# Cantina Documentation - [Welcome to Cantina](https://docs.cantina.security/introduction.md): Cantina is an agentic security platform that finds the issues that matter, prioritizes them against real exposure, remediates them, and proves the loop is closed. - [How Cantina works: the loop](https://docs.cantina.security/how-it-works.md): How Cantina runs security work as a single loop: find, prioritize, remediate, and prove every issue closed with evidence. - [Vision and approach](https://docs.cantina.security/vision-and-approach.md): Cantina's approach to security: machine intelligence paired with world-class human expertise, with the human always in the driver's seat. - [Platform overview](https://docs.cantina.security/platform/overview.md): One agentic security platform with two products, Apex and Clarion, and a network of human expertise, all running the same loop. - [The security loop](https://docs.cantina.security/platform/the-loop.md): The core model behind Cantina: how a security issue moves from first signal to verified closure across find, prioritize, remediate, and prove. - [Products at a glance](https://docs.cantina.security/platform/products.md): Apex for code security and Clarion for security operations, two products sharing one platform, one loop, and one record. - [Trust, auditability, and human control](https://docs.cantina.security/platform/trust.md): How Cantina keeps autonomous security work under the team's control and on the record with human approval, verified closure, and full audit trails. - [Apex application security documentation](https://docs.cantina.security/apex.md): Set up Apex to scan repositories and pull requests for exploitable vulnerabilities, verify findings, and run scans through the app, CLI, or API. - [Client onboarding guide](https://docs.cantina.security/apex/onboarding.md): How repository access works, what Apex needs during setup, and what to send before the first scan. - [Apex scan manual](https://docs.cantina.security/apex/scan-manual.md): A practical guide to scoping scans, timing them well, and giving Apex enough context to return useful findings. - [Scheduled scans](https://docs.cantina.security/apex/scheduled-scans.md): Run recurring workspace scans or fix reviews on a fixed cadence so monitoring keeps up with the code without manual effort. - [Apex CLI guide](https://docs.cantina.security/apex/cli.md): Install Apex CLI, wire it into Claude Code, Codex CLI, or GitHub Copilot CLI, and run scans from the terminal or an agent. - [Apex service API](https://docs.cantina.security/apex/api.md): Run Apex from serverless functions, CI, and internal audit hubs with an organization service key and a REST/JSON workflow. - [Apex API agent environment](https://docs.cantina.security/apex/api-agent-environment.md): A copyable REST-only prompt that selects a source and starts a Standard Apex scan, then returns handoff links immediately. - [Clarion security operations documentation](https://docs.cantina.security/clarion.md): Set up Clarion to connect security tools, correlate alerts, preserve business context, and run governed response with security agents. - [Getting started](https://docs.cantina.security/clarion/getting-started.md): Set up your Clarion workspace, create your first agent, and start triaging issues. - [Measuring your ROI](https://docs.cantina.security/clarion/roi/measuring-roi.md): Turn the numbers on your Analytics page into hours and dollars saved. - [Getting the most value](https://docs.cantina.security/clarion/roi/getting-the-most-value.md): The setup choices that most increase the time and money Clarion saves you. - [Knowledge base](https://docs.cantina.security/clarion/knowledge-base.md): A collection of answers to frequently asked questions. - [Introduction](https://docs.cantina.security/clarion/learn.md): An overview of how Clarion's core concepts fit together, from incoming events to issues to response. - [Issues](https://docs.cantina.security/clarion/learn/issues.md): How issues get created, and what you can do with one. - [Tasks](https://docs.cantina.security/clarion/learn/tasks.md): Track follow-up work, agent improvements, and operational actions across your team. - [Agents](https://docs.cantina.security/clarion/learn/agents.md): Learn how agents triage issues, investigate them, and execute response actions in your security stack. - [Skills](https://docs.cantina.security/clarion/learn/skills.md): Reusable playbooks that teach agents how to handle specific classes of tasks to a known standard. - [Tools](https://docs.cantina.security/clarion/learn/tools.md): The integrations agents use to take action: send messages, change DNS, file tickets, and more. - [AI chat](https://docs.cantina.security/clarion/learn/chat.md): The same agent runtime, driven by you — threat hunting across your stack, remediation, and building agents by asking. - [Notifications](https://docs.cantina.security/clarion/learn/notifications.md): Multiple destinations, agent-chosen routing, direct messages, and the clarification types agents use to reach you. - [Settings](https://docs.cantina.security/clarion/learn/settings.md): Configure your workspace, manage members and access, and customize how your team works in Clarion. - [AWS](https://docs.cantina.security/clarion/integrations/aws.md): Connect your AWS account to Clarion for CloudTrail events, CloudWatch alarms, GuardDuty findings, and IAM agent tools. - [EventBridge and SNS](https://docs.cantina.security/clarion/integrations/aws/eventbridge.md): Connect your AWS account to Clarion for CloudTrail events, CloudWatch alarms, GuardDuty findings, Amazon Inspector vulnerabilities, and IAM agent tools. - [CloudTrail via existing S3 bucket](https://docs.cantina.security/clarion/integrations/aws/cloudtrail-s3.md): Ingest CloudTrail events into Clarion from an existing S3 bucket using S3 event notifications and SNS — ideal for centralized, organization-wide logging. - [Google Cloud](https://docs.cantina.security/clarion/integrations/google-cloud.md): Connect Google Cloud monitors and runtime credentials for agent triage. - [Cloud Logging](https://docs.cantina.security/clarion/integrations/google-cloud/cloud-logging.md): Send Google Cloud audit logs to Clarion with one monitor per GCP project. - [Cloud Monitoring](https://docs.cantina.security/clarion/integrations/google-cloud/cloud-monitoring.md): Send Google Cloud Monitoring incidents to Clarion from selected alert policies. - [Security Command Center](https://docs.cantina.security/clarion/integrations/google-cloud/security-command-center.md): Send active Google Security Command Center findings to Clarion. - [Cloudflare](https://docs.cantina.security/clarion/integrations/cloudflare.md): Connect Cloudflare to Clarion for Cloudflare Notifications webhooks, Logpush detection monitors, and optional API-powered DNS and analytics agent tools. - [Logpush](https://docs.cantina.security/clarion/integrations/cloudflare/logpush.md): Send Cloudflare firewall_events Logpush batches to Clarion for L7 DDoS-like detection windows. - [Threat Intel](https://docs.cantina.security/clarion/integrations/threat-intel.md): Bring vulnerability advisories, supply chain threats, and security feeds into Clarion for AI-powered triage and response. - [Webhook](https://docs.cantina.security/clarion/integrations/threat-intel/webhook.md): Send structured vulnerability advisories and supply chain threats to Clarion via a signed webhook for AI-powered triage. - [RSS Feed](https://docs.cantina.security/clarion/integrations/threat-intel/rss-feed.md): Subscribe Clarion to an RSS or Atom feed — security blogs, CERT/CSIRT bulletins, advisory feeds — and open an issue for each newly-published item. - [Okta](https://docs.cantina.security/clarion/integrations/okta.md): Clarion is a security operations platform that helps teams detect, investigate, and respond to identity and access threats. Install the Clarion Okta app from the Okta Integration Network to connect your Okta org to Clarion. - [Microsoft Entra ID](https://docs.cantina.security/clarion/integrations/microsoft-entra-id.md): Connect Microsoft Entra ID (Azure AD) to Clarion to enforce enterprise single sign-on for your organization. - [Microsoft Sentinel](https://docs.cantina.security/clarion/integrations/microsoft-sentinel.md): Connect Microsoft Sentinel to Clarion to poll incidents as issues and give triage agents Sentinel and Defender investigation tools. - [Microsoft Teams](https://docs.cantina.security/clarion/integrations/microsoft-teams.md): Connect Microsoft Teams to Clarion so agents can post notifications to channels and chats, request approvals via Adaptive Cards, and reach the right people during incidents. - [Google Workspace](https://docs.cantina.security/clarion/integrations/google-workspace.md): Connect Google Workspace Alert Center to Clarion for real-time security alert ingestion and AI-powered triage. - [Google Calendar](https://docs.cantina.security/clarion/integrations/google-calendar.md): Sync the on-call rotation to a Google Calendar so anyone on the team can see who is on call at a glance. - [JumpCloud](https://docs.cantina.security/clarion/integrations/jumpcloud.md): Connect JumpCloud to Clarion to ingest directory and identity events via Insights Rule webhooks and enable agent-driven investigation and response using a JumpCloud service account. - [1Password](https://docs.cantina.security/clarion/integrations/1password.md): Connect 1Password to Clarion to monitor audit events, sign-in attempts, and item usage events from your 1Password Business account. - [NinjaOne](https://docs.cantina.security/clarion/integrations/ninjaone.md): Connect NinjaOne to Clarion to triage RMM conditions, let agents look up device health, patching, software and access during an investigation, and optionally run scripts or restart services with human approval. - [Swif](https://docs.cantina.security/clarion/integrations/swif.md): Connect Swif to Clarion so your managed device fleet and employee directory are discovered into the Brain as assets. - [Vanta](https://docs.cantina.security/clarion/integrations/vanta.md): Connect a Manage Vanta Application so Clarion agents can read live compliance and vendor-risk data and perform separately approved writes. - [CrowdStrike Falcon](https://docs.cantina.security/clarion/integrