Integrations
Connect the cloud accounts, LLM endpoints, web app logins and code sources your engagements test.
Overview
Integrations hold the credentials PENOPS uses to reach what you want tested. You connect them once under Manage > Integrations, then pick them when you set up an engagement. One integration can serve many engagements, and when you rotate its credentials every engagement using it picks up the change.
| Category | Integrations | Used for |
|---|---|---|
| Cloud Providers | AWS, Azure, GCP | Discovering and testing your cloud accounts. See Cloud permissions. |
| AI Endpoints | LLM endpoint | Testing the LLMs and AI services you run. |
| Web App Authentication | Web app auth | Signing in to your web apps so testing covers what logged-in users can reach. |
| Source Code & Registries | GitHub, GitLab, Docker registry | Reading repositories and container images, for example to find exposed secrets. |
Filter the list with the All, Cloud, LLM, Web App and Secrets tabs.
Connect an integration
- Go to Manage > Integrations and click Connect integration.
- Choose the integration type.
- Give it a Label you will recognize when picking it in an engagement, then fill in the fields for that type (below).
- Click Connect. For web app logins the button reads Connect (validate in background).
Cloud, LLM and Docker credentials are checked when you save. If one is wrong, the form shows the reason under the field and nothing is saved.
AWS
- Access Key ID and Secret Access Key, plus an optional Session Token.
- Optionally an Assumed role with its External ID. Set both or neither.
- Scan regions: tick the regions to scan. Leave every region unticked to scan all of them.
Azure
- Tenant ID, Client ID (Application ID) and Client Secret of an app registration.
- An optional Subscription ID.
GCP
Choose an Authentication method: paste a service account JSON key file, or provide an ADC credentials file.
LLM endpoint
Choose a Provider: OpenAI, Anthropic, Azure OpenAI (with an API key or Azure AD), GCP Vertex AI, or AWS Bedrock / SageMaker. The form then asks for what that provider needs, such as an API key, endpoint URL, API version, project, location or region.
Web app auth
- Autodiscover (recommended): enter the target URL, a username and a password. PENOPS agents find the login form at the app root and sign in for you.
- Manual: also give the Login URL if the login form is not at the app root.
- Role: Victim (the default) or Attacker. A victim account holds the data an attacker account tries to reach.
GitHub, GitLab and Docker registry
- GitHub: click Install PENOPS GitHub App.
- GitLab: click Authorize via OAuth and approve PENOPS on gitlab.com.
- Docker registry: enter the Namespace and Images, then choose the authentication: a username with a password or personal access token, or anonymous access for public images.
Status and maintenance
| Status | Meaning |
|---|---|
| Connected | The credentials work. |
| Validating | A web app login is being checked in the background. This typically takes 1 to 2 minutes. |
| Not validated | The credentials have not been confirmed to work yet. Use Test connection. |
| Error | The last check failed. Fix the credentials or test again. |
Each card shows what was last synced, when it was connected and how many engagements use it. Its menu offers Edit, Test connection and Disconnect.
An engagement that uses a web app login in Error cannot run until you fix the login or test it successfully again.
Before you disconnect an integration, PENOPS warns you which engagements use it. Those engagements must be reconfigured with another integration.
Permissions
| To | You need |
|---|---|
| See integrations | Platform > Integrations: Read |
| Connect, edit or test an integration | Platform > Integrations: Write |
| Disconnect an integration | Platform > Integrations: Delete |