Skip to main content
Integrations

Wire training into your security stack

Every training and phishing-simulation event can flow into the tools your security team already runs. Assign training straight from your service desk, your SOAR, and your incident tools, chart human risk in Grafana and New Relic, feed your SIEM, and post live evidence to Vanta and Drata. New hires can be provisioned and enrolled straight from your HRIS. It all runs on a token-authenticated REST API and signed webhooks.

Integrations diagram: training and simulation events on the left flowing through a REST API and signed webhooks to destinations on the right, including a service desk, a SOAR playbook, Slack and Microsoft Teams, a SIEM, observability dashboards, and live Vanta and Drata evidence

Connected platforms

How RansomLeak connects to your stack

Four steps from a security event to your tools, with the wiring handled for you.

01

Choose a destination

Point events at your service desk, a SOAR playbook, a webhook, Slack or Teams, your SIEM, an observability dashboard, or a live evidence sync like Vanta or Drata. Every destination is configured in the same integrations console, per tenant.

02

Pick the events

Subscribe to what you care about: exercise and course completions, badges, certificate renewals, learning-path milestones, and campaign deadlines. Eleven event types in all.

03

Secure the connection

Webhooks are signed with HMAC-SHA256 and a per-endpoint secret. The REST API uses per-tenant bearer tokens with scoped access, so a key only reaches what you grant it.

04

Watch it flow

Send a test event, read the response, and review a full delivery log. Failed deliveries retry on a backoff schedule, so a brief outage does not drop the event.

Build on a real API and signed webhooks

The same building blocks our own partners use, documented and available to your team.

Integrations console showing a webhook endpoint with selected events, an HMAC signing secret, a recent delivery log with status codes, and a REST API token panel

Token-authenticated REST API

Manage users, teams, campaigns, and assignments, and pull analytics over a documented REST API. Per-tenant tokens carry scoped access, and the endpoint reference ships with OpenAPI docs.

Signed, reliable webhooks

Eleven events, from exercise and course completions to badge, certificate, learning-path, and campaign milestones, each signed with HMAC-SHA256 and retried with exponential backoff.

Delivery logs and test sends

Fire a test event, watch the response, and review every delivery with its status and body. A misconfigured endpoint is obvious before it matters.

Provision and enroll people from your HRIS

The joins, role changes, and departures you already record in HR become the right training, assigned and retired automatically, with no roster to keep current.

An HRIS console: a new hire from HiBob provisioned and enrolled in onboarding, a role change synced through Merge reassigning a curriculum, and an employee-lifecycle panel mapping joins, role changes, and departures to training actions

HiBob, connected natively

Authorize HiBob over its own OAuth and RansomLeak reads your directory on a read-only pull. A new hire is provisioned, licensed, and enrolled in onboarding within about a minute; a role or department change reassigns the matching curriculum; and a departure disables the account while preserving its training history. The full flow is in the HiBob setup guide.

Any other HRIS through Merge

Not on HiBob? A single Merge connection covers Workday, ADP, Rippling, BambooHR, and 80-plus other systems, so the same lifecycle runs whatever your HR stack is. People are matched by work email, so your HRIS and SCIM provisioning never fight over the same person. The full system list and setup are in the Merge setup guide.

A lifecycle, not a one-off import

The first sync provisions your existing workforce as a baseline and marks them already onboarded, so only genuinely new hires get onboarding training afterward. An hourly reconcile catches anything a webhook misses, and disconnecting clears the mirrored directory while leaving your users and their history untouched.

Notify people where they already work

Training updates reach your team in the channels and calendars they check every day.

A Slack channel and a Microsoft Teams channel each showing a training-completion card, next to a calendar app displaying a training-deadline event subscribed from an ICS feed

Slack and Microsoft Teams

Post completion alerts, overdue nudges, and campaign milestones into a Slack or Teams channel through an incoming webhook. Setup is pasting one URL. The RansomLeak app for Slack adds personal reminders, direct-messaging each employee the moment training is assigned or a deadline nears, with a one-click link to the lesson.

Calendar deadlines

Each employee can subscribe to a personal calendar feed, so training deadlines appear in whatever app they already use, with a reminder the day before each one.

