New RMM & PSA integrations — tickets that write themselves (almost)
Subtitle: ConnectWise, Autotask, Halo, SuperOps, NinjaOne, Syncro, Freshservice, Zendesk, ServiceNow, Jira, and more — one dispatch fabric.
Your SOC finds something real. Then someone copies a title into ConnectWise. Then the ticket closes in the PSA but stays open in the SIEM. Then nobody trusts either system.
Dual-Strike XISEM PSA integrations exist to break that loop: native ticket create, bidirectional close sync, and client mapping from the same console where detections and alerts already live.
What’s supported today
Configure at /integrations/psa (MSP credentials + per-client company mapping):
PlatformNative API / path ConnectWise ManageREST AutotaskREST Syncro MSPREST Halo PSAOAuth REST SuperOpsGraphQL NinjaOneOAuth REST FreshserviceREST ZendeskREST ServiceNowREST Jira Service ManagementAtlassian REST Console (console.com)Webhook playbook N-able N-centralCustom PSA webhook Custom webhookJSON POST to your middleware
What gets ticketed
You choose rules — not a firehose:
COBRA² detections & threats (primary path from the Threats console)
Alerts (with optional skip when already backed by a detection — avoids duplicates)
High/critical security events
CVE correlation hits
OSINT threat-actor overlap with client telemetry
Manual “Create Ticket” from any investigation
Rate limits (max tickets per hour/day) keep noisy environments from spamming the PSA.
Bidirectional sync
When a ticket closes in the PSA, XISEM can resolve the linked detection/alert — and when XISEM resolves, the PSA ticket updates too. Scheduled sync keeps status from drifting for days.
RMM context (not just tickets)
Beyond PSA, Dual-Strike XISEM ingests from SuperOps, NinjaOne, SentinelOne (MSP site maps), Hudu, Huntress, DNSFilter, and the XISEM agent fleet itself — so asset identity in the console matches how you already organize clients in the RMM.
Infeeds & integrations live at /infeeds and /msp-tenants depending on vendor (MSP vs client scope).
Monday-morning setup (15-minute version)
PSA Integrations → pick your PSA tab → enter MSP API credentials → Test
Client Mapping → link each PSA company to a XISEM client
Ticket rules → enable detections + alerts at your minimum severity
Fire a test detection in a lab client → confirm ticket lands in the right queue
Why this post belongs in a security newsletter
Integrations aren’t checkbox features. They’re posture multipliers: the same signal that drives compliance evidence should drive work your technicians already do — in the tool they already live in.
Explore integrations: dual-strike.com · console PSA Integrations
Exact tab labels and vendor OAuth flows evolve — use in-console setup wizards as ground truth.