Athena

Integrations

Data sources that power Gather AI’s dashboard — status and what each one needs to connect.

0 / 14

connected in stack

Cloud

Amazon Web Services

Sample data

Security Hub findings, Config inventory, and Cost Explorer spend.

How to connect

Create a read-only IAM role (e.g. AchieveDashboardReadOnly) that Athena's task role may assume; add an external ID for the confused-deputy guard.
Point the role at the payer/management account so Cost Explorer returns consolidated org-wide spend.
For findings + resources, allow assuming a role in the Audit (delegated-admin) account — Security Hub aggregates there and resources read from the Control Tower Config aggregator.
Send Achieve the role ARN(s) and external ID (AWS_ROLE_ARN_<ID>, AWS_ROLE_EXTERNAL_ID_<ID>).

Microsoft Azure

Sample data

Defender for Cloud findings, resource inventory, and cost.

How to connect

Register an Entra app in the customer tenant (app-only credentials).
Grant it Reader (resources + Defender findings) and Cost Management Reader (spend) on the subscription.
Send Achieve the tenant ID, client ID, client secret, and subscription ID.

Google Cloud

Sample data

Security Command Center findings, asset inventory, and billing.

How to connect

Create a service account with Security Center, Cloud Asset, and Billing viewer roles.
Enable the BigQuery billing export and grant read on its table.
Send Achieve the service-account key JSON, the project/org ID, and the billing export table.

Identity

Identity provider (Entra ID / Okta)

Sample data

Directory groups that resolve vendor/contractor people rosters live.

How to connect

Entra: grant the Athena app Directory.Read.All (admin-consented) so it can list group members.
Okta: issue a read-only API token with permission to read groups and their members.
Rosters are resolved live from the IdP group — no people records are stored in Athena.

Entra app governance

Sample data

Enterprise-app (service principal) inventory + stale-app detection.

How to connect

Grant the Athena Graph app Application.Read.All (list service principals) and AuditLog.Read.All (sign-in activity), admin-consented.
Sign-in activity needs Entra ID P1; without it, apps still list but staleness can't be measured.
To disable/re-enable stale apps in-app (Phase 2), additionally grant Application.ReadWrite.All — opt-in and gated to owner/admins. Without it the feature stays read-only.

Security Awareness (Attack Simulator)

Sample data

Phishing-simulation results from Microsoft Attack Simulation Training.

How to connect

Grant the Athena Graph app AttackSimulation.Read.All, admin-consented.
Read-only — reads aggregate simulation reports (targets + compromise rate); no per-user data is pulled.
Use "Test connection" to confirm the permission before flipping the go-live toggle on.

Endpoints

Microsoft Intune

Not in stack

Managed-device inventory, encryption, and OS currency (Windows fleet).

How to connect

Grant the Athena Graph app the DeviceManagementManagedDevices.Read.All application permission and admin-consent it.
If Athena's login app already has it, nothing more is needed — the device feed reuses that app against the customer tenant.

Jamf Pro

Sample data

macOS + iOS/iPadOS inventory, FileVault, and OS currency (Apple fleet).

How to connect

In Jamf Pro, create an API Role with read on computers, mobile devices, and inventory.
Create an API Client (OAuth client credentials) bound to that role.
Send Achieve the Jamf base URL, client ID, and client secret (JAMF_BASE_URL / JAMF_CLIENT_ID / JAMF_CLIENT_SECRET).

EDR

CrowdStrike Falcon

Not in stack

Endpoint agent coverage and detections (Windows fleet).

How to connect

Create a Falcon API client with Hosts (read) and Detections (read) scopes.
Send Achieve the client ID, client secret, and Falcon cloud (e.g. us-1).

Jamf Protect

Sample data

macOS endpoint telemetry and alerts (Apple fleet).

How to connect

In Jamf Protect, create an API client (client ID + password).
Send Achieve the Protect base URL, client ID, and client password.

Microsoft Defender

Not in stack

Endpoint protection state reconciled via Microsoft Graph.

How to connect

Reuses the Athena Graph app — grant the required security-read permissions and admin-consent them.
Defender state is reconciled onto the device inventory rather than opted in as its own feed.

Monitoring

Network monitoring

Sample data

Site/link reachability and network posture for the Network view.

How to connect

Connect the network monitoring source for the customer's sites/links.
Once live, the Network view renders real reachability instead of sample data.

Service availability

Sample data

Uptime/health monitors the customer manages for their own services.

How to connect

Define the service/health monitors to track (managed by the customer).
Monitors drive the Service Availability card and its status history.

Teams channel alerts

Not in stack

Watches a Microsoft Teams channel and turns posts into Incidents & Alerts.

How to connect

In the Teams channel, add a Workflow: ••• → Workflows → "Post to a webhook when a new channel message is posted" (Power Automate).
Point the workflow at https://<athena-host>/api/incidents/teams?customer=<id>, sending JSON with the message text, subject, author, and timestamp.
Add the shared secret as an X-Athena-Secret header (Athena side: TEAMS_WEBHOOK_SECRET[_<ID>]); set INCIDENTS_TABLE to enable the store.
Severity is inferred from the message text (🔴/CRITICAL/P1 → critical, 🟠/HIGH/P2 → high); anything else defaults to High so no notice is dropped.

Documents

DocuWare

Sample data

Contract repository + paid-invoice source for Vendor Management.

How to connect

Authorize DocuWare once via the Connect flow on the Vendor Management page (OAuth).
Once connected, contract PDFs and paid invoices load into Vendor Management; terms are extracted by Claude Haiku on Bedrock, then human-verified.

Ticketing

Jira

Sample data

Read-only mirror of the remediation Work board.

How to connect

Create a dedicated per-customer Jira Cloud project for the remediation board.
Create an Atlassian service account with Browse Projects on that project (add Create + Transition Issues only if remediation write-back is enabled).
Explicitly ADD the service account to the project (Project settings → Access → add it to a role that has Browse Projects). Granting permissions through a scheme is NOT enough if the account isn't a member — the connection test reports “project not found or not visible to the service account” until it's added.
Base URL, email, and project key are entered here; the API token is a secret stored in SSM at /achieve/customers/<ref>/JIRA_API_TOKEN — never entered in-app.
Service-account (scoped) tokens authenticate through the Platform API gateway (api.atlassian.com/ex/jira/<cloudId>), not the site URL. The Cloud ID is auto-resolved from the site; set JIRA_CLOUD_ID only to override.
Token scopes (scoped tokens): grant the Jira PLATFORM scopes read:jira-work + write:jira-work (+ read:jira-user). Do NOT grant the Jira Service Management (*:jira-service-management) scopes — Athena files JSM tickets via the platform issue API too, so they're unused. A read-only token passes this connection test (reads only need read scope) but every remediation write 401s with “scope does not match”.
Remediation write-back assigns each closed ticket to the service account. A scoped token can't read /myself, so set JIRA_SERVICE_ACCOUNT_ID to the account's Atlassian accountId (from .../jira/people/<accountId>) — otherwise tickets are created unassigned.
Closed remediation tickets are added to the board's ACTIVE sprint (Jira Software / scrum boards) so they land as completed work in the current sprint — best-effort, so a project with no board or no active sprint still files fine. Uses the Agile API; if it 403s, add the agile scopes to the token (read:board-scope:jira-software + write:sprint:jira-software). Idempotent: each ticket carries a deterministic athena-key-* label and a re-run adopts the existing ticket instead of creating a duplicate.

Jira Service Management

Sample data

Service-desk metrics for the ticket queue the team manages.

How to connect

Reuses the Jira Cloud credentials (base URL + service-account email here; the API token from SSM at /achieve/customers/<ref>/JIRA_API_TOKEN).
Set JSM_PROJECT_KEY[_<ID>] to the service-desk project to monitor — the card shows open backlog, 30-day throughput, resolution speed, and the open queue by priority.
The service account must be a licensed JSM agent on that service project (Browse Projects to read; Create + Transition Issues for improvement-ticket write-back).
Explicitly ADD the service account to the project's Agents (Project settings → Agents / People). A JSM agent license + role permissions alone don't grant visibility until the account is added to the project — otherwise the test reports “project not found or not visible”.
Uses the same token scopes as Jira: read:jira-work + write:jira-work (Athena creates JSM tickets as platform issues via /rest/api/3/issue — the *:jira-service-management / servicedesk scopes are NOT used).

Backup

Sample data

Backup coverage and last-successful-run tracking.

How to connect

AWS Backup: grant the customer's existing read-only role backup:ListProtectedResources so the app can read protected workloads and their last successful backup.
Enable the feed with LIVE_ADAPTERS=backups (or backups@<customer>).
Live coverage currently reflects AWS Backup–protected resources; unprotected-workload detection (a join to the resource inventory) and Azure/Veeam sources are follow-ups.