One console for every destination

Webhooks, Slack, Teams, and the API are all managed in the same place, per tenant, each with its own test button and on or off switch.

Turn any security signal into training

A ticket, an incident, or a detection becomes a short assigned lesson for the person involved, with completion written back where the work already lives.

A security signal on the left, a service desk ticket and an incident, flowing through a workflow action in the center to an assigned RansomLeak exercise on the right, with completion written back as a note

Your service desk

When a security-relevant request lands in Jira Service Management, Freshservice, or ManageEngine ServiceDesk Plus, RansomLeak assigns a short module to the affected employee and writes the assignment and its completion back onto the ticket. Each app maps your request types to lessons, and a repeated update never double-assigns. The full flow is in the Jira setup guide.

Incidents and on-call

RansomLeak for PagerDuty turns an incident into a teaching moment. The responder gets a five to ten minute module, and the completion posts back as a note on the incident.

SOAR playbooks

Assign training from inside the automation you already run. A Cortex XSOAR content pack and a reusable Tines story let a phishing or insider-risk playbook assign the matching lesson and read completion back through a callback.

Detections

When a Datadog detection rule fires on risky user activity, a workflow action assigns the matching exercise to the people involved, so the response includes coaching, not just another alert in the queue. The full flow is in the Datadog setup guide.

Watch human risk where you watch everything else

Human-risk score, training completion, and phishing outcomes belong on the same dashboards as the rest of your operational telemetry.

A monitoring dashboard with a human-risk-score gauge, a training-completion stat, a phishing click-rate panel, a human-risk-over-time chart, and an assignments-by-category bar chart

Grafana data source

An open-source Grafana data source plugin queries RansomLeak live, so per-team human-risk score, completion rate, overdue assignments, and phishing click and report rates chart next to your other panels. A ready-made Human Risk dashboard ships with the plugin.

New Relic quickstart

A New Relic quickstart adds pre-built dashboards and alert conditions for training and phishing events, plus a human-risk-score gauge, streamed in from RansomLeak with no agent to run.

Datadog and your SIEM

Training and human-risk events also stream into Datadog and any SIEM through the same export and webhooks, so awareness data sits alongside the signals your SOC already watches.

Feed your SIEM and prove compliance automatically

Awareness data belongs next to your other security signals, and your evidence should write itself.

A SIEM ingesting a JSON export of security events on one side, and a panel of connected compliance partners on the other, with Vanta and Drata both marked connected and live

Security-event export for your SIEM

Pull training and security events as JSON or CSV from a dedicated export endpoint, filtered by event type and date, so your SIEM can ingest awareness data alongside everything else it polls.

Live Vanta evidence

Connect Vanta over OAuth, and training completions and user-account status post automatically as evidence for SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, and CCPA controls, on an hourly sync and on every completion. The full flow is in the Vanta setup guide.

Live Drata evidence

Stream completed modules into Drata as records on a Custom Connection. A Custom Test maps them to your security-awareness controls, so training evidence for SOC 2, ISO 27001, HIPAA, PCI DSS, and NIS2 stays current between audits, with no manual export. The full flow is in the Drata setup guide.

Frequently Asked Questions

Does RansomLeak have an API?

Yes. RansomLeak exposes a REST API secured with per-tenant bearer tokens and scoped access. You can manage users, teams, campaigns, and assignments, and pull analytics, and the endpoint reference ships with OpenAPI documentation.

Tokens are generated in the admin console, and a key only reaches the scopes you grant it.

What events can trigger a webhook?

Eleven event types, including exercise and course completions, badge awards, certificate renewals and expirations, learning-path assignment and completion, and campaign assignment, deadline, and completion milestones.

Every webhook is signed with HMAC-SHA256 using a per-endpoint secret, retried with exponential backoff if your endpoint is briefly unavailable, and recorded in a delivery log you can inspect.

Can I assign training from my service desk?

Yes. RansomLeak has dedicated apps for Jira Service Management, Freshservice, and ManageEngine ServiceDesk Plus. When a security-relevant request comes in, the app assigns a short module to the affected employee, then writes the assignment and its completion back onto the ticket as a comment or note.

An admin maps each request type or category to a lesson, picks who counts as the affected user, and the apps are idempotent, so a repeated update never double-assigns and a re-delivered completion never double-posts.

