6.1 Integration Model
CBOM Secure integrates with external systems in three directions: bringing data in, sending data out, and using another platform as the delivery channel for discovery. This part covers the integration model, the two integrations implemented in depth — CrowdStrike Falcon and ServiceNow — and the notification and rule engine that sits behind the outbound ones.
There are three kinds of integration. Knowing which kind is in front of you sets the expectation for what it does and what it needs.
Inbound integrations bring data into CBOM Secure — host inventory from an EDR or configuration management database, certificate inventory from a lifecycle manager, findings from a vulnerability scanner.
-
Outbound integrations send data out: a ticket raised in a service management tool, a notification to a messaging platform, an export consumed by another system.
Execution integrations use another platform as the delivery and execution channel for discovery, rather than exchanging data. The EDR-orchestrated scan pattern is this kind.
Common to all of them: credentials are stored encrypted and masked on every read; the masking sentinel written back does not overwrite the stored value; provider names are normalised, so an integration cannot be added twice under different capitalisation; and integration failures should be alerted on, because an integration that has silently stopped working is invisible.