Feed Orithos findings into your security platform

Orithos pushes every finding — with lifecycle status — to any CNAPP, SIEM, or webhook endpoint you designate. HMAC-signed delivery, 50-finding batches, rotating secrets. If your platform can ingest a signed webhook, it can graph agent-security findings.

1. Create a destination

Dashboard → Settings → Integrations → Findings Feed. Each destination is a name, a URL, and a signing secret (16+ chars). Secrets are encrypted at rest and never appear in any API response — you see the value once at creation time.

Rotate secrets without dropping events

When you rotate, the previous secret stays valid for an overlap window: delivery signs with the new secret first, and falls back to the previous one if the endpoint rejects it. No events are lost mid-rotation.

2. Verify the signature

Every request carries X-Orithos-Signature-256: the HMAC-SHA256 hex digest of the raw JSON body, keyed with your destination secret.

body = await request.raw_body()
expected = hmac.new(secret, body, sha256).hexdigest()
assert constant_time_compare(expected, request.headers["X-Orithos-Signature-256"])

3. Handle the events

finding.created

Scan completes and a finding is recorded

finding fields: id, severity, attack_path, probe_key, triage_status, source, compliance_tags

finding.updated

Triage status changes (new → triaged → confirmed/remediated/false_positive)

finding fields: same + previous status in triage_status

Batching

Large scans deliver in batches of 50 findings per request — a 1,000-finding scan is 20 posts, not 1,000. The scan_run_id and destination_id fields let you correlate and dedupe.

4. Endpoint health

Failed deliveries are parked with an audit event (visible in your audit log) — the feed never blocks a scan and never silently drops data. A destination that 500s shows up in Settings with its last-failure timestamp; retry via the fanout endpoint or disable the destination without losing audit history.

Dual format: JSON or SARIF

Need SARIF instead of JSON? Every scan exports SARIF 2.1.0 directly (GET /v1/scans/{id}/report/download?format=sarif) — poll the scan API on your own schedule and pull, or use the push feed for lifecycle updates. Both formats carry the same finding IDs, so you can merge them on your side.

Loading documentation…

Integration