# IDR-004: Integrate with SIEM, SOAR, ticketing, and identity systems


- Area: AI Detection & Response

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: GOV-003
- URL: /r/IDR-004

**Acceptance criteria:** Use webhooks or APIs to consume relevant employee identity context and to push alerts into logging and response systems.

**Why it matters:** Security alerts need relevant context and need to stream to centralized repositories.

**How to verify:** Pilot events can be enriched with employee identity context and streamed to your SIEM.

**OWASP adoption context:** Operational integration with security, identity and service-management systems is a cross-tier governance capability.

**Mappings:**
- NIST CSF 2.0: DE.AE-06; SOC 2: CC7.3, CC7.4 — Structured webhooks and APIs can route adverse-event evidence into authorized staff’s monitoring, triage and incident-response workflows. A connector contributes only when delivery, ingestion, successful processing and the associated operational workflow are configured and exercised; it does not itself establish incident decisions or response ownership.
- NIST AI RMF: GOVERN 4.3 — Feeding AI events into enterprise incident, ticket and evidence workflows enables organizational information sharing about AI issues. The connected teams still need to operate the associated reporting and response practices.
- ISO 27001: A.5.25, A.8.15 — Structured telemetry and incident-ticket integration supply logging, analysis and event-triage inputs. Demonstrate delivery, ingestion, successful processing, correlation and triage routing. An endpoint alone does not establish incident decisions, response ownership or completed response.