Integrations

Works with the tools
your program
already trusts.

REAEGIS reads from your pipeline and writes to your systems of record. Nothing you run is replaced.

Request a demo See the platform

Three things happen
at every connection.

The directory below uses three labels. Each one says which way data moves.

READS01
push
REAEGIS takes in pushes,
scan results and images.
WRITES02
POA&M update
REAEGIS sends pull requests, POA&M updates, evidence and signed records.
TWO-WAY03
pushpull request
Both directions on one connection.
In source control, that is GitHub.

Find your tool.

Grouped by the job each tool does in the pipeline.

01SOURCE CONTROL

Where REAEGIS reads pushes. GitHub also receives pull requests.

How a fix reaches GitHub

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
GitHub	Reads pushes, opens pull requests, sets commit status	TWO-WAY	PUSH	ARERAMPART
GitLab	Reads pushes to protected branches	READS	PUSH	RAMPART
Azure DevOps	Reads pushes to protected branches	READS	PUSH	RAMPART
Bitbucket	Reads pushes to protected branches	READS	PUSH	RAMPART

GitHubPUSHARERAMPART
TWO-WAY
Reads pushes, opens pull requests, sets commit status
GitLabPUSHRAMPART
READS
Reads pushes to protected branches
Azure DevOpsPUSHRAMPART
READS
Reads pushes to protected branches
BitbucketPUSHRAMPART
READS
Reads pushes to protected branches

02SCANNERS

Scan results REAEGIS takes in and validates as findings.

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
Grype	Dependency and image vulnerabilities	READS	FIND	ADVERSARIUS
Trivy	Dependency and image vulnerabilities	READS	FIND	ADVERSARIUS
Checkov	Infrastructure as code checks	READS	FIND	ADVERSARIUS
Semgrep	Static analysis	READS	FIND	ADVERSARIUS
SonarQube	Code quality results	READS	FIND	ADVERSARIUS
OpenSCAP	STIG checks and CKL results	READS	FIND	ADVERSARIUS
Tenable ACAS	IAVA status	READS	FIND	ADVERSARIUS
Snyk	Scanner results	READS	FIND	ADVERSARIUS
OSV-Scanner	Dependency vulnerabilities	READS	FIND	ADVERSARIUS
Trufflehog	Secret detection	READS	FIND	ADVERSARIUS

GrypeFINDADVERSARIUS
READS
Dependency and image vulnerabilities
TrivyFINDADVERSARIUS
READS
Dependency and image vulnerabilities
CheckovFINDADVERSARIUS
READS
Infrastructure as code checks
SemgrepFINDADVERSARIUS
READS
Static analysis
SonarQubeFINDADVERSARIUS
READS
Code quality results
OpenSCAPFINDADVERSARIUS
READS
STIG checks and CKL results
Tenable ACASFINDADVERSARIUS
READS
IAVA status
SnykFINDADVERSARIUS
READS
Scanner results
OSV-ScannerFINDADVERSARIUS
READS
Dependency vulnerabilities
TrufflehogFINDADVERSARIUS
READS
Secret detection

03SUPPLY CHAIN

What goes into a build, and the signature on what comes out.

How a record is verified

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
Syft	SBOM generation	READS	BUILD	RAMPART
Sigstore Cosign	Signs every record and artifact	WRITES	ATO	CHRONICLE
Rekor	Anchors signed records in the public transparency log	WRITES	ATO	CHRONICLE

SyftBUILDRAMPART
READS
SBOM generation
Sigstore CosignATOCHRONICLE
WRITES
Signs every record and artifact
RekorATOCHRONICLE
WRITES
Anchors signed records in the public transparency log

04INFRASTRUCTURE AS CODE

Infrastructure files checked by the IAC_COMPLIANCE gate.

See the eleven gates

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
Terraform	Evaluated against baselines on every push	READS	VERIFY	RAMPART
Kubernetes	Evaluated against baselines on every push	READS	VERIFY	RAMPART
Helm	Evaluated against baselines on every push	READS	VERIFY	RAMPART
Dockerfiles	Evaluated against baselines on every push	READS	VERIFY	RAMPART
Bicep	Evaluated against baselines on every push	READS	VERIFY	RAMPART
CloudFormation	Evaluated against baselines on every push	READS	VERIFY	RAMPART

TerraformVERIFYRAMPART
READS
Evaluated against baselines on every push
KubernetesVERIFYRAMPART
READS
Evaluated against baselines on every push
HelmVERIFYRAMPART
READS
Evaluated against baselines on every push
DockerfilesVERIFYRAMPART
READS
Evaluated against baselines on every push
BicepVERIFYRAMPART
READS
Evaluated against baselines on every push
CloudFormationVERIFYRAMPART
READS
Evaluated against baselines on every push

05HARDENED IMAGES

Base images used when a fix rebuilds a container.

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
Chainguard	Hardened base image for container rebuilds	READS	BUILD	ARE
Iron Bank	Hardened base image for container rebuilds	READS	BUILD	ARE

ChainguardBUILDARE
READS
Hardened base image for container rebuilds
Iron BankBUILDARE
READS
Hardened base image for container rebuilds

06SYSTEMS OF RECORD

Where status, results and evidence are delivered.

