Integrations
Works with your stack
Prava AI connects to the tools you already run through open standards, documented APIs and connectors. Findings go where your team works, and data stays in your region.
Methods
How Prava AI connects
Most integrations use a standard protocol rather than a bespoke link. That keeps them predictable, auditable and easy to replace.
API
REST API
JSON over HTTPS, authenticated with API keys or OAuth 2.0 client credentials. Pull findings, push telemetry and manage cases.
Events
Webhooks
Signed outbound events for new detections, case changes and scan results, with retries on failure.
Logs
Syslog, CEF and LEEF
Stream alerts and events to log platforms in the formats they already parse, or send logs to Prava AI for analysis.
Intelligence
STIX and TAXII 2.1
Share and consume indicators and threat objects in a structured, standard format.
Sign-in
SAML 2.0 and OIDC
Single sign-on through your identity provider, so access follows your existing policies.
Provisioning
SCIM 2.0
Create, update and remove users and groups automatically from your directory.
Journaling and mail APIs
Email journaling, Microsoft Graph and the Gmail API give phishing defence the message context it needs.
Cloud
Cloud provider APIs
Read-only roles and audit logs for posture, asset discovery and monitoring across cloud accounts.
Telemetry
OpenTelemetry
Receive traces, metrics and logs from applications and servers already instrumented with OpenTelemetry.
Categories
Typical targets by category
Each product below is reached through one of the methods above, or through a connector where one is available for your plan.
Note. Availability of specific connectors varies by plan; confirm with us. Custom connectors are available on the Ultra Max plan, as listed on the pricing page. Product names are listed only as integration targets. All trademarks belong to their respective owners, and no partnership, endorsement or official listing is implied.
| Category | Typical targets | How they are reached |
|---|---|---|
| SIEM | Splunk, Microsoft Sentinel, IBM QRadar, Elastic, Google SecOps | Syslog, CEF or LEEF forwarding; REST API pull; webhooks; or a connector |
| SOAR and ticketing | Palo Alto Cortex XSOAR, ServiceNow, Jira, PagerDuty | Webhooks to create and update incidents or tickets; REST API for enrichment and response actions; or a connector |
| Cloud | AWS, Microsoft Azure, Google Cloud | Cloud provider APIs with read-only roles and audit log access |
| Identity | Okta, Microsoft Entra ID, Google Workspace | SAML 2.0 or OIDC for sign-in; SCIM 2.0 for provisioning; identity logs through provider APIs |
| Microsoft 365, Google Workspace | Email journaling, Microsoft Graph or the Gmail API | |
| Collaboration | Slack, Microsoft Teams | Webhooks for alerts and case updates to channels you choose; or a connector |
| EDR co-existence | CrowdStrike, Microsoft Defender, SentinelOne | The Prava AI agent is designed to run alongside these tools. Their alerts can be ingested through syslog, REST API or a connector |
| Code and CI | GitHub, GitLab, Bitbucket | Webhooks and REST API to trigger scans and post results to pipelines and pull requests; or a connector |
| Vulnerability tools | Tenable, Qualys | REST API import of scan results for correlation with attack-surface findings; or a connector |
| Threat-intel platforms | MISP, OpenCTI | STIX and TAXII 2.1 in both directions; REST API |
| Compliance and GRC | [GRC platforms to name] | Compliance evidence API and webhooks to export control evidence. See compliance for the frameworks the platform is designed to align with |
| OT | Modbus, DNP3, OPC UA | Protocols passively observed from network traffic. Prava AI reads them without writing to controllers |
| VoIP and comms | Cisco Unified Communications, Asterisk, FreePBX, SIP trunks | SIP / RTP passive network inspection, PBX configuration audit connectors, and toll fraud anomaly detection |
| Satellite and RF | Inmarsat, Iridium, Starlink Enterprise, VSAT terminals | Ground station and terminal telemetry feeds via REST API, syslog, and RF spectrum anomaly monitors |
| Connected vehicles | Automotive telematics control units (TCU), in-vehicle IVI, CAN bus gateways | CAN bus message log ingestion, ECU firmware integrity audits via edge Agent or MQTT/REST bridge (UN R155 / ISO/SAE 21434) |
Data flow
How data moves, and where it stays
Integrations follow the same residency rule as the rest of the platform.
- Data enters through a regional endpoint for your account, over encrypted connections.
- It is stored and processed only in data centres in your own region.
- Outbound integrations send only what you configure: the event types, fields and destinations you choose.
- Credentials for connected tools are designed to be stored encrypted and scoped to the least access the integration needs.
- Data sent to a third-party tool is then governed by that tool's terms and location. Check those before you connect it.
For details, see the Data Processing Addendum, the AI data use policy and security.
Build
Build your own
If a connector does not exist for your tool, the API and webhooks cover the same ground.
API
Read and write through REST
Versioned endpoints, regional base URLs and documented rate limits. Start in the sandbox, then move to production keys.
Webhooks
React to events
Subscribe to the events you need and verify each delivery's signature before acting on it.
Reference, guides and examples are in the developer docs. API usage is billed as set out on API pricing. Questions about building go to developers@prava.dev.
Request
Request an integration
Need a tool that is not listed, or a connector rather than a standard method? Email hello@prava.dev with the product name, the version you run, the direction of data you need, and your plan. We will tell you which method fits and whether a connector is available.
FAQ
Questions
Are you a partner of the vendors listed?
No partnership, endorsement or official listing is implied. The products are named as targets that can be reached through standard methods or connectors. Trademarks belong to their owners.
Which integrations are included in my plan?
Standard methods such as the REST API, webhooks, syslog and SSO are part of the platform. Availability of specific connectors varies by plan; confirm with us. Custom connectors are available on Ultra Max.
Do I have to replace my EDR?
No. The Prava AI agent is designed to run alongside existing endpoint tools, and their alerts can be brought into Prava AI for correlation.
Does Prava AI write to OT devices?
No. OT protocols such as Modbus, DNP3 and OPC UA are observed passively from network traffic.
Does connecting a tool move my data out of region?
Data held by Prava AI stays in your region. Data you choose to send to a third-party tool goes wherever that tool stores it, so review its terms before connecting.
Is integration API usage billed?
Metered API calls are billed as set out on API pricing. Webhook deliveries are included.
Next step
Map Prava AI to your stack
Tell us what you run today. We will show you how each tool connects and what your plan includes.