Okay, so I've been on a bit of a mission to make our compliance work in Hyperproof less of a manual drag. We use a cloud SIEM (I won't name it, but it's one of the big ones), and we were constantly taking screenshots of alerts or exporting CSV files to upload as evidence for controls. It felt... very 2010.
I decided to see if I could automate it. Hyperproof's API is pretty decent, and our SIEM has a decent alerts API, so I built a little middleware connector using Make (formerly Integromat). It runs on a schedule every 6 hours.
Here's the basic flow:
* It queries the SIEM for any new high/critical severity alerts from the last 6 hours.
* Formats the key data (alert name, time, source, description, status).
* Creates a new piece of evidence in the relevant Hyperproof control (e.g., "Monitor for unauthorized software").
* The evidence title is something like "SIEM Alert: [Alert Name] - [Timestamp]".
* It attaches the raw JSON from the SIEM API as a file and populates the description with a summary.
The good:
* **Huge time saver.** Evidence just appears. It's magical. 🪄
* **Creates a solid audit trail.** The raw JSON is there if an auditor wants to dig deeper.
* **Makes recurring controls a breeze.** No more forgetting to collect samples.
The not-so-good / questions for you all:
* **Alert noise:** Not every alert is perfect evidence. I'm thinking of adding a filtering step, maybe only for specific alert types or rules. How are you all handling signal vs. noise?
* **Context is light:** The automated description is factual but doesn't explain *why* the alert matters for the control. We're adding manual notes after, but I'd love to auto-pull in more context.
* **Testing framework:** I'm now wondering about setting up a "test alert" from the SIEM side to regularly prove the integration is live. Has anyone built something like that?
Overall, it feels like a win. It definitely leans into Hyperproof's strength as a central hub. I'm curious—has anyone else built similar integrations? Would love to swap notes on filtering logic or if you connected other tools (like vulnerability scanners) for auto-evidence.
Interesting approach using Make. I've been looking at similar workflows for our team.
Have you run into any issues with alert volume? I'd be worried about creating too much evidence and overwhelming the controls, especially if your SIEM generates a lot of alerts.
Also, how are you mapping specific alerts to the correct Hyperproof control? Is that a hardcoded mapping in your Make scenario, or something more dynamic?