Integrations: Complass comes to your team, not the other way around

Complass reads members, teams and rights of your GitHub organisation for access reviews and checks settings such as 2FA or branch protection as evidence.

GitHub organisation→toIdentities and access

Connection

Your own GitHub app, installed on one organisation on GitHub.com, with read permissions only.

Direction

Read only. Complass refuses apps with write or admin permissions.

Which data

• Members with role and 2FA status, outside collaborators, teams and their repositories.
• Optional: direct repository rights from write access upwards.
• For evidence only switches and figures, such as required 2FA, branch protection, secret scanning and Dependabot.

In Complass

Identities and access, access reviews and evidence at the matching requirements of your frameworks.

How often

Daily, or every six hours or weekly if you prefer. The first run is a preview.

What you set up

Create and install the GitHub app with read permissions on members, organisation administration and repository metadata.

Data protection

No code, issues, pull requests, secrets or e-mail addresses. The app's private key is stored encrypted in Complass.

Complass posts important events to your Teams channels.

Event in Complass→toCard in Teams

Connection

Through a Teams workflow whose address you enter in Complass.

Direction

Complass sends messages. Nothing comes back from Teams.

Which data

Messages about incidents and reporting deadlines, new vulnerabilities, due and assigned tasks, pending approvals, evidence, backups, certificates and other events

In Complass

In the chosen Teams channel, as a card with a link to the entry in Complass.

How often

Right when the event happens. Many messages in a short time are combined into one summary.

What you set up

No Microsoft Graph permission and no app registration.

Data protection

Complass reads no Teams messages. You decide how much content a message shows. Whistleblower reports never appear in Teams.

Complass posts important events to your Slack channels.

Event in Complass→toMessage in Slack

Connection

Through the webhook of a Slack app in your workspace. Complass shows you the ready-made template for the app.

Direction

Complass sends messages.

Which data

Messages about incidents and reporting deadlines, new vulnerabilities, due and assigned tasks, pending approvals, evidence, backups, certificates and other events

In Complass

The Slack channel you choose. Every message links back to the entry in Complass.

How often

Right when the event happens. Many messages in a short time are combined into one summary.

What you set up

Create the Slack app from the template, choose a channel and enter the webhook address in Complass.

Data protection

The webhook address is stored encrypted in Complass. Complass reads no Slack messages. You decide how much content a message shows.

Tasks from Complass become Jira issues. Status, comments and assignees come back.

Task in Complass⇄both waysIssue in Jira

Connection

Jira Cloud through OAuth 2.0, that is a sign-in at Atlassian. Jira Data Center through a personal access token.

Direction

Both directions.

Which data

• To Jira: title, deadline, priority and the control reference. The description only if you choose so.
• From Jira: status, comments and assignee.

In Complass

Action plan. When Jira reports "done", the responsible person confirms in Complass, so the evidence stays a human decision.

How often

Handover with one click or by a rule you set. Updates come back about every five minutes.

What you set up

Cloud: consent at Atlassian to read and create issues and to read users. Data Center: a technical user with an access token, the server reachable from the internet over HTTPS.

Data protection

Access tokens are stored encrypted in Complass. No attachments, no evidence documents. Tasks from whistleblower reports and data breaches never go to Jira.

Tasks and, if you wish, incidents from Complass become ServiceNow tickets. Status, assignees and notes come back.

Task or incident⇄both waysIncident or change in ServiceNow

Connection

OAuth client in your own ServiceNow instance.

Direction

Both directions.

Which data

• To ServiceNow: short description, description if you choose so, impact, urgency, deadline and assignment group.
• From ServiceNow: state, assignee, work notes and comments.
• Coming soon from the CMDB: serial number, asset tag, name and network addresses to match your assets.

In Complass

Action plan and incidents. Coming soon: the CMDB match suggests pairs that a person confirms. Complass never creates assets from the CMDB.

How often

Handover with one click, in bulk or by rule. Updates about every five minutes.

What you set up

An integration user with its own role, which Complass provides as an update set: create and change tickets, never delete. No admin role.

Data protection

Credentials are stored encrypted in Complass. Comments are only sent when their author ticks the box. Whistleblower reports and data breaches never go to ServiceNow.

Complass reads accounts, roles and groups from your Microsoft Entra ID for access reviews and checks key security settings as evidence.

Microsoft Entra ID→toIdentities and access

Connection

Your own app registration in your tenant with read permissions only. This direct connection replaces the Entra ID file import.

Direction

Read only. Complass refuses access with write permissions.

Which data

• Accounts: display name, sign-in name, enabled or disabled, member or guest.
• Role assignments, eligible roles from PIM and the groups you select.
• Optional: last sign-in and whether MFA is registered.
• For evidence only figures, such as the share with MFA, conditional access rules and the number of global admins.

In Complass

Identities and access, access reviews and checks for orphaned accounts. The evidence appears at the matching requirements of your frameworks.

How often

Daily, or every six hours or weekly if you prefer. The first run is a preview.

What you set up

Application permissions with admin consent, for example User.Read.All, GroupMember.Read.All and RoleManagement.Read.Directory. A secret with an expiry date; Complass reminds you in time.

Data protection

No phone numbers, addresses, sign-in logs, IP addresses or mailbox data. Evidence contains no names. The secret is stored encrypted in Complass.

Complass reads how many Microsoft 365 licences you have and how many are assigned, and reconciles that with your contracts.

Microsoft 365 licences→toContracts

Connection

Your own app registration in your tenant with a single read permission.

Direction

Read only. Any further permission makes Complass pause the connection.

Which data

Per product: name, purchased and assigned licences, state.

In Complass

Contract management: licence reconciliation between purchased and used.

How often

Daily, or every six hours or weekly if you prefer.

What you set up

Application permission LicenseAssignment.Read.All or Organization.Read.All with admin consent.

Data protection

Only figures per product, no names of licensed people.

Upload your Nessus scans as a file. Complass assigns the vulnerabilities to your assets.

Nessus export→toVulnerabilities per asset

Connection

File upload in .nessus format, also compressed, up to 50 MB.

Direction

Import only. Complass does not connect to the tool.

Which data

• Per host: name and IP address.
• Per finding: CVE or Nessus plugin, title, port, severity and CVSS score. Pure information items without a CVE are not taken over.

In Complass

Vulnerability management. A preview shows per host which asset matches and what is new. An import can be undone.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass does not read plugin output or solution texts. Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Upload reports from Greenbone or OpenVAS. Complass assigns the vulnerabilities to your assets.

Greenbone report→toVulnerabilities per asset

Connection

File upload of the report in XML format, up to 50 MB.

Direction

Import only. Complass does not connect to the tool.

Which data

Per finding: host with IP address and name, CVE or test, title, port and severity.

In Complass

Vulnerability management. A preview shows per host which asset matches and what is new. An import can be undone.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. You export the file and upload it.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Upload Trivy results for container images, repositories or file systems, by hand or from your CI through the API.

Trivy report→toVulnerabilities per component

Connection

File upload in JSON format or automatically through the Complass API.

Direction

Import only. Complass does not connect to the tool.

Which data

• Per finding: CVE, title, severity, CVSS score, package with version and package URL, and the fixed version.
• Complass does not read misconfigurations or detected secrets from the file.

In Complass

Vulnerability management, with component and version at the asset.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. For CI an API key with write access to vulnerabilities.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Upload Grype results, by hand or from your CI through the API.

Grype report→toVulnerabilities per component

Connection

File upload in JSON format or automatically through the Complass API.

Direction

Import only. Complass does not connect to the tool.

Which data

Per finding: CVE, severity, CVSS score, package with version, package URL and CPE, and fixed versions.

In Complass

Vulnerability management, with component and version at the asset.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. For CI an API key with write access to vulnerabilities.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Upload ZAP reports to track findings from web application scans.

ZAP report→toVulnerabilities per application

Connection

File upload in JSON or XML format or automatically through the Complass API.

Direction

Import only. Complass does not connect to the tool.

Which data

Per site: host. Per alert: name, risk level and CVE if given. Pure information items are not taken over.

In Complass

Vulnerability management. A preview shows per host which asset matches and what is new. An import can be undone.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. You export the file and upload it.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Upload Nuclei results. Complass assigns the matches to your assets.

Nuclei result→toVulnerabilities per asset

Connection

File upload in JSONL format, one line per match.

Direction

Import only. Complass does not connect to the tool.

Which data

Per match: host, IP address, template, name, severity and CVE if given.

In Complass

Vulnerability management. A preview shows per host which asset matches and what is new. An import can be undone.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. You export the file and upload it.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Take findings from a Burp Suite pentest into an audit report and track them until the retest.

Burp issues export→toFindings in the pentest report

Connection

File upload of the issues export in XML format when importing a pentest report, up to 50 MB.

Direction

Import only. Complass does not connect to the tool.

Which data

Per finding: title, severity, location, description, recommendation and CWE.

In Complass

Pentest and audit reports: findings with deadline, owner, task and retest. A finding is closed only after the retest.

How often

One upload per report.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass never reads requests and responses from Burp, because they can contain session data.

Build or update your asset inventory from an Nmap scan.

Nmap scan→toAssets and services

Connection

File upload of the Nmap XML output.

Direction

Import only. Complass does not connect to the tool.

Which data

Per reachable host: IP and MAC address, name, open ports with service and version, detected operating system.

