Keystone integrations
34 integrations in the public catalog. Customers sign in to download them.
34 integrations
- AWS EventBridge (inbound event source) AWS events through an EventBridge API destination: CloudWatch alarm state changes, GuardDuty and Security Hub findings, AWS Health and EC2 state changes, and anything else as external.aws.event.
- Amazon S3 (file library repository type) Objects in an S3 bucket under a prefix, listed with ListObjectsV2 a page at a time and read with GetObject, every request signed with AWS Signature Version 4. Each object's ETag says whether it changed. For an S3-compatible store (MinIO, Wasabi, Ceph), copy this file and change base_url.
- Azure Blob Storage (file library repository type) Blobs in an Azure Storage container under a prefix, listed with List Blobs a page at a time and read with Get Blob. Signs in with a SAS token (kept sealed, or as a secret store reference) or a Microsoft Entra bearer token. Each blob's ETag says whether it changed.
- Azure Event Grid (inbound event source) Azure resource and service events from an Event Grid subscription: resources written or deleted, blobs created, and anything else as external.azure.event.
- Azure Monitor (inbound event source) Alerts from an Azure Monitor action group's webhook, in the common alert schema, as external.azure.alert_fired and external.azure.alert_resolved. Give the action group the endpoint's address, token included, and turn on the common alert schema.
- Dated URL (any mirror) (version source type) Any mirror that keeps each snapshot at its own path — snapshot.ubuntu.com and snapshot.debian.org by timestamp, a reposync tree by date on your own web server. There is no list to read: name the snapshot (its timestamp or path segment) when promoting ring 1.
- Elasticsearch / OpenSearch (event destination type) Indexes events through the _bulk API, each as a document with @timestamp and Keystone's own event under keystone. The event id is the document id, so a batch sent twice is not indexed twice.
- GitHub (file library repository type) Files in a GitHub (or GitHub Enterprise Server) repository at a branch, tag or commit, listed with the git trees API and read raw. Each blob's SHA says whether it changed.
- GitHub (inbound event source) Pushes, published releases and finished workflow runs from a repository or organization webhook, as external.github.push, external.github.release and external.github.workflow_run. Content type application/json; paste the endpoint's secret into the webhook's Secret.
- GitLab (file library repository type) Files in a GitLab project at a branch, tag or commit, listed with the repository tree API a page at a time and read with the raw file API. Each blob's id says whether it changed.
- Google Workspace (identity provider preset) Google accounts, limited to your Workspace domain. Google sends no groups.
- HTTPS file server (file library repository type) Any web server or file share that serves files over HTTPS with an index of them: a JSON document listing each file's path and a hash or etag, {"files": [{"path": "a/b.conf", "sha256": "..."}]}. The template for anything else.
- JFrog Artifactory (file library repository type) A generic (or any) Artifactory repository, listed with the storage API and read by its download path. Paths are relative to the prefix; each file's SHA-1 says whether it changed.
- JFrog Artifactory (version source type) Artifactory with one repository per snapshot — rhel9-2026-10-01, a copy or a frozen remote cache — named by a common pattern. Lists the repositories that fit it; hosts read a snapshot at its repository's URL.
- Jira (notification channel) Opens an issue for each new alert, comments when more changes join it, and transitions it when the alert is resolved in Keystone. Jira Cloud REST v3: sign in with your email and an API token; Data Center: a personal access token.
- Keycloak (identity provider preset) A Keycloak realm, often run inside the network.
- Microsoft Entra ID (identity provider preset) Azure AD / Entra ID, single tenant, through OpenID Connect.
- Microsoft Teams (notification channel) Posts each new alert to a Teams channel through a Workflows webhook (“Post to a channel when a webhook request is received”).
- NetBox (data source type) NetBox devices, virtual machines or IP addresses, read through its REST API. Read only. The credential is the whole Authorization value NetBox expects — “Token 0123abcd…”. An example of a second system on the same engine: header auth and next-link paging.
- NetFlow, IPFIX and sFlow (through an edge adapter) (inbound event source) Flow records summarised at the edge (the netflow-adapter pack: goflow2 collects NetFlow v5/v9, IPFIX and sFlow; Vector reduces them per minute to the top talkers).
- Okta (identity provider preset) Okta, through its org authorization server.
- OpenTelemetry (OTLP/HTTP) (inbound event source) Metrics from an OpenTelemetry Collector or SDK over OTLP/HTTP, as protobuf or JSON, gzip or not: gauges, cumulative sums (as counters) and histograms (as .count and .sum counters), written into one metric object.
- Prometheus Alertmanager (inbound event source) Each alert in an Alertmanager webhook notification becomes an event: external.alertmanager.firing or external.alertmanager.resolved. Give Alertmanager the endpoint's address, token included, as a webhook_config url.
- Pulp 3 (version source type) Pulp 3 with one distribution per snapshot under a common base path — rhel9/2026-10-01, rhel9/2026-11-01 — which is how Pulp keeps snapshots addressable. Lists the distributions whose base path starts with the prefix; hosts read a snapshot from Pulp's content app.
- SNMP traps (inbound event source) SNMP traps from network devices, forwarded by a Keystone trap relay installed near them (trap-relay/README.md): interfaces down and up, restarts, authentication failures, and any other trap as external.snmp.trap.
- ServiceNow (data source type) A ServiceNow CMDB table, read through the Table API — the rows of one table, filtered by the encoded query a list view shows in its breadcrumb — and, opt in, written back through the Identification and Reconciliation Engine (IRE), so ServiceNow's own rules decide which source may change which field.
- ServiceNow (notification channel) Opens an incident for each new alert, adds a work note when more changes join it, and resolves it when the alert is resolved in Keystone. Table API; the account needs the itil role.
- Slack (notification channel) Posts each new alert to a Slack channel through an incoming webhook.
- Sonatype Nexus Repository (file library repository type) A raw (or any) Nexus 3 repository, listed with the assets API a page at a time and read from the repository path. Each asset's SHA-256 says whether it changed.
- Sonatype Nexus Repository (version source type) Nexus with one yum or apt repository per snapshot, named by a common pattern. Lists the repositories that fit it; hosts read a snapshot at the URL Nexus gives the repository.
- Splunk HTTP Event Collector (event destination type) Sends events to a Splunk HTTP Event Collector (HEC) as JSON events. Each is Keystone's own event, unmapped, under sourcetype keystone:event by default.
- Syslog (through an edge adapter) (inbound event source) Syslog lines that an edge adapter near the senders chose to forward (the syslog-adapter pack: Vector, filtering and classifying at the edge).
- Webhook (JSON) (event destination type) POSTs each batch as a JSON array of Keystone's own events to any HTTPS address — a log collector, a SOAR, a queue gateway.
- aptly (version source type) aptly's snapshots, each published at its own prefix under the published URL (https://apt.example.com/2026-10-01). Lists the snapshots whose names fit the pattern, newest first.
No integrations match . Show all integrations