Overview
AuditFindings integrations connect your account to AI providers and to Splunk for security analytics and remediation workflows. Administrators manage connections from Admin > Integrations.
The Integrations page shows each provider’s status, whether it is configured or enabled, the available configuration action, and provider documentation. Credentials are encrypted in AuditFindings. Treat provider secrets and Splunk tokens as confidential.
AI Advisor providers
AuditFindings can use the following AI providers, depending on what your organization has configured:
- OpenAI — use OpenAI models for AuditFindings AI features.
- Anthropic — use Claude models.
- Google Gemini — use Gemini models.
- xAI (Grok) — use xAI models.
- Microsoft Copilot Studio — use a published Copilot Studio agent as the AI Advisor provider.
- Azure OpenAI — use Azure OpenAI v1 chat-completion deployments.
Connect and test an AI provider
- Open Admin > Integrations.
- Find the provider card and choose Connect or Configure.
- Enter the provider endpoint, model or deployment details, and credential requested by the provider form.
- Use the provider’s Provider API docs link when you need the exact API requirement.
- Run the test-before-save flow. Save only after the test succeeds.
- Enable AI Advisor under Admin > Manage Company, then open AI Advisor on the Dashboard, Manage Audits, or Manage Issues page.
For OpenAI and other model-based providers, a successful connection can discover available models. Select a model supported by your account and policy.
Microsoft Copilot Studio
Use a published Copilot Studio agent. AuditFindings keeps the Direct Line secret on the server. Images and PDFs are represented by their file names because the Direct Line text channel cannot accept those files inline.
Azure OpenAI
Use an Azure OpenAI resource with the /openai/v1 base URL and v1 chat-completion deployments. AuditFindings uses the resource connection to discover models or deployments available through that endpoint.
Configure Splunk HTTP Event Collector (Beta)
The Splunk integration sends accessible AuditFindings findings to Splunk Cloud or Splunk Enterprise through an HTTP Event Collector (HEC) connection. Use Connect on the Splunk card, enter the HEC details and token, test the connection, and save it only after the test succeeds.
The Splunk card has separate workflows for the connection, automatic push, and inbound webhook. Complete and save the connection first; the automatic-push and inbound-webhook settings depend on a working connection.
Export findings from Manage Issues
From Manage Issues, use the Splunk HEC export to send the findings you can access. The export includes issue custom fields and assignees. Large account-wide sends continue in the background, so Manage Issues does not wait for the full run. Automatic push is the option for scheduled sends and for sending every finding, including closed findings.
For “open findings,” AuditFindings uses every Customizations status marked Is Open, not only a status literally named “Open.” Splunk receives the detailed status name so inbound updates can select the correct closed-family status.
Automatic push
- Open the Splunk integration and select the Automatic push tab.
- Choose whether to send open findings or all findings.
- Select a 6-, 12-, or 24-hour schedule.
- Test and save the connection from the Connection tab, then save the automatic-push settings.
Inbound webhook (Beta)
On the Inbound webhook tab, enable the feature after the Splunk connection is tested and enabled, then generate the secret URL. Copy the URL when it is shown and configure Splunk Alerts to call it when a finding should be closed or updated.
- The generated URL does not include your account ID.
- History records an inbound change as Splunk webhook without sending an extra issue email.
- Deactivating Splunk also stops inbound POSTs.
- Only matching AuditFindings findings are updated; generic Splunk result IDs are not treated as AuditFindings finding IDs.
Troubleshooting and safety
- If the connection test fails, verify the endpoint, deployment or model, token, and provider permissions before saving.
- Do not paste API keys, Direct Line secrets, or HEC tokens into help-center comments or AI Advisor prompts.
- If a provider is configured but AI Advisor is unavailable, check the Manage Company setting and the user’s access.
- If Splunk shows no events, confirm the HEC configuration, token permissions, selected finding scope, and whether a background export is still running.
- When changing an enabled integration, test the connection and verify the resulting status before relying on scheduled or inbound workflows.
Integration screen
The page below shows the provider cards, test status, discovered-model count, documentation links, and Splunk’s beta connection entry point.
Admin > Integrations in AuditFindings.