Integration recipes

Patterns for wiring intSignal into the tools you already run. Each recipe uses the REST API, webhooks, and the code examples — no server-side setup required on your end beyond a place to receive webhooks. If you'd rather consolidate consoles than write integrations, the unified security management and analytics platform is the packaged version of the same idea.

Post events to chat (Slack / Teams)

Goal: a message in your team channel the moment something happens.

How: subscribe a webhook to the events you care about, verify the signature, and forward a summary to your chat provider's incoming webhook.

// Express handler — verify, then forward to Slack
app.post("/hooks/intsignal", express.raw({ type: "*/*" }), async (req, res) => {
  if (!verify(req)) return res.sendStatus(401); // see Webhooks → Verify
  const evt = JSON.parse(req.body);
  if (evt.type === "case.opened") {
    await fetch(process.env.SLACK_WEBHOOK, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ text: `🚨 New ${evt.data.severity} case: ${evt.data.id}` }),
    });
  }
  res.sendStatus(200);
});

File records from your own tools

Goal: raise a ticket/case from a monitoring tool, a form, or a script.

How: POST with a scoped key. Records created this way are tagged with source API, so you can tell them apart later.

session.post(f"{BASE}/soc/cases", json={
    "title": "Disk 90% full on web-03",
    "severity": "medium",
})

Keep a mirror in sync

Goal: a local copy of your records for reporting or a data warehouse.

How: do one initial backfill with pagination, then stay current two ways — a periodic incremental pull with since, and/or webhooks for near-real-time updates.

# incremental: only what changed since last run
new = list_all("/soc/cases", params={"since": last_run_iso})
upsert(new)                     # your DB write
last_run_iso = now_iso()

Prefer webhooks over tight polling — you'll get changes faster and stay under the rate limits.

Build a live status view

Goal: an internal dashboard or wallboard.

How: read the list endpoints on a sensible interval (30–60s), cache the results, and render. Filter with query params so you only pull what you show.

const open = await api("/soc/cases?status=open&limit=100");
render(open.data);

Power an AI assistant over your data

Goal: let an AI tool answer questions from your intSignal data and docs.

How: point an MCP-capable client at the MCP server with a read-only scoped key. The assistant can search the docs and, with the token, query your account — no custom API glue.