Integrations
QScout workflow connectors deliver findings into Jira, ServiceNow, and webhooks so security teams can open tickets from assessment results.
Honest operating limits
Connectors are one-way creation today: QScout opens or updates tickets outbound. They are dry-run by default (dry_run=true). Live HTTP requires operator configuration (base URL and auth header). Bidirectional ticket-driven state and non-dry write-back are on the Workflow 10 path; do not assume automatic reopen from Jira without that capability deployed and configured for your tenant.
1. Jira field mapping
Source: connectors/jira.py · connector id workflow.jira
| Field | Source |
|---|---|
| project.key | connector project_key (default SEC) |
| summary | finding.title or finding_id |
| description | finding.description or empty string |
| issuetype.name | Bug |
| labels | ["qscout", "post-quantum", severity_lower or "unknown"] |
| qscout_envelope_hash | SHA-256 of envelope body (correlation key) |
Live create: POST {base}/rest/api/3/issue with Authorization header. Dry-run returns JIRA-DRY-{hash8} without network I/O.
2. ServiceNow field mapping
Source: connectors/servicenow.py · connector id workflow.servicenow
| Field | Source |
|---|---|
| short_description | finding.title or finding_id (max 160 chars) |
| description | finding.description |
| urgency | CRITICAL/HIGH→1, MEDIUM→2, else→3 |
| u_qscout_finding_id | envelope finding_id |
| u_qscout_envelope_hash | envelope hash (correlation key) |
Live create: POST {instance}/api/now/table/{table} (default table incident). Dry-run returns SNOW-DRY-{hash8}.
3. Webhook envelope schema
Source: connectors/base.py envelope(). The hash field is the correlation key for idempotency and write-back.
{
"schema": "qscout.workflow.finding-envelope.v1",
"connector_id": "workflow.jira",
"finding_id": "F-TLS-001",
"title": "Weak TLS ciphers on api.example.com",
"severity": "HIGH",
"target": "api.example.com:443",
"hndl_score": 72,
"delivered_at": "2026-07-28T22:00:00+00:00",
"hash": "8955ba98b58b605684c1ee0984bbff4594fb49033a30f06793bd09d5e720c599"
}Hash input is canonical JSON of the envelope body with sorted keys (excluding the hash field itself), SHA-256 hex digest.
4. Closed-loop sequence
Source: workflow/closed_loop.py run_closed_loop()
- 1. Finding
QScout emits a finding with id, title, severity, target, and optional HNDL score.
- 2. Ticket create
JiraConnector or ServiceNowConnector delivers via deliver() with dry_run default true. Live HTTP requires operator-configured base URL and auth header.
- 3. Poll status
Ticket status is polled (or synthesized in dry-run). Correlation uses the envelope hash, not a second identifier.
- 4. Rescan verify
verify_closure checks ticket status against rescan exposure. Presence of the vulnerability with a closed ticket is a conflict, not a pass.
- 5. Signed closure
sign_closure_artifact attaches SHA-256 always and ML-DSA-65 when signing is available. Offline verify_closure_artifact_offline checks the digest.
5. Defaults that keep claims credible
dry_run=trueis the default on every connector deliver path.- Without a configured HTTPS base URL and auth header, connectors stay dry-run or return a configuration error — they do not guess tenant endpoints.
- One-way creation means QScout does not claim full bidirectional ITSM control until Workflow 10 write-back and inbound event paths are live for your engagement.