From the Findings panel, select findings and click Push to Jira. Or configure auto-push: all Critical/High findings create Jira tickets automatically when confirmed.
ServiceNow Integration
Settings → Integrations → ServiceNow:
Instance URL : https://your-instance.service-now.com
Username : phantomyerra_svc
Password : [encrypted on entry]
Table : sn_si_incident (Security Incidents) or incident
Features:
→ Push findings as Security Incidents
→ CMDB sync: discovered assets → CI records
→ Bi-directional status sync (fix in ServiceNow → closes in PhantomYerra)
Slack Integration
Settings → Integrations → Slack:
Webhook URL : https://hooks.slack.com/services/...
Channel : #security-findings (or per-severity channels)
Notification triggers (configurable):
✓ Critical finding confirmed → immediate alert
✓ Scan started / completed
✓ Report generated and ready
✓ AI credits running low
✓ Daily digest of open findings
Message format:
🔴 CRITICAL Finding: SQL Injection in /api/users
Project: [project name] | CVSS: 9.8 | EPS: High
→ View in PhantomYerra: [deep link]
Microsoft Teams Integration
Settings → Integrations → Microsoft Teams:
Webhook URL : https://your-org.webhook.office.com/...
Channel : General / Security-Alerts
Same trigger configuration as Slack.
Adaptive Card format for rich finding notifications.
PagerDuty Integration
Settings → Integrations → PagerDuty:
Integration Key : [from PagerDuty service]
Escalation : Critical → immediate page
High → page after 30 minutes if unacknowledged
Use case: On-call security engineer gets paged immediately when
a Critical finding is confirmed during automated scanning.
In your .gitlab-ci.yml:
phantom_sast:
stage: test
script:
- curl -X POST http://phantomyerra:8731/api/v1/sast/scan
-d '{"path": ".", "fail_on": ["critical", "high"]}'
-H "Authorization: Bearer $PHANTOM_API_KEY"
artifacts:
reports:
sast: gl-sast-report.json
Quality Gate Configuration
Settings → Integrations → CI/CD Quality Gate:
Fail build if:
✓ Any Critical finding
✓ High findings > [threshold: 0]
✓ New CVEs in SBOM > [threshold: 5]
✓ GPL license violations found
Pass conditions:
✓ Zero critical findings
✓ All high findings have accepted risk or remediation tickets
✓ SBOM contains no known-exploited CVEs (KEV check)
Splunk Integration
Settings → Integrations → Splunk:
HEC URL : https://splunk.your-org.com:8088/services/collector
HEC Token : [from Splunk HTTP Event Collector]
Index : security_findings
Source Type : phantomyerra:finding
All findings and scan events stream to Splunk in real-time.
Pre-built dashboards available in PhantomYerra Splunk App.
Common Issues
Your Jira project likely has required custom fields that PhantomYerra doesn't know about. Go to Settings → Integrations → Jira → Field Mapping → Advanced. Inspect the Jira field schema and map the required fields. Common required fields: "Sprint", "Fix Version", "Component". Set default values for fields that PhantomYerra can't auto-populate.
Test the webhook: Settings → Integrations → Slack → Test Connection. If the test fails, regenerate the webhook in Slack (Apps → Incoming Webhooks). Verify the bot is still a member of the target channel. Check that notification triggers are enabled in the trigger configuration — all triggers are OFF by default and must be explicitly enabled.
GitHub Advanced Security must be enabled for the repository (requires GitHub Enterprise or public repo). The SARIF file must be valid SARIF 2.1.0. Check the file: cat phantomyerra_results.sarif | jq .version — should return "2.1.0". Ensure the workflow has the security-events: write permission in the workflow YAML.