Integrations ​

The Integrations view is a bring-your-own-key catalog of 58 security and workflow services you can connect, across:

  • Data & Threat Intel — threat-intel feeds, OSINT and recon sources, malware sandboxes, adversary-emulation and defensive TTP libraries, and vulnerability intelligence.
  • Internal / self-hosted tools — your own SIEM, log management, EDR, SOAR, and vulnerability-management platforms (Splunk, Elastic, CrowdStrike, Nessus, Wazuh, TheHive, OpenCTI, and more).
  • Ticketing — Jira, GitHub, GitLab, Linear, ServiceNow, PagerDuty, Asana, Azure DevOps, Zendesk.
  • Communication — Slack, Discord, Mattermost, Rocket.Chat.

The Integrations catalog: bring-your-own-key security data sources grouped by category — threat intel, OSINT, malware sandboxes, and vulnerability intelligence

How a connection works ​

Every integration is a direct connection. You supply the API URL and the exact credentials that service documents, and Hacker Sidekick opens its own TLS session straight to that URL. Nothing is relayed through us.

Credentials never reach the agent. They are held by the app and injected into each request in the background — the agent names an integration and a path, gets the response back, and never sees the key. It cannot ask for a credential, and it is explicitly prevented from calling these services itself with the terminal or scripts. Non-GET requests ask for your approval first.

What you'll be asked for ​

Each service asks for exactly what its API needs, so a two-part credential gets two boxes rather than one:

Example
API URLAlways present, pre-filled for hosted services (https://api.github.com) and blank for your own (https://splunk.internal:8089). Change it any time for a regional endpoint, a gov cloud, or an on-prem install.
A single key or tokenGitHub, Slack, GreyNoise, Snyk
Two keysTenable (access key + secret key), Datadog (API key + application key), IBM X-Force (key + password)
Username and passwordQualys, ServiceNow, Wazuh, TAXII
Email and API tokenJira, Zendesk
ID, secret, and org keyCarbon Black Cloud
Client ID and secretCrowdStrike, Microsoft Defender, Microsoft Sentinel — exchanged for a short-lived token automatically

Self-hosted and certificates ​

Services you run yourself also accept TLS material, because private CAs and self-signed certificates are normal on-prem:

  • a CA certificate to trust an internal issuer,
  • a client certificate and key for mutual TLS,
  • or, as a last resort, a skip verification toggle.

If a connection fails on the certificate, the error says which problem it hit and what to supply.

Test connection ​

Every integration has a Test connection button that runs a cheap, read-only probe with your saved credentials. It exercises the same URL, TLS, and authentication path a real call uses, so a green test means the agent's calls will authenticate too. A service saved with a credential still missing is marked incomplete and stays invisible to the agent until you finish it.

The full catalog ​

All 58 integrations, grouped the way the Integrations view groups them. Each is optional and off until you configure it — enable only what you use.

Data & Threat Intel ​

Threat Intelligence — AlienVault OTX · Anomali ThreatStream · GreyNoise · IBM X-Force Exchange · MalwareBazaar · PassiveTotal (RiskIQ) · Recorded Future · ThreatFox · URLhaus

OSINT — BuiltWith · DNSdumpster · Hunter.io · SecurityTrails

Malware Analysis — ANY.RUN · Hybrid Analysis

TTPs — CALDERA · MITRE D3FEND

Vulnerability Intelligence — Qualys VMDR · Rapid7 InsightVM · Snyk · Tenable Vulnerability Management

Vulnerability Management — Nessus

Internal / Self-hosted ​

SIEM Platforms — Elastic Security · IBM QRadar SIEM · LogRhythm SIEM · Microsoft Sentinel (Log Analytics) · Splunk · Sumo Logic

Log Management — Datadog · Graylog · Loki (Grafana Loki) · New Relic

EDR Platforms — Carbon Black Cloud · CrowdStrike Falcon · Microsoft Defender for Endpoint · SentinelOne

Vulnerability Management — Wazuh

Security Information Sharing — TAXII Server

Threat Intelligence Platforms — MISP · OpenCTI

Security Orchestration (SOAR) — Cortex XSOAR · Shuffle · Splunk SOAR (Phantom) · TheHive

Network Security — pfSense (requires the pfSense-pkg-RESTAPI package)

Ticketing ​

Asana · Azure DevOps · GitHub · GitLab · Jira · Linear · PagerDuty · ServiceNow · Zendesk

Interaction ​

Communication — Discord · Mattermost · Rocket.Chat · Slack

Also built in

Core threat-intel tools — MITRE ATT&CK, NVD/CVE, VirusTotal, Shodan, Censys, and Exploit-DB — ship ready to use through the built-in public-intel MCP server, so they need no key and aren't part of this bring-your-own-key catalog.

Working with the catalog

A few services are deliberately absent because they cannot be reached as a direct API connection: local tools and rule formats with no HTTP interface (Snort, Suricata, Zeek, YARA, Sigma, Atomic Red Team), and services whose authentication cannot be automated from stored credentials. If you need one of these, drive it from the terminal or connect it as an MCP server.

See also ​

Hacker Sidekick documentation