Integration catalog

Preserves

• · Findings with severity, description and remediation
• · Affected assets per finding occurrence
• · Approved evidence attachments and report fields

Known limits

• · The CSV route carries only the prescribed finding columns — no client or report metadata
• · Full-engagement fidelity needs the qualified API connector, not the CSV download

Preserves

• · One shared issue mapped to many per-node evidence instances
• · Attachments through the attachment API
• · Project structure and methodology fields

Known limits

• · Rich text is converted deliberately — Dradis takes a subset of Textile, not Markdown
• · Packet captures and long video are referenced, never embedded

Preserves

• · Findings and notes with referenced files
• · Project design and template field mapping
• · Project archives (tar.gz / JSON / TOML / YAML) for round-tripping

Known limits

• · Uploaded files that no note references can be cleaned up — we verify the reference, not just the upload

Preserves

• · Activity-log entries with operator, source, target and timing
• · Evidence attached to the log entry it belongs to
• · Asciinema terminal recordings (.cast / .cast.gz)

Known limits

• · A scoped operation-log token does not also grant finding or report writes — grants are qualified separately
• · Desktop video stays in the engagement package; the log carries the clip reference

Preserves

• · Projects, vulnerabilities, test cases and retest context
• · Testing start/stop and retest status events

Known limits

• · An imported scope change arrives as a proposal for review — it never authorizes testing by itself

Preserves

• · Generic findings JSON with title, severity and description
• · Affected endpoints and stable external IDs

Known limits

• · Evidence attachment and lifecycle behavior is qualified separately from the import

Preserves

• · Planned test case linked to the execution that actually ran
• · ATTiRe execution logs with timings and outcomes
• · Defensive observations recorded apart from offensive execution claims

Known limits

• · An ATT&CK technique list is not an executed procedure — we export executions, not labels

Preserves

• · Reviewed finding summary, affected assets and approved attachments
• · A link back to the authoritative assessment record
• · Ticket reference, status and owner read back into Forge

Known limits

• · A ticket is not the raw archive, and a Done status is not a passed retest
• · Cloud and Data Center are separate connector profiles

Preserves

• · Customer-mapped vulnerable items or remediation tasks
• · Approved CMDB asset references

Known limits

• · Not a generic create-an-incident-per-finding integration — it follows the customer's data model

Preserves

• · Manifest with schema version, hashes, sizes and the categories included and omitted
• · Original evidence bytes plus separately identified redacted derivatives
• · Append-only activity records, capture coverage and every known gap
• · A human-readable index and an offline verify path

Known limits

• · No live credential values
• · A sanitized package states plainly that it is a selected subset, not the full preservation copy