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
eMASS	POA&M status, results and artifacts	WRITES	ATO	PHAROS
ServiceNow	GRC records	WRITES	ATO	PHAROS
Jira	Tickets mirror findings and their status	TWO-WAY	FIX	PHAROS
Custom adapter	Your own system, through the adapter framework	WRITES	ATO	PHAROS

eMASSATOPHAROS
WRITES
POA&M status, results and artifacts
ServiceNowATOPHAROS
WRITES
GRC records
JiraFIXPHAROS
TWO-WAY
Tickets mirror findings and their status
Custom adapterATOPHAROS
WRITES
Your own system, through the adapter framework

07IDENTITY

How your people sign in.

Platform security

TOOL	WHAT REAEGIS DOES WITH IT	DIRECTION	STAGE	ENGINE
SAML 2.0	Enterprise sign-in	READS	N/A	N/A
OpenID Connect	Enterprise sign-in, with PKCE	READS	N/A	N/A
CAC and PIV	Sign-in through your identity provider	READS	N/A	N/A

SAML 2.0NO STAGE OR ENGINE
READS
Enterprise sign-in
OpenID ConnectNO STAGE OR ENGINE
READS
Enterprise sign-in, with PKCE
CAC and PIVNO STAGE OR ENGINE
READS
Sign-in through your identity provider

The two-way connection,
step by step.

One push, followed from the commit to a signed result. GitHub is the only source control where REAEGIS opens pull requests.

DeveloperAUTHOR
GitHubSOURCE CONTROL
REAEGISPLATFORM
Maya ReyesREVIEWER

1
Developer pushes to a protected branch
Developer sends git push to GitHub.
2
GitHub sends the push event
GitHub sends push event to REAEGIS.
3
Gates are evaluated, commit status is set
RAMPARTREAEGIS sends commit status to GitHub.
4
A failed gate opens a finding
ADVERSARIUSREAEGIS records finding 0482.
5
A pull request with the fix is opened
AREREAEGIS sends pull request #482 to GitHub.
6
Maya Reyes approves and merges
AC-5 reviewer is not the authorMaya Reyes sends approve, merge to GitHub.
7
REAEGIS re-evaluates and signs the result
RAMPARTCHRONICLEREAEGIS records signed record.

Sent by REAEGISSent by GitHub or a person

See how a fix is verified

Evidence lands where your assessor already looks.

REAEGIS does not replace your system of record.
It keeps it current.

eMASS

The DoD system of record for RMF

WRITESPHAROS

01
Export files
In eMASS import format. Your ISSO uploads them.
poam.xlsxeMASS
02
In-boundary agent
Syncs POA&M status and results with a customer-owned PKI credential. REAEGIS never holds the key.
PKIeMASS
03
Direct API
Where network policy allows.
APIeMASS

Which path fits your boundary

ServiceNow

WRITESPHAROS

recordadapterServiceNow

GRC records, written through the adapter.

Jira

TWO-WAYPHAROS

findingticket

Tickets mirror findings and their status.

What changes when
the boundary does.

The same engines run in every model. These are the integration details that differ.

Integrations by boundary
WHAT DIFFERS	REAEGIS cloudRuns outside your boundary	In your boundaryInside an IL4 or IL5 environment	Air-gappedInside an enclave
Vulnerability dataNVD and OSV feeds	Live feeds (standard in this model)	Live feeds, or a mirror inside the boundary (set during scoping)	Offline database, updated by scheduled transfer (standard in this model)
Transparency logSigned record anchoring	Public Rekor (standard in this model)	Public Rekor, or an internal log (set during scoping)	Internal log (standard in this model)
eMASS pathPOA&M status and results	Export files your ISSO imports (standard in this model)	In-boundary agent, or direct API where network policy allows (standard in this model)	Export files, inside the enclave (set during scoping)
Pull requestsGitHub only	To your GitHub (standard in this model)	To your GitHub, inside the boundary (standard in this model)	To your GitHub, inside the enclave (set during scoping)
ScannersAs listed in the directory	All listed (standard in this model)	All listed, run inside the boundary (standard in this model)	Bundled in the signed kit (standard in this model)

REAEGIS cloudRuns outside your boundary
In your boundaryInside an IL4 or IL5 environment
Air-gappedInside an enclave

WHAT DIFFERS

Vulnerability data
NVD and OSV feeds
REAEGIS cloud
Live feeds (standard in this model)
In your boundary
Live feeds, or a mirror inside the boundary (set during scoping)
Air-gapped
Offline database, updated by scheduled transfer (standard in this model)
Transparency log
Signed record anchoring
REAEGIS cloud
Public Rekor (standard in this model)
In your boundary
Public Rekor, or an internal log (set during scoping)
Air-gapped
Internal log (standard in this model)
eMASS path
POA&M status and results
REAEGIS cloud
Export files your ISSO imports (standard in this model)
In your boundary
In-boundary agent, or direct API where network policy allows (standard in this model)
Air-gapped
Export files, inside the enclave (set during scoping)
Pull requests
GitHub only
REAEGIS cloud
To your GitHub (standard in this model)
In your boundary
To your GitHub, inside the boundary (standard in this model)
Air-gapped
To your GitHub, inside the enclave (set during scoping)
Scanners
As listed in the directory
REAEGIS cloud
All listed (standard in this model)
In your boundary
All listed, run inside the boundary (standard in this model)
Air-gapped
Bundled in the signed kit (standard in this model)

Compare the three boundaries

Run something that is not here?

adapterYour system

Custom adapter

Tell us what you run and we will tell you plainly whether it fits.

Contact

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demo See the platform

Federal programs
Invitation only, with CAC and PIV.
Request access
Commercial teams
Self-register with single sign-on.
Create a workspace
Pricing
Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.
See pricing

Works with the tools your program already trusts.

Three things happen at every connection.