Qualys VM
LIVE APICloud, every platform pod. Native tags sync into region and asset type.
qualysEvery edition
Integrations
25 connectors, not just scanners.
Vulnerability scanners, endpoint and cloud agents, code security, penetration tests, bug bounty, attack surface, patch confirmation, vendor risk and the CMDB land in one queue. The same finding from two tools collapses to one identity. Eight of these sources can prove a fix on a host.
Each card names the editions that include it. Compare editions →
Scanners, agents and cloud
Verifying sources
The eight sources whose rescan or sensor reassessment can prove a fix on a host. Absence counts only on assets the pass actually assessed.
Tenable
LIVE APIVulnerability Management including FedRAMP, Security Center, or Nessus Professional, Expert and Manager.
tenableEvery editionOpenVAS / Greenbone
LIVE APICommunity Edition and Enterprise appliances, GMP over TLS on port 9390.
openvasEvery editionRapid7 InsightVM
LIVE APISecurity Console (API v3) or the Insight Platform (integration API v4).
rapid7Every editionMicrosoft Defender Vulnerability Management
LIVE APIDevices and their software vulnerabilities, with Defender's exploitability level. Commercial and US government clouds.
defender_vmProfessional · EnterpriseCrowdStrike Falcon Spotlight
LIVE APIHosts and open Spotlight vulnerabilities, with exploit status, the CISA KEV flag and the remediation.
crowdstrike_spotlightProfessional · EnterpriseAmazon Inspector
LIVE APIFindings on EC2 instances, ECR images and Lambda functions, per region, with coverage.
aws_inspectorProfessional · EnterpriseWiz
LIVE APIVulnerability findings on cloud workloads, with EPSS, exploit and KEV flags.
wizProfessional · EnterpriseCode and cloud
Code-level and cloud findings
SAST, SCA, secrets and cloud posture alongside host findings. A code platform closes its own finding when the default branch's next analysis no longer has it; that proves the code changed, nothing about a host.
GitHub Advanced Security
LIVE APICode scanning, Dependabot and secret scanning alerts, per repository. GitHub.com or Enterprise Server.
github_securityProfessional · EnterpriseGitLab Security
LIVE APIThe group's vulnerability report: SAST, dependency, container, secret detection and DAST.
gitlab_securityProfessional · EnterpriseSnyk
LIVE APIOpen Source, Code, Container and IaC issues, grouped by repository, with Snyk's risk score.
snykProfessional · EnterpriseSARIF import
FILEAny SARIF 2.1.0 producer: CodeQL, Semgrep, Snyk and others.
sarif_importEvery editionAWS Security Hub
FILEASFF exports covering Inspector, GuardDuty and IAM Access Analyzer.
asff_importEvery editionAttack surface
External attack surface
Internet-facing exposures get their own prioritised queue.
Patrowl
LIVE APISelf-hosted PatrowlManager or Patrowl SaaS.
patrowlProfessional · EnterprisewatchTowr Platform
LIVE APICloud platform, API key.
watchtowrProfessional · EnterpriseEASM import
FILEAny external attack surface export.
easm_importEvery editionBloodHound
API · FILEActive Directory attack paths from BloodHound CE or a SharpHound ZIP, and attack path findings from a BloodHound Enterprise tenant.
bloodhound_apiProfessional · EnterprisePatch deployment
Patch confirmation
Evidence that a patch was deployed. Not proof the vulnerability is gone.
Microsoft Intune
LIVE APICommercial, GCC, GCC High, DoD and 21Vianet clouds.
intuneEvery editionWSUS / SCCM / Ansible
FILEDeployment reports from your existing patch tooling.
patch_deployment_importEvery editionPeople and vendors
Penetration tests, bug bounty and third parties
Findings that did not come from your own scanners, in the same register and on the same scale.
Penetration tests
FILE · REPORTThe tester's findings export (JSON or CSV), or the PDF or Word report read by AI into findings a person accepts. A finding that matches a scanner's joins it as a second report. Engagements and retests are in the paid editions.
pentestEvery editionBug bounty import
FILEHackerOne and Bugcrowd API exports as saved; Intigriti and others in the flat format.
bugbounty_importEvery editionSecurityScorecard
LIVE APIVendor risk by portfolio ID or domain list.
securityscorecardProfessional · EnterpriseInventory
CMDB
Which computers exist and who owns them. A CMDB proves nothing about vulnerabilities: a computer it lists that no scanner reached reads unknown, never clean.
ServiceNow CMDB
LIVE APIComputers from cmdb_ci_computer, with owner, support group, location and environment as tags.
servicenow_cmdbEnterpriseCMDB import
FILEA computers export from GLPI, iTop, Lansweeper, NetBox or a spreadsheet, as CSV or JSON.
cmdb_importEvery editionAnything else
Generic and community
When none of the above fits.
CSV / JSON import
FILEAssets, vulnerabilities and KB files from any tool or a pentest report.
csv_importEvery editionCustom connector
CODECommunity connectors built on the shared base class.
custom
What a source can prove
Deployment is not remediation.
A patch report from WSUS, SCCM, Intune or Ansible says a patch was deployed. Only a verifying scanner's rescan says the vulnerability is gone, and PYXA only uses a run that covered what it claims to: an incremental Tenable run, a Rapid7 run with unreadable assets and hosts a scan did not reach are never read as fixed.
CVE-2026-21445 · 9 of 34 hosts proven fixed25 unproven
Tickets, webhooks, API.
Jira tickets in every edition, GLPI and TheHive in Professional and Enterprise, and ServiceNow in Enterprise are created, refreshed and closed as remediations move. Webhooks emit claims, status changes, tickets and escalations, and a token-authenticated API serves CI/CD.
Write a connector.
Every connector implements one base class. The connector development guide walks through it, and file connectors accept pushes from a pipeline with a per-connector upload key.
Connector development guide →