#261 [Integration] SIEM, Jira/ServiceNow & OPA Policy Support

[RaminNietzsche]

Problem

CVE Radar notifies via Slack, Teams, email, webhooks, and per-tenant channel secrets (#245). Security operations need SIEM export (CEF/JSON), ITSM tickets (Jira/ServiceNow), and policy gates (OPA/Rego) before auto-remediation or mass notify.

Current state

• Notification adapters in server/services/notifications/
• Webhook payload is JSON; no CEF/syslog
• No Jira/ServiceNow clients; no OPA sidecar

Goals

• SIEM — optional SIEM_WEBHOOK_URL or syslog (RFC5424) with normalized event schema
• Jira — create/update issue on critical KEV match (JIRA_* env, idempotent by CVE id)
• ServiceNow — incident table API (configurable)
• OPA — POST /api/v1/policy/evaluate proxy or embedded @open-policy-agent/opa-wasm for notify/scan decisions
• OpenAPI + extended-docs ch.07 integrations (×6)

Out of scope (v1)

• Bi-directional Jira sync (status from Radar → Jira only)
• Custom SOAR playbooks

Depends on

• Tenant notification prefs ([Sub #124] Tenant-scoped notification preferences (PostgreSQL) #170) and channel secrets (Notifications phase 2: per-tenant webhook URLs in PostgreSQL #245)

Size

XL — split into SIEM (M), Jira (L), OPA (L) sub-PRs if needed

[github-actions]

The issue outlines a request for integrating enterprise security tools, including support for SIEM webhooks (ELK/Splunk), Jira/ServiceNow ticketing systems, and OPA policy-as-code functionality, with specific acceptance criteria targeting these capabilities.