STAP note: PSA and RMM connections are Strategic Technology Alliances under the Strategic Technology Alliance Program (STAP). XISEM operationalizes partner telemetry through Shared Security Context — it does not replace your PSA or RMM.
Your SOC finds something real. Then someone copies a title into ConnectWise. Then the ticket closes in the PSA but stays open in the SIEM. Then nobody trusts either system.
Dual-Strike XISEM PSA alliances exist to break that loop: native ticket create, bidirectional close sync, and client mapping from the same console where detections and alerts already live.
What’s supported today
Configure at /integrations/psa (MSP credentials + per-client company mapping):
• ConnectWise Manage — REST
• Autotask — REST
• Syncro MSP — REST
• Halo PSA — OAuth REST
• SuperOps — GraphQL
• NinjaOne — OAuth REST
• Freshservice — REST
• Zendesk — REST
• ServiceNow — REST
• Jira Service Management — Atlassian REST
• Console (console.com) — Webhook playbook
• N-able N-central — Custom PSA webhook
• Custom webhook — JSON POST to your middleware
What gets ticketed
You choose rules — not a firehose:
• COBRA² detections & threats (primary path from the Threats console)
• Alerts (with optional skip when already backed by a detection — avoids duplicates)
• High/critical security events
• CVE correlation hits
• OSINT threat-actor overlap with client telemetry
• Manual “Create Ticket” from any investigation
Rate limits (max tickets per hour/day) keep noisy environments from spamming the PSA.
Bidirectional sync
When a ticket closes in the PSA, XISEM can resolve the linked detection/alert — and when XISEM resolves, the PSA ticket updates too. Scheduled sync keeps status from drifting for days.
RMM context (not just tickets)
Beyond PSA, Dual-Strike XISEM ingests from SuperOps, NinjaOne, SentinelOne (MSP site maps), Hudu, Huntress, DNSFilter, and the XISEM agent fleet itself — so asset identity in the console matches how you already organize clients in the RMM.
Technology alliances & Gateways live at /infeeds and /msp-tenants depending on vendor (MSP vs client scope). Console labels say Gateway; routes are unchanged.
Monday-morning setup (15-minute version)
1. PSA Integrations → pick your PSA tab → enter MSP API credentials → Test
2. Client Mapping → link each PSA company to a XISEM client
3. Ticket rules → enable detections + alerts at your minimum severity
4. Fire a test detection in a lab client → confirm ticket lands in the right queue
Why this post belongs in a security newsletter
Technology alliances aren’t checkbox features. They’re posture multipliers: the same signal that drives compliance evidence should drive work your technicians already do — in the tool they already live in.
Explore technology alliances: dual-strike.com/partners · console PSA Integrations
Exact tab labels and vendor OAuth flows evolve — use in-console setup wizards as ground truth.