Dashboard guide

Notifications and integrations

Owners and admins set these up under Settings → Notifications and Settings → Integrations. Every member can read them. Saving credentials asks for a step-up; credentials are stored encrypted, bound to your environment and the channel, and never shown again. Every change and every test is in the audit log.

#Channels

Add channel, then Test sends a test event. Outgoing connections only go to public addresses over https, without following redirects; an address in a private range is refused.

#Rules

A rule links event types to channels, with filters: crown jewels only, a minimum score, a minimum severity, specific hosts or groups, or ecosystems. Each channel also has its own minimum severity.

New environments start with three rules for all channels:

The full list of events is in Settings → Notifications.

Digest per channel: immediately, 15 minutes, 1 hour or 1 day. Quiet hours: only critical events go out; the rest waits until the end. Each event is sent once per channel.

Delivery log: every delivery with its result. Failed deliveries are retried after 1 minute, 5 minutes, 15 minutes, 1 hour and 3 hours; after 6 attempts they stop, and an admin can Retry them.

#Webhook format

SEK Systems sends a POST with a JSON body:

{
  "version": 1,
  "source": "sec",
  "channel": "SOC webhook",
  "events": [
    {
      "id": "5f0c1c8e-6a1b-4b0e-9d7e-2f1f7c3e9a10",
      "kind": "kev_hit",
      "severity": "high",
      "subject": "CVE-2024-6387 (KEV) on web-01: openssh-server",
      "detail": { "cve": "CVE-2024-6387", "score": 100 },
      "object": "finding:…",
      "link": "https://console.sek.systems/t/…",
      "created_at": "2026-11-07T09:12:44Z"
    }
  ]
}

The fields of detail depend on the event kind. The values above are an example.

Two headers authenticate it:

Verify both on your side: compare the signature in constant time, and refuse timestamps older than 5 minutes (so an intercepted request cannot be replayed). Example in Python:

import hmac, hashlib, time

def verify(secret: bytes, timestamp: str, signature: str, body: bytes) -> bool:
    if abs(time.time() - int(timestamp)) > 300:
        return False
    mac = hmac.new(secret, timestamp.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest("v1=" + mac, signature)

#Tickets

For Jira, TOPdesk, ConnectWise Manage, Autotask and HaloPSA, SEK Systems creates one ticket per object (a finding, a plan or an agent):

• a new event on the same object adds a note to the existing ticket;
• when the finding is no longer open, SEK Systems adds a note and closes the ticket (Jira: with the "done" transition you set; the PSAs: with the closed status you set, or the PSA's default);
• the ticket priority follows the severity; you can map each severity to a priority of your PSA.

An environment is one customer in your PSA: the channel records which company or client its tickets belong to.

#RMM connections (read-only)

Under Settings → Integrations → RMM connections you can connect NinjaOne, N-able N-central or Datto RMM. SEK Systems only reads the device list, to show the coverage gap: machines in your RMM without a SEK Systems agent. It never runs anything through your RMM. Use an RMM API account with read-only rights.

• Devices are matched to agents by serial number, then MAC address, then host name. Serial numbers and MAC addresses are compared as keyed pseudonyms, not stored in readable form.
• The list is synchronised every hour, or now with Test & sync. A machine that appears later without an agent raises a coverage gap event; the initial gap of a new connection is only listed.

Install through your RMM: the same page offers a PowerShell and a shell script that you put in your RMM yourself. The script checks the checksum of what it installs, does nothing when the agent is already there, and enrolls with the observe profile. The enrollment token is not in the script: set it as the RMM script variable SEC_ENROLL_TOKEN, and limit the token in uses, lifetime and source network (Enrollment tokens).