Security tool integrations feed vulnerability data, endpoint status, and threat intelligence directly into LowerPlane. These integrations automate some of the most labor-intensive aspects of compliance: proving that you detect, track, and remediate security issues.

​
Supported Security Tools

​
Evidence and Tests by Tool Type

​
Vulnerability Scanners (Snyk, Wiz, Qualys)

Evidence collected:
  • Open vulnerability findings with severity, affected component, and remediation guidance
  • Scan history and frequency records
  • Vulnerability aging reports (time to remediation)
  • Suppressed or accepted risk findings with justification
Automated tests:
  • No critical vulnerabilities older than 30 days
  • Vulnerability scanning runs at least weekly
  • All production applications are included in scan scope
  • Mean time to remediation meets SLA thresholds

​
Endpoint Protection (CrowdStrike, SentinelOne)

Evidence collected:
  • Device inventory with protection agent status
  • Threat detection events and response actions
  • Policy compliance per device (encryption, OS updates, agent version)
  • Unprotected device list
Automated tests:
  • All company devices have endpoint protection agent installed
  • Endpoint agent is up to date on all devices
  • No unresolved critical threat detections
  • Device encryption is enabled on all endpoints

​
SIEM / Monitoring (Splunk, Datadog)

Evidence collected:
  • Log collection configuration and coverage
  • Alert rules and notification channels
  • Incident detection and response timeline evidence
  • Uptime and availability metrics
Automated tests:
  • Security logging is enabled for all critical systems
  • Log retention meets minimum requirements (typically 90+ days)
  • Alert rules exist for critical security events
  • Monitoring covers all production infrastructure

​
Code Security (GitHub, GitLab, Semgrep)

Evidence collected:
  • Branch protection rule configurations
  • Code review approval requirements
  • Dependency vulnerability alerts
  • Static analysis findings
Automated tests:
  • Branch protection is enabled on main/production branches
  • Pull requests require at least one approval before merge
  • Dependency vulnerability alerts are enabled
  • No critical static analysis findings in production code

​
Framework Control Mapping

​
Vulnerability Data Flow

1

Integration syncs findings

The security tool integration fetches the latest vulnerability or threat findings from the connected tool.
2

Findings are categorized

Each finding is assigned a severity level (critical, high, medium, low, informational) and mapped to affected assets.
3

Assets are updated

The asset inventory in LowerPlane is updated with vulnerability counts and severity breakdowns.
4

Tests are evaluated

Automated compliance tests check whether findings meet your organization’s SLA thresholds and policy requirements.
5

Controls reflect current status

Control implementation status updates based on test results, and compliance scores recalculate across all applicable frameworks.
Security tool integrations may surface sensitive vulnerability data. Ensure that access to the Assets > Vulnerabilities section is restricted to security and compliance team members using role-based access controls.
Connect at least one vulnerability scanner and one endpoint protection tool. Together, these cover the majority of technical security controls required by all 50+ compliance frameworks.