Documentation contents
AarView · Integrate
SOAR outbound connectors
Send AarView cases to Slack, Microsoft Teams, Jira, ServiceNow or a signed webhook, under approval, with data kept to a minimum.
A SOAR rule can send a case to the tools your team already uses. Available since version 1.77.0.
Destinations
| Type | What happens |
|---|---|
| Slack | A message in the incoming webhook’s channel (hooks.slack.com). |
| Microsoft Teams | A card in the channel of the webhook or the Workflows (Power Automate) flow. |
| Jira Cloud or Data Center | An issue in the chosen project and type, once per case. |
| ServiceNow | An incident (incident table), once per case. |
| Signed HTTPS webhook | A signed POST your service can verify. |
The Jira issue key or ServiceNow incident number shows in the run’s result and in the case timeline.
Approval
- Every send waits for an administrator’s decision. The approval page shows the destination and the exact fields that will leave.
- A connector can allow automatic sending. That setting is off at creation, and any change to the destination or the secret turns it off again.
- Managing connectors (create, edit, test, delete) is reserved for the super administrator, with a second-factor step-up for every change.
What leaves AarView
Only: the case title, its severity, its reference and portal link, the client name, the rule name, the MITRE ATT&CK techniques and the time.
Never: the raw alert, observables, internal notes.
Send safety
- HTTPS only, no credentials in the address.
- Destination checked per type: a Slack connector accepts only
hooks.slack.com, Jira Cloud anatlassian.netsite, ServiceNow aservice-now.cominstance unless declared self-hosted. - Private addresses refused. The address is checked, then used as is, with no re-resolution between the check and the send.
- No redirect followed.
- Secrets (tokens, Slack and Teams URLs that act as credentials) are encrypted, never shown again and never logged.
- An issue is never created twice: creation is not retried after an ambiguous answer.
Sovereignty
For a client whose offer excludes any third-party service, no send to Slack, Teams, Jira Cloud or ServiceNow, except to that client’s own connector attested inside its perimeter by a super administrator.
Known limits
- Jira Data Center or ServiceNow behind a private certificate authority are not supported yet.
- Request formats follow the vendors’ documentation; they were checked against a test server, not against each live service.