Integrations
Native where it counts. Webhooks where it does not.
PolicyCortex reads configuration and events from the cloud providers most defense and regulated organizations already run: Azure, AWS, and GCP, with Azure Government, AWS GovCloud (US) and GCC High supported, through their own APIs, and writes approved remediation through their own primitives. Findings, tickets, notifications, and evidence exports move through the security, GRC, notification, and SIEM tools listed below.
Cloud providers
Native integration means consuming events directly and applying remediation through the provider's own primitives, not screen-scraping consoles.
| Provider | What is read | What is written |
|---|---|---|
| AWS, with AWS GovCloud (US) supported | Resource configuration and events, through the provider APIs, read only. | Approved remediation through the provider's own primitives, with a rollback identifier where a restore exists and rollback is enabled for the action. |
| Azure, with Azure Government and GCC High supported | Resource configuration and events, through the provider APIs, read only. | Approved remediation through the provider's own primitives, with a rollback identifier where a restore exists and rollback is enabled for the action. |
| GCP, including Assured Workloads | Resource configuration and events, through the provider APIs, read only. | Approved remediation through the provider's own primitives, with a rollback identifier where a restore exists and rollback is enabled for the action. |
AWS and Azure boundaries are supported for ATO packaging; GCP support covers governance, remediation, and control-linked evidence, not an ATO workflow.
Security posture
Posture platforms already in the environment feed the evidence record; no write-back is on record.
| Provider | What is read | What is written |
|---|---|---|
| Microsoft Defender for Cloud | Findings. | None on record |
| AWS Security Hub | Findings. | None on record |
| GCP Security Command Center | Findings. | None on record |
| Wiz | Findings. | None on record |
| Prisma | Findings. | None on record |
Ticketing and GRC
Work items go to the ticketing system your teams already watch; evidence can be imported into an existing GRC tool.
| Provider | What is read | What is written |
|---|---|---|
| ServiceNow ITSM and GRC | None on record | Tickets. |
| Jira | None on record | Tickets. |
| Linear | None on record | No ticketing integration today. |
| Azure DevOps | None on record | No ticketing integration today. |
| Drata | None on record | Evidence, imported into the GRC tool. |
| Vanta | None on record | Evidence, imported into the GRC tool. |
Notifications
Outbound only.
| Provider | What is read | What is written |
|---|---|---|
| Slack | None on record | Notifications. |
| Microsoft Teams | None on record | Notifications. |
| PagerDuty | None on record | Notifications. |
| None on record | Notifications. | |
| Webhook | None on record | Notifications, as events. |
AI and ML platforms
The AI estate inventory enumerates every model and agent in scope with identities, channels, egress paths, and binding envelope, as of a timestamp the customer chooses.
| Provider | What is read | What is written |
|---|---|---|
| Azure OpenAI | Models and agents in scope, for the AI estate inventory. | None on record |
| AWS Bedrock | Models and agents in scope, for the AI estate inventory. | None on record |
| GCP Vertex AI | Models and agents in scope, for the AI estate inventory. | None on record |
| OpenAI API | Models and agents in scope, for the AI estate inventory. | None on record |
| Anthropic | Models and agents in scope, for the AI estate inventory. | None on record |
| Hugging Face | Models and agents in scope, for the AI estate inventory. | None on record |
| MLflow | Models and agents in scope, for the AI estate inventory. | None on record |
Audit and evidence
Packages export as OSCAL 1.1.2 with SSP, SAR, POA&M, the eMASS POA&M worksheet, POA&M XML, and evidence indexes generated from one implementation record.
| Provider | What is read | What is written |
|---|---|---|
| OSCAL 1.1.2 | None on record | SSP, SAR, POA&M, and evidence indexes. |
| eMASS | None on record | The eMASS POA&M worksheet. POA&M XML uses the PolicyCortex schema; its import into eMASS has not been verified. |
| Splunk | None on record | Chained records, as events. |
| Microsoft Sentinel | None on record | Chained records, as events. |
| Datadog | None on record | Chained records, as events. |
| Custom SIEM via webhook | None on record | Chained records, as events. |
YOUR BOUNDARY · CUSTOMER-OPERATED INSTALLATION
SHA3-256 EVIDENCE STREAM · OFFLINE VERIFIERMissing one? Tell us what you run.