory.
    Live API pull
  • Microsoft Intune Microsoft
    Managed-device inventory + compliance state maps to assets and patch-management control coverage.
    Live API pull Outbound
  • NetBox NetBox Labs
    DCIM/IPAM device + VM inventory into canonical assets.
    Live API pull
  • Snipe-IT Snipe-IT
    Hardware asset inventory into canonical assets.
    Live API pull
  • ServiceNow CMDB ServiceNow
    Configuration items pulled live from the ServiceNow CMDB Table API, with business criticality; CSV import also supported.
    Live API pull File import
  • runZero runZero
    Discovered assets pulled live from a runZero organization; CSV import also supported.
    Live API pull File import
  • Lansweeper Lansweeper
    Discovered assets pulled live from Lansweeper Sites; CSV import also supported.
    Live API pull File import
  • Device42 Device42
    Device inventory pulled live from a Device42 appliance; CSV import also supported.
    Live API pull File import
  • Axonius Axonius
    Correlated device inventory pulled live from Axonius, naming which adapters saw each device; CSV import also supported.
    Live API pull File import
  • Jamf Pro (inventory) Jamf
    Managed Mac inventory pulled live from Jamf Pro: serial, MAC, OS and management state on every canonical asset.
    Live API pull
  • Kandji Kandji
    Managed Apple device inventory pulled live from Kandji.
    Live API pull
  • NinjaOne NinjaOne
    RMM device inventory across every client organisation, pulled live from NinjaOne.
    Live API pull
08 · External attack surface

External attack surface 4

4 integrations in this category. Linked names have a detail page.

  • Microsoft Defender EASM Microsoft
    Internet-facing assets discovered by Defender External Attack Surface Management.
    Live API pull
  • SecurityScorecard SecurityScorecard
    Issues for your own or a third-party scorecard, with the affected external host.
    Live API pull
  • Shodan Shodan
    Internet-exposed services + known-vuln banners for your IP space.
    Live API pull
  • Censys Censys
    Internet-wide host search for your assets and exposed services.
    Live API pull
09 · Network and web scanners

Network and web scanners 9

9 integrations in this category. Linked names have a detail page.

  • Nmap Nmap Project
    Network discovery, built-in engine, plus XML import.
    File import Built-in engine
  • Masscan Masscan
    masscan -oJ JSON port-scan import.
    File import
  • Burp Suite PortSwigger
    Burp Suite issue XML export import.
    File import
  • OWASP ZAP ZAP (Checkmarx)
    ZAP scan report XML import.
    File import
  • Nikto CIRT.net
    Nikto -Format json web-server scan import.
    File import
  • testssl.sh testssl.sh
    TLS/SSL configuration findings (--jsonfile) import.
    File import
  • SSLyze SSLyze
    SSLyze --json_out TLS scan import.
    File import
  • Acunetix Invicti
    Open DAST vulnerabilities pulled live from Acunetix; XML export import also supported.
    Live API pull File import
  • Invicti (Netsparker) Invicti
    Live DAST vulnerability pull; Invicti/Netsparker XML export import also supported.
    Live API pull File import
10 · Identity and access

Identity and access 3

3 integrations in this category. Linked names have a detail page.

  • Okta Okta
    MFA / sign-on policy posture maps to org-wide MFA control in the mitigation graph.
    Live API pull
  • Microsoft Entra ID Microsoft
    Conditional Access policy posture maps to org-wide MFA control in the mitigation graph.
    Live API pull
  • Have I Been Pwned HIBP
    Domain breach exposure: breached accounts for your domains as identity findings.
    Live API pull
11 · Mitigating controls

Mitigating controls 14

14 integrations in this category. Linked names have a detail page.

  • SafeBreach SafeBreach
    Import simulation runs and their prevented/detected outcomes, with SafeBreach's verdicts attributed to SafeBreach.
    Live API pull
  • AttackIQ AttackIQ
    Import assessment results from AttackIQ, attributed to AttackIQ.
    Live API pull
  • Cymulate Cymulate
    Import assessment findings from Cymulate, attributed to Cymulate.
    Live API pull
  • Pentera Pentera
    Import action results from a Pentera console, attributed to Pentera.
    Live API pull
  • Picus Security Picus
    Import threat simulation results from Picus, attributed to Picus.
    Live API pull
  • Imperva Cloud WAF Imperva (Thales)
    Protected sites and their WAF enforcement mode.
    Live API pull
  • Akamai App & API Protector Akamai
    Security configurations from Akamai App & API Protector.
    Live API pull
  • Cloudflare WAF Cloudflare
    Zone WAF posture maps to WAF control coverage for assets behind each zone.
    Live API pull
  • AWS WAF AWS
    WebACL inventory (wafv2) maps to WAF control coverage for protected resources.
    Live API pull
  • Control Inventory CSV CVEasy
    Operator-maintained control inventory: EDR/WAF/MFA/segmentation per asset, zone, or org-wide.
    Push ingest File import
  • Palo Alto NGFW (config import) Palo Alto Networks
    Firewall running-config import maps to firewall/segmentation controls in the mitigation graph.
    Push ingest File import
  • FortiGate (config import) Fortinet
    FortiOS config import maps to firewall/segmentation controls in the mitigation graph.
    Push ingest File import
  • pfSense (config import) Netgate
    config.xml import maps to firewall/segmentation controls in the mitigation graph.
    Push ingest File import
  • Cisco ASA (config import) Cisco
    ASA running-config import maps to firewall/segmentation controls in the mitigation graph.
    Push ingest File import
12 · Ticketing and ITSM

Ticketing and ITSM 5

5 integrations in this category. Linked names have a detail page.

  • Jira Atlassian
    Create/update remediation issues from findings and SLA breaches.
    Outbound
  • GitHub Issues GitHub
    Open remediation issues in the owning repo.
    Outbound
  • ServiceNow ITSM ServiceNow
    Create incidents/changes for remediation work.
    Outbound
  • Linear Linear
    Create remediation issues in Linear teams.
    Outbound
  • Monday.com monday.com
    Create remediation items on boards.
    Outbound
13 · Patch management

Patch management 5

5 integrations in this category. Linked names have a detail page.

  • Automox Automox
    Dispatch patch tasks to Automox policies/groups.
    Outbound
  • Tanium Tanium
    Dispatch patch/deploy actions to Tanium.
    Outbound
  • Jamf Pro Jamf
    Dispatch macOS patch policies via Jamf.
    Outbound
  • PDQ Deploy PDQ
    Dispatch package deployments via PDQ.
    Outbound
  • Patch Webhook (generic) CVEasy
    Send patch orders to any endpoint (SCCM runbooks, Ansible, custom).
    Outbound
14 · Notifications

Notifications 7

7 integrations in this category. Linked names have a detail page.

  • Slack Slack
    Finding/scan/SLA event notifications to channels.
    Outbound
  • Microsoft Teams Microsoft
    Event notifications to Teams channels.
    Outbound
  • Discord Discord
    Event notifications to Discord channels.
    Outbound
  • PagerDuty PagerDuty
    Page on-call for critical exposure events.
    Outbound
  • Webhooks (outbound) CVEasy
    Signed JSON events (bas.blocked_by_control, finding.created, …) to any URL.
    Outbound
  • Opsgenie Atlassian
    Open on-call alerts for critical exposure events; closed automatically when the fix is proven.
    Outbound
  • Google Chat Google
    Event notifications to Google Chat spaces.
    Outbound
15 · Automation, SOAR and CI

Automation, SOAR and CI 9

9 integrations in this category. Linked names have a detail page.

  • REST API / Generic Webhook CVEasy
    API-key'd push ingest for any tool: normalized JSON or raw scanner output.
    Push ingest Outbound
  • n8n n8n
    Workflow automation: push findings in, receive outbound events.
    Push ingest Outbound
  • Tines Tines
    SOAR stories: push findings in, receive outbound events.
    Push ingest Outbound
  • Torq Torq
    Hyperautomation: push findings in, receive outbound events.
    Push ingest Outbound
  • Zapier Zapier
    Zaps: push findings in, receive outbound events.
    Push ingest Outbound
  • GitHub Actions GitHub
    CI upload step: post SARIF/JSON scan output from workflows.
    Push ingest
  • GitLab CI GitLab
    CI upload step: post scan artifacts from pipelines.
    Push ingest
  • Jenkins Jenkins
    Pipeline upload step: post scan artifacts post-build.
    Push ingest
  • Azure Pipelines Microsoft
    Pipeline upload step: post scan artifacts from Azure DevOps.
    Push ingest
FAQ

Questions, answered.

The questions practitioners actually ask.

How many integrations does CVEasy AI have?

CVEasy AI ships 158 integrations across 15 categories. 135 bring findings and asset context in (78 live API connectors, 43 file imports, 14 push endpoints), 17 push work back out as ticketing, patch dispatch and notifications, and 6 are built-in data feeds. Every entry maps to a real, working path in the product; a catalog test enforces that in code.

Does CVEasy integrate with the scanner I already run?

Almost certainly. CVEasy consolidates Tenable, Qualys, Rapid7, Nessus, OpenVAS, CrowdStrike, Microsoft Defender, Wiz, Snyk, GitHub, Splunk, ServiceNow and many more. There is also a header-flexible CSV import that maps most scanner grid exports, so even a tool without a named connector usually imports.

Do I have to replace my existing tools?

No. CVEasy is designed to sit on top of the tools you already run, not replace them. It re-scores their output with TRIS 3 scoring and validates reachability, so the switch is additive. Keep your scanner; change the brain that prioritizes.

Where does the data from my integrations live?

On your own Apple Silicon Mac. CVEasy is local-first: the asset graph and the AI stay on-box, and the setup is air-gap capable. Only minimal licensing data touches the vendor side.

What if my tool is not listed?

Two paths usually cover it: the header-flexible CSV import maps most scanner exports (hostname, ip, cve, severity and port columns are auto-detected), and the API-keyed push ingest accepts normalized JSON or raw scanner output from any pipeline or workflow. Tell us what you run and we will point you at the right one.

Point CVEasy at the tools you already run.

One asset graph, one TRIS-ranked queue, on your own hardware.

Request a Demo → See public pricing

Mac-native · local-first · your data never leaves the box