In Complass

Asset management. Detected software feeds the match with known vulnerabilities. A preview shows new, changed and conflicting entries.

How often

With every upload. A scan does not overwrite values you maintained by hand.

What you set up

Nothing. Active scans can disturb sensitive controllers; for OT networks the help recommends a reachability scan only.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Take over the hardening checks (SCA) from Wazuh and see per asset how well it meets your baseline.

Wazuh SCA result→toHardening per asset

Connection

File upload of the SCA results in JSON format or automatically through the Complass API.

Direction

Import only. Complass does not connect to the tool.

Which data

Per check: ID, title, result, policy and references.

In Complass

Hardening: result per asset and baseline, with score and exceptions. Complass does not take over Wazuh alerts or detections.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass stores no commands, files, registry keys or measured values from the checks.

Take over your Sigma rules as use cases and see which ATT&CK techniques they cover.

Sigma rules→toUse cases

Connection

File upload of single YAML files or a ZIP archive of a rule folder, up to 5,000 rules.

Direction

Import only. Complass does not connect to the tool.

Which data

Per rule: title, ID, status, level, description, ATT&CK tags and log source.

In Complass

Detection: use cases and ATT&CK coverage.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass does not read the detection part of the rules.

Prove your backups with the job results from Veeam.

Veeam job report→toBackup evidence

Connection

File upload of the job report as CSV, or a script on your side that sends the results to the Complass API.

Direction

Import only. Complass has no access to Veeam.

Which data

Per run: job name, end time, result and optionally the size.

In Complass

Backup and recovery: jobs, runs and their assets. Complass reports a failed backup.

How often

With every upload or as often as your script runs.

What you set up

Nothing for the upload. For the script an API key for the evidence source.

Data protection

Metadata only. No backup content, no paths with user names, no passwords.

Upload reports from OWASP Dependency-Check, by hand or from your CI through the API.

Dependency-Check report→toVulnerabilities per library

Connection

File upload in JSON format or automatically through the Complass API.

Direction

Import only. Complass does not connect to the tool.

Which data

Per library: file name, package URL and CPE. Per finding: CVE, severity and CVSS score.

In Complass

Vulnerability management, with the component at the asset.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. For CI an API key with write access to vulnerabilities.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Discover devices, services and connections in your network from Zeek logs.

Zeek logs→toAssets and connections

Connection

File upload of the conn, known_hosts, known_services, dhcp and software logs, as TSV or JSON, also compressed.

Direction

Import only. Complass does not connect to the tool.

Which data

Hosts with IP and MAC address and names, services, software, first and last seen, and observed connections between hosts.

In Complass

Asset management with the connections between assets. A preview shows new and changed entries.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass takes only devices, services and connections, no content of the communication. Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Show which detection rules and log sources you run in Microsoft Sentinel, without handing log data to Complass.

Microsoft Sentinel→toUse cases and log sources

Connection

File upload: export of the analytics rules as JSON or ARM template, and the result of two fixed queries as CSV.

Direction

Import only. Complass does not connect to the tool.

Which data

• Per rule: name, ID, severity, enabled or not and ATT&CK techniques.
• Per table: name and time of the last event.

In Complass

Detection and logging: use cases, ATT&CK coverage and log sources. If a source goes silent, Complass reports it.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass discards the rule queries. Metadata only. Complass stores no content from logs, queries or results.

Show which detection rules you run in Elastic and which ATT&CK techniques they cover.

Elastic rule export→toUse cases

Connection

File upload of the rule export in NDJSON format.

Direction

Import only. Complass does not connect to the tool.

Which data

Per rule: name, ID, severity, enabled or not, ATT&CK techniques and indices used.

In Complass

Detection: use cases and ATT&CK coverage. A preview shows new and known rules.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass discards the rule queries. Metadata only. Complass stores no content from logs, queries or results.

Take over accounts from Microsoft Entra ID by file, without any app registration.

Entra user export→toAccounts

Connection

File upload of the user export from the Entra admin centre, optionally with the MFA registration export.

Direction

Import only. For a daily sync there is the direct Entra ID connection.

Which data

Sign-in name, display name, enabled or disabled, member or guest. Optional: MFA registered and admin role.

In Complass

Identities and access and access reviews. If an account is missing from a later file, Complass marks it removed only after you confirm.

How often

With every upload.

What you set up

Nothing. You only need an Entra role that may download users.

Data protection

Complass drops all other columns before storing. Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.

Take over accounts from your Active Directory with a read-only PowerShell command.

AD export→toAccounts

Connection

File upload of a CSV file created by a PowerShell command. Complass shows you the command.

Direction

Import only. Complass does not connect to your directory.

Which data

• Account name, display name, sign-in name or e-mail, enabled or not, last sign-in.
• Whether an account is privileged, for example as domain admin, or a service account.