Integrations

Data sources that power Gather AI’s dashboard — status and what each one needs to connect.

0 / 14

connected in stack

Cloud

Amazon Web Services

Sample data

Security Hub findings, Config inventory, and Cost Explorer spend.

How to connect

Create a read-only IAM role (e.g. AchieveDashboardReadOnly) that Athena's task role may assume; add an external ID for the confused-deputy guard.
Point the role at the payer/management account so Cost Explorer returns consolidated org-wide spend.
For findings + resources, allow assuming a role in the Audit (delegated-admin) account — Security Hub aggregates there and resources read from the Control Tower Config aggregator.
Send Achieve the role ARN(s) and external ID (AWS_ROLE_ARN_<ID>, AWS_ROLE_EXTERNAL_ID_<ID>).

Microsoft Azure

Sample data

Defender for Cloud findings, resource inventory, and cost.

How to connect

Register an Entra app in the customer tenant (app-only credentials).
Grant it Reader (resources + Defender findings) and Cost Management Reader (spend) on the subscription.
Send Achieve the tenant ID, client ID, client secret, and subscription ID.

Google Cloud

Sample data

Security Command Center findings, asset inventory, and billing.

How to connect

Create a service account with Security Center, Cloud Asset, and Billing viewer roles.
Enable the BigQuery billing export and grant read on its table.
Send Achieve the service-account key JSON, the project/org ID, and the billing export table.

Identity

Identity provider (Entra ID / Okta)

Sample data

Directory groups that resolve vendor/contractor people rosters live.

How to connect

Entra: grant the Athena app Directory.Read.All (admin-consented) so it can list group members.
Okta: issue a read-only API token with permission to read groups and their members.
Rosters are resolved live from the IdP group — no people records are stored in Athena.

Entra app governance

Sample data

Enterprise-app (service principal) inventory + stale-app detection.

How to connect

Grant the Athena Graph app Application.Read.All (list service principals) and AuditLog.Read.All (sign-in activity), admin-consented.
Sign-in activity needs Entra ID P1; without it, apps still list but staleness can't be measured.
To disable/re-enable stale apps in-app (Phase 2), additionally grant Application.ReadWrite.All — opt-in and gated to owner/admins. Without it the feature stays read-only.

Security Awareness (Attack Simulator)

Sample data

Phishing-simulation results from Microsoft Attack Simulation Training.

How to connect

Grant the Athena Graph app AttackSimulation.Read.All, admin-consented.
Read-only — reads aggregate simulation reports (targets + compromise rate); no per-user data is pulled.
Use "Test connection" to confirm the permission before flipping the go-live toggle on.

Endpoints

Microsoft Intune

Not in stack

Managed-device inventory, encryption, and OS currency (Windows fleet).

How to connect

Grant the Athena Graph app the DeviceManagementManagedDevices.Read.All application permission and admin-consent it.
If Athena's login app already has it, nothing more is needed — the device feed reuses that app against the customer tenant.

Jamf Pro

Sample data

macOS + iOS/iPadOS inventory, FileVault, and OS currency (Apple fleet).

How to connect

In Jamf Pro, create an API Role with read on computers, mobile devices, and inventory.
Create an API Client (OAuth client credentials) bound to that role.
Send Achieve the Jamf base URL, client ID, and client secret (JAMF_BASE_URL / JAMF_CLIENT_ID / JAMF_CLIENT_SECRET).

EDR

CrowdStrike Falcon

Not in stack

Endpoint agent coverage and detections (Windows fleet).

How to connect

Create a Falcon API client with Hosts (read) and Detections (read) scopes.
Send Achieve the client ID, client secret, and Falcon cloud (e.g. us-1).

Jamf Protect

Sample data

macOS endpoint telemetry and alerts (Apple fleet).

How to connect

In Jamf Protect, create an API client (client ID + password).
Send Achieve the Protect base URL, client ID, and client password.

Microsoft Defender

Not in stack

Endpoint protection state reconciled via Microsoft Graph.

How to connect

Reuses the Athena Graph app — grant the required security-read permissions and admin-consent them.
Defender state is reconciled onto the device inventory rather than opted in as its own feed.

Monitoring

Network monitoring

Sample data

Site/link reachability and network posture for the Network view.

How to connect

Connect the network monitoring source for the customer's sites/links.
Once live, the Network view renders real reachability instead of sample data.

Service availability

Sample data

Uptime/health monitors the customer manages for their own services.