Can I assign training from PagerDuty, Cortex XSOAR, or Tines?

Yes. RansomLeak for PagerDuty assigns a module to an incident responder and posts completion back as a note on the incident. For SOAR, a Cortex XSOAR content pack and a reusable Tines story let a playbook assign the matching lesson and read the result back.

All three call the same assignment API, so a phishing, insider-risk, or access playbook can end with coaching for the person involved and a completion you can act on.

Can I see human risk in Grafana or New Relic?

Yes. An open-source Grafana data source plugin queries RansomLeak live, so per-team human-risk score, completion rate, overdue assignments, and phishing click and report rates chart next to your other panels. A ready-made Human Risk dashboard ships with it.

A New Relic quickstart adds pre-built dashboards and alert conditions for the same training and phishing events plus a human-risk-score gauge, streamed in with no agent to run.

Can I get training notifications in Slack or Microsoft Teams?

Yes, in two ways. For channels, post completion alerts, overdue reminders, and campaign milestones into a Slack or Microsoft Teams channel through an incoming webhook. You create the webhook in your workspace, paste the URL, and send a test message.

For people, install the RansomLeak app for Slack. It direct-messages each employee when they have training assigned or due, with a one-click link to the lesson and a button to mute reminders. The Microsoft Teams app is on the way.

How do I install the RansomLeak app for Slack?

A workspace admin connects it once from the RansomLeak console, under Admin → Integrations → Slack → Connect Slack, and approves the requested permissions. There is no per-employee setup.

After that, anyone with assigned training gets a direct message carrying an Open training button and a Mute reminders button. Employees can pause, resume, or check reminders themselves with /ransomleak mute, /ransomleak unmute, and /ransomleak status. The app only messages people who have training to complete, and never posts to channels.

Can I send training data to my SIEM?

Yes. A dedicated export endpoint returns training and security events as JSON or CSV, filterable by event type and date range, so your SIEM can poll it on a schedule and ingest awareness data alongside its other sources.

It is a pull-based export API rather than a CEF or syslog connector, which keeps the data on a path your team controls.

Does RansomLeak integrate with Datadog?

Yes. When a Datadog detection rule fires on risky user activity, a workflow action assigns the matching RansomLeak exercise to the people involved, and training and human-risk events stream into Datadog so you can watch them in your SOC pipeline.

The assignment runs as a Datadog Workflow Automation action, so it fits the detection rules and playbooks your team already maintains, and the response includes coaching rather than just an alert.

Does RansomLeak integrate with Vanta?

Yes, and it is live. Connect Vanta over OAuth, and training completions and user-account status flow in automatically as evidence for SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, and CCPA controls.

The sync runs hourly and on every completion, so your control evidence is current whenever an auditor asks.

Does RansomLeak integrate with Drata?

Yes. Completed modules stream into Drata as records on a Custom Connection, and a Custom Test maps them to your security-awareness controls.

That keeps training evidence for SOC 2, ISO 27001, HIPAA, PCI DSS, and NIS2 current between audits, with no manual export.

Can RansomLeak sync users from my HRIS?

Yes. Connect HiBob over its native OAuth, or reach Workday, ADP, Rippling, BambooHR, and 80-plus other systems through a single Merge connection. RansomLeak reads your directory on a read-only pull and turns it into a training lifecycle: new hires are provisioned and enrolled in onboarding, role and department changes reassign the matching curriculum, departures disable access while keeping the training history, and rehires are reactivated.

People are matched by work email, so your HRIS and SCIM provisioning stay in step rather than working against each other. The first sync records your existing workforce as a baseline, so only genuinely new hires receive onboarding afterward. Setup is in the HiBob guide.

How do single sign-on and user provisioning work?

RansomLeak supports SAML 2.0 single sign-on and SCIM 2.0 provisioning with Okta, Microsoft Entra ID, and any standards-compliant identity provider. Because SSO and SCIM govern access to the platform itself, they live with the Cloud LMS. Step-by-step setup is in the Okta SSO, Okta SCIM, Entra SSO, and Entra SCIM guides.

If your HR system is the source of truth instead, RansomLeak syncs the employee lifecycle straight from your HRIS through HiBob or Merge, covered above.

See RansomLeak in Action

Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.