tracemint.
Integrations

Keep your tools.
Move the work forward.

From the repository to a Jira or Linear ticket. Bring your code, scanner findings and delivery workflow into the same security review.

Find your integration Review permissions and sample imports
The connection directory

Your stack.
Its place in the workflow.

Find your tools—and see exactly how they work with TraceMint. Repository access, report imports and delivery integrations each have a different job.

Issue tracking

A finding needs an owner. And a place to go.

Create linked remediation tickets in the tools your engineering team already uses.

See the ticket handoff

  • Jira

    Ticket connection

    Create linked Jira issues. Cloud and Data Center use their own connection setup.

  • Linear

    Ticket connection

    Create linked issues in the configured Linear team and follow the remediation work.

  • GitHub Issues

    Ticket connection

    Create and link issues in a configured GitHub repository.

  • GitLab Issues

    Ticket connection

    Create and link issues in the selected GitLab project.

  • ServiceNow

    Ticket connection

    Create linked incidents through a configured ServiceNow ticket connection.

Connection scopeStatus mirrors require configuration and provider permissions. Closing an external ticket does not close a TraceMint finding or verify its fix.

Source control

Start where your code lives.

Connect a provider, discover accessible repositories and choose what to bring into TraceMint.

Compare repository connections

  • GitHub

    Repository connection

    GitHub App or supported token access for repository discovery and import.

  • GitLab

    Repository connection

    Connect GitLab.com or your configured self-managed GitLab instance.

  • Bitbucket

    Repository connection

    Cloud and separate Server / Data Center connections for your edition.

  • Azure DevOps

    Repository connection

    Connect with a PAT and organization or collection URL. No native Azure SCM webhook receiver.

  • Gitea

    Repository connection

    Connect your Gitea instance using its server URL and a scoped token.

Connection scopeWebhooks, result feedback and credentials are provider-specific. Bitbucket Cloud and Server / Data Center have separate setup paths.

SAST reports

Keep the scanner. Improve the review.

Bring supported report exports into autonomous triage. These are file-import paths, not native scanner connections.

Explore autonomous triage

  • Checkmarx

    CSV / XML / SARIF import

    Review supported Checkmarx SAST and Checkmarx One report exports.

  • OpenText Fortify

    XML / FVDL / FPR import

    Bring supported Fortify SCA or Fortify on Demand exports into review.

  • CodeQL

    SARIF import

    Import CodeQL findings from a supported SARIF export.

  • Semgrep

    SARIF import

    Import a supported SARIF report for source-backed triage.

  • ESLint

    SARIF import

    Bring security findings exported in a supported SARIF format.

  • Bandit

    SARIF import

    Review Python security findings from a supported SARIF export.

  • SpotBugs

    SARIF import

    Bring supported SARIF output into the same review workflow.

Connection scopeSupported formats: SARIF, Checkmarx CSV/XML, Fortify XML/FVDL/FPR and generic CSV with supported vulnerability columns. Validate the export schema and source context you use.

Scanner connections

Pull findings from the tools already in place.

Use a configured scanner API connection to import findings into the selected TraceMint project.

See the triage workflow

  • OpenText Fortify SSC

    Scanner API pull

    Retrieve findings from a configured SSC project version.

  • Checkmarx One

    Scanner API pull

    Import results using the configured Checkmarx scan identifier.

  • SonarQube / SonarCloud

    Scanner API pull

    Retrieve vulnerability issues for a configured component key.

  • Snyk

    Scanner API pull

    Pull issues from the configured Snyk organization endpoint.

  • Semgrep AppSec Platform

    Scanner API pull

    Import findings from a configured Semgrep deployment.

Connection scopeAPI pulls are separate from file uploads. Configure credentials, endpoint, project mapping and optional schedules; coverage and response limits depend on the provider.

CI pipelines

Put the scan in the next change.

Generate pipeline configuration for your CI system. Review and install it in your own environment.

Explore delivery workflows

  • GitHub Actions

    Generated configuration

    Generate a workflow for your GitHub Actions pipeline.

  • GitLab CI

    Generated configuration

    Generate a scan job for your GitLab CI configuration.

  • Bitbucket Pipelines

    Generated configuration

    Generate pipeline configuration for Bitbucket Cloud.

  • Azure Pipelines

    Generated configuration

    Generate Azure Pipelines YAML for the scan workflow.

  • Jenkins

    Generated configuration

    Generate a Jenkins pipeline configuration for review and installation.

  • CircleCI

    Generated configuration

    Generate CircleCI configuration for repeatable scans.

  • Buildkite

    Generated configuration

    Generate Buildkite pipeline configuration for your agents.

Connection scopeConfiguration generation is not an already-connected runner. Secrets, triggers, permissions and release-policy settings remain part of your pipeline setup.

Supply-chain evidence

Bring the artifact. Bind it to the release.

Import supported scanner artifacts and inspect their relationship to a project, source revision or image digest.

Explore supply-chain security

  • Trivy

    Artifact import

    Use supported Trivy JSON as dependency or container evidence.

  • Grype

    Artifact import

    Bring supported Grype JSON into the supply-chain evidence workflow.

  • npm audit

    Artifact import

    Import npm audit JSON for dependency vulnerability evidence.

Connection scopeAn imported report is not proof of a passing release. Its scope, integrity and source or artifact binding still need to support the decision.

Notifications

Send the signal to the team.

Route configured notification events to the collaboration tools your team watches.

Discuss your notification workflow

  • Slack

    Webhook notification

    Send configured scan and finding notifications to a Slack channel.

  • Microsoft Teams

    Webhook notification

    Deliver configured notifications through a Teams webhook.

Connection scopeNotification delivery uses configured webhooks. A message is not a remediation ticket, a scan trigger or a two-way synchronization channel.

Security operations

Carry the record into security operations.

Forward configured audit or finding streams to your security monitoring environment.

Review security and data handling

  • Splunk

    HEC event delivery

    Deliver the selected audit or finding stream to a configured HEC endpoint.

  • Elastic

    Event delivery

    Forward the selected stream using the configured Elastic sink and format.

  • Microsoft Sentinel

    Event delivery

    Forward the selected stream to a configured Microsoft Sentinel sink.

Connection scopeConfigure the sink, authentication, event source and wire format. Generic HTTP sinks and CEF / LEEF formats are also available; they do not imply a native connector for every SIEM or SOAR.

Provider marks identify supported workflows, not a partnership or endorsement. Availability depends on your deployment and connection setup.

Artwork credits

Jenkins artwork by Frontside for the Jenkins project (CC BY-SA 3.0). Grype artwork by Anchore and SpotBugs artwork by the SpotBugs project (CC BY 4.0). Artwork reproduced without changes. OpenText's mark identifies OpenText Fortify; Microsoft's Azure mark identifies the Sentinel workflow.

The remediation handoff

A ticket moves the work.
A retest answers the risk.

Keep the engineering workflow connected without confusing a closed issue with a verified fix.

  1. 01 / TraceMint

    Review the finding

    Source referenceEvidence & assessment

    Choose the finding that needs remediation.

  2. 02 / Your issue tracker

    Create a linked ticket

    Engineering workflowLinked external record

    Use Jira, Linear or another configured ticket provider. Enable supported status mirrors when needed.

  3. 03 / Back in TraceMint

    Verify the outcome

    Retest the changeRecord the finding decision

    External ticket closure alone does not close the finding or prove remediation.

Workflow illustration—not a live connection or a customer finding.

Delivery workflows

Make security part
of the next change.

Connect the scan to your delivery process without giving every integration the same promise. Repository access, generated pipeline configuration and result feedback have separate setup and permission requirements.

Run

Choose a starting point.

Start from your pipelineCI configuration

Generate pipeline configuration for GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure Pipelines, Jenkins, CircleCI or Buildkite. Review and install the generated configuration in your environment.

Work from the checkoutCLI & repeatable scans

Scan a local checkout from the CLI or focus configured CI analysis on changed files. Compare compatible scans against a baseline; changed-file scope does not stand in for a whole-repository assessment.

Return on your scheduleScheduled project scans

Schedule project scans with a saved configuration and time zone. Enable or pause a schedule, run it on demand and review its recent run history. Scheduling a project scan is separate from configuring a provider webhook.

Open a method to see its setup and scope.

Decide

A decision needs
something to stand on.

  • Recorded scan
  • Source revision
  • Artifact digest
Bound to the same release.

Policies & GitOps decisions

Evaluate release policies using the recorded scan, source revision and artifact digest. An unbound report or unevaluated scope is not evidence of a passing release.

Missing or unbound evidence is not a passing release.

Deliver

Give the result somewhere to go.

Put the finding in the workflowLinked issue trackers

Create and link findings with configured Jira, Linear, GitHub, GitLab or ServiceNow ticket connections. Authentication, supported synchronization events and update permissions differ by provider; universal two-way synchronization is not implied.

Carry the record forwardReport exports

Export findings in PDF, HTML, JSON, CSV, Markdown, SARIF or Fortify XML. Use configured export schedules for repeatable reporting; rendering support, delivery setup and scope remain installation-specific.

Configured connections. Installation-specific delivery.

A workflow guide. Each connection keeps its own setup and permissions.

Compare provider-specific automation
Connection contract

“Integrated” should mean
something specific.

Three questions to bring to the technical evaluation.

The input

Import

Can the file or repository be read in the format and layout you use?

The boundary

Context

Which project, source revision and permissions does the result actually cover?

The trigger

Automation

Is the requirement a manual run, a webhook, a schedule or a CI decision? Validate each separately.

Plan your evaluation

Bring the workflow
you already use.

Tell us what you want to evaluate. Our team will review your request and contact you to agree the scope and arrange a time.

Request a demo