How to connect

Define the service/health monitors to track (managed by the customer).
Monitors drive the Service Availability card and its status history.

Teams channel alerts

Not in stack

Watches a Microsoft Teams channel and turns posts into Incidents & Alerts.

How to connect

In the Teams channel, add a Workflow: ••• → Workflows → "Post to a webhook when a new channel message is posted" (Power Automate).
Point the workflow at https://<athena-host>/api/incidents/teams?customer=<id>, sending JSON with the message text, subject, author, and timestamp.
Add the shared secret as an X-Athena-Secret header (Athena side: TEAMS_WEBHOOK_SECRET[_<ID>]); set INCIDENTS_TABLE to enable the store.
Severity is inferred from the message text (🔴/CRITICAL/P1 → critical, 🟠/HIGH/P2 → high); anything else defaults to High so no notice is dropped.

Documents

DocuWare

Sample data

Contract repository + paid-invoice source for Vendor Management.

How to connect

Authorize DocuWare once via the Connect flow on the Vendor Management page (OAuth).
Once connected, contract PDFs and paid invoices load into Vendor Management; terms are extracted by Claude Haiku on Bedrock, then human-verified.

Ticketing

Jira

Sample data

Read-only mirror of the remediation Work board.

How to connect

Create a dedicated per-customer Jira Cloud project for the remediation board.
Create an Atlassian service account with Browse Projects on that project (add Create + Transition Issues only if remediation write-back is enabled).
Explicitly ADD the service account to the project (Project settings → Access → add it to a role that has Browse Projects). Granting permissions through a scheme is NOT enough if the account isn't a member — the connection test reports “project not found or not visible to the service account” until it's added.
Base URL, email, and project key are entered here; the API token is a secret stored in SSM at /achieve/customers/<ref>/JIRA_API_TOKEN — never entered in-app.
Service-account (scoped) tokens authenticate through the Platform API gateway (api.atlassian.com/ex/jira/<cloudId>), not the site URL. The Cloud ID is auto-resolved from the site; set JIRA_CLOUD_ID only to override.
Token scopes (scoped tokens): grant the Jira PLATFORM scopes read:jira-work + write:jira-work (+ read:jira-user). Do NOT grant the Jira Service Management (*:jira-service-management) scopes — Athena files JSM tickets via the platform issue API too, so they're unused. A read-only token passes this connection test (reads only need read scope) but every remediation write 401s with “scope does not match”.
Remediation write-back assigns each closed ticket to the service account. A scoped token can't read /myself, so set JIRA_SERVICE_ACCOUNT_ID to the account's Atlassian accountId (from .../jira/people/<accountId>) — otherwise tickets are created unassigned.
Closed remediation tickets are added to the board's ACTIVE sprint (Jira Software / scrum boards) so they land as completed work in the current sprint — best-effort, so a project with no board or no active sprint still files fine. Uses the Agile API; if it 403s, add the agile scopes to the token (read:board-scope:jira-software + write:sprint:jira-software). Idempotent: each ticket carries a deterministic athena-key-* label and a re-run adopts the existing ticket instead of creating a duplicate.

Jira Service Management

Sample data

Service-desk metrics for the ticket queue the team manages.

How to connect

Reuses the Jira Cloud credentials (base URL + service-account email here; the API token from SSM at /achieve/customers/<ref>/JIRA_API_TOKEN).
Set JSM_PROJECT_KEY[_<ID>] to the service-desk project to monitor — the card shows open backlog, 30-day throughput, resolution speed, and the open queue by priority.
The service account must be a licensed JSM agent on that service project (Browse Projects to read; Create + Transition Issues for improvement-ticket write-back).
Explicitly ADD the service account to the project's Agents (Project settings → Agents / People). A JSM agent license + role permissions alone don't grant visibility until the account is added to the project — otherwise the test reports “project not found or not visible”.
Uses the same token scopes as Jira: read:jira-work + write:jira-work (Athena creates JSM tickets as platform issues via /rest/api/3/issue — the *:jira-service-management / servicedesk scopes are NOT used).

Backup

Sample data

Backup coverage and last-successful-run tracking.

How to connect

AWS Backup: grant the customer's existing read-only role backup:ListProtectedResources so the app can read protected workloads and their last successful backup.
Enable the feed with LIVE_ADAPTERS=backups (or backups@<customer>).
Live coverage currently reflects AWS Backup–protected resources; unprotected-workload detection (a join to the resource inventory) and Azure/Veeam sources are follow-ups.