In Complass

Identities and access and access reviews.

How often

With every upload.

What you set up

Nothing. The command only needs read access to the directory.

Data protection

Group memberships only decide the "privileged" flag and are not stored.

Prove your backups with the job results from Azure Backup.

Azure Backup report→toBackup evidence

Connection

File upload of the backup report as CSV.

Direction

Import only. Complass has no access to Azure.

Which data

Per run: backup item, time and result.

In Complass

Backup and recovery: jobs, runs and their assets.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Metadata only. No backup content.

Read software bills of materials (SBOM) in CycloneDX format and issue them for your products.

SBOM file⇄both waysComponents and vulnerabilities

Connection

File upload and export, as JSON or XML.

Direction

Both directions.

Which data

• Import (version 1.4 to 1.6): components with version, package URL, licence and hashes, plus vulnerabilities and VEX assessments.
• Export (version 1.6): SBOM per asset or own product and CycloneDX VEX with the status of every vulnerability.

In Complass

The asset's software list, vulnerability management and licence overview. Complass takes over assessments such as "not affected" or "fixed".

How often

With every upload or export. Saved SBOM snapshots can be compared.

What you set up

Nothing. Exporting needs the "Export" right in asset management.

Data protection

An SBOM leaves Complass only when you export or release it.

Take over your suppliers' assessments in OpenVEX format, for example that a product is not affected by a vulnerability.

OpenVEX document→toVulnerability status

Connection

File upload or the Complass API.

Direction

Import only.

Which data

Per statement: vulnerability, product, status and justification.

In Complass

Vulnerability management: status of matching findings. The import does not overwrite an assessment you set yourself.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Read vendor security advisories in CSAF format and issue your own advisories and VEX in CSAF.

CSAF advisories⇄both waysVulnerabilities and assets

Connection

Automatic retrieval of public advisories from vendors that offer CSAF, plus file upload and export.

Direction

Both directions.

Which data

• Import: CSAF 2.0 security advisories and VEX. Complass checks signature and hash; an advisory that fails the check is not used.
• Export: CSAF VEX from your findings and customer notices under the Cyber Resilience Act.

In Complass

Vendor advisories matched against your assets by vendor, model and version. Matches become findings.

How often

Retrieval regularly per enabled source, upload and export at any time.

What you set up

Nothing. You switch the sources on or off in Complass.

Data protection

Complass retrieves only public advisories and sends no data about your assets.

Take over hardening checks from tools such as OpenSCAP or CIS-CAT in XCCDF format.

XCCDF result→toHardening per asset

Connection

File upload of XCCDF 1.1 or 1.2 and ARF, up to 100 MB, or through the Complass API.

Direction

Import only.

Which data

Per rule: ID, title and result.

In Complass

Hardening: result per asset and baseline. If no matching baseline exists, Complass creates it.

How often

With every upload.

What you set up

Nothing. You export the file and upload it.

Data protection

Complass does not read check details or system facts from the file.

Complass includes MITRE ATT&CK for IT and OT: as a framework, as a coverage map and as a reference for vulnerabilities, incidents and risks.

MITRE ATT&CK→toCoverage and references

Connection

Complass loads the public ATT&CK data itself. You do not need to import anything.

Direction

Complass reads public data. Exports as Excel, CSV, PDF or JSON.

Which data

Tactics, techniques, mitigations and data sources for Enterprise and ICS.

In Complass

Coverage map, detection map from your use cases, techniques at vulnerabilities, incidents and risks.

How often

Updated monthly.

What you set up

Nothing. You choose whether you see Enterprise, ICS or both.

Data protection

None of your data leaves Complass for ATT&CK.

Read and issue software bills of materials in SPDX format, also in the version BSI TR-03183-2 asks for.

SPDX file⇄both waysComponents

Connection

File upload and export.

Direction

Both directions.

Which data

• Import: SPDX 2.2 and 2.3 as JSON.
• Export: SPDX 2.3 as JSON and SPDX 3.0.1 as JSON-LD.

In Complass

The asset's software list and the match with known vulnerabilities.

How often

With every upload or export.

What you set up

Nothing. Exporting needs the "Export" right in asset management.

Upload results from code scanners in SARIF format, by hand or from your CI through the API.

SARIF report→toVulnerabilities

Connection

File upload in SARIF 2.1.0 format or automatically through the Complass API.

Direction

Import only.

Which data

Per finding: tool, rule, message, level, severity and location.

In Complass

Vulnerability management.

How often

With every upload. If a new scan no longer reports a finding, Complass closes it automatically.

What you set up

Nothing. For CI an API key with write access to vulnerabilities.

Data protection

Between upload and adoption only the parsed data is kept, encrypted, for at most 24 hours.