SafeToOpen Browser Security
Ticketing, SIEM & Threat Feed Integration Guides
Send Browser Security incidents to ServiceNow, Jira, your SIEM or SOAR, close the loop, and bring your own threat intelligence in.
Overview and Setup
Concepts, choosing push, pull or email-to-ticket, and step-by-step console setup. Start here.
ServiceNow Integration Guide
Scripted REST receiver, incident mapping, close-the-loop Business Rule and a polling alternative.
Jira Integration Guide
Jira Automation incoming webhook or a signature-verifying relay, plus close-the-loop rules.
Webhook and API Reference
Payloads, headers, signature verification code, polling, schema variants and error codes.
Threat Feeds: Bring Your Own Intelligence
Ingest vendor or community URL feeds on a schedule so their entries are blocked in every workspace. Presets, formats, TAXII and MISP, caps and removal.
Response Actions: Blocklist, Microsoft 365, Entra ID, Defender, Okta, EDR, Web Gateways, Paging, Chat and MSP Propagation
What each integration lets you do, with a capability table across all 24 connectors, then per integration: what you need, the vendor-side and console set-up step by step, the actions with their scope and undo, and the rules to write.
MSP Operations: Overview, Linked Organisations and Administrator Access
One screen across every organisation you administer, MSP-wide blocking through linked organisations, co-admins that follow an identity-provider group, and required SSO for administrators.
AI Governance: Sanctioned AI, Shadow AI Warnings and the AI Usage Report
Name the AI platforms your organisation approves, warn on or block the rest, tell work and personal editions apart, and report who uses which AI tools, with incidents for your SIEM and response rules.
Modern Threat Guards: ClickFix, Consent Phishing and Password Reuse
Three controls for the attacks that walk past URL filtering: pages that trick people into running a command, apps that ask for lasting mailbox access on a genuine sign-in page, and the work password typed into a proxy phishing kit or a personal site. What each catches, what people see, and the incidents they raise.
Which guide do I need?#
- Administrators — Read the Overview first: it explains events, workspaces and the three integration routes, and shows the console screens.
- ServiceNow or Jira owners — Go straight to the ServiceNow or Jira guide; each is self-contained and ends with a test plan.
- Engineers building a receiver, relay or collector — Use the Reference: payload fields, signature verification in Python, Node and PowerShell, polling, OCSF/ECS/CEF, STIX/TAXII and error codes.
- Bringing intelligence in — Guide 5: add vendor or community URL feeds (abuse.ch, OpenPhish, PhishTank, MISP, TAXII, Recorded Future, Proofpoint ET, or any list) so their entries are blocked automatically across all workspaces.
- Acting on incidents — Guide 6: connect a hosted blocklist for firewalls and your Microsoft 365 tenant, then let confirmed incidents block URLs, junk senders and lock down compromised users, with dry-run and undo.
- Running several organisations — Guide 7: the MSP overview screen, linking organisations for MSP-wide blocking, co-admins that follow an identity-provider group, and requiring SSO for administrators.
- Governing AI use (Shadow AI) — Guide 8: approve the AI platforms your organisation sanctions, warn on or block the rest, and get the AI usage report that ISO 42001, EU AI Act and cyber-insurance questionnaires ask for.
- Stopping the attacks that pass MFA — Guide 9: switch on the ClickFix guard, the OAuth consent guard and Password Alert, and read the incidents they raise.
Before you start#
You need an Owner or Co-administrator login to https://plus.safetoopen.com/business-console#/integrations, where tokens and webhooks are created. Tokens and webhook secrets are shown once; keep them in your secret store.
Machine-readable documentation of every endpoint is published at https://plus.safetoopen.com/api/integrations/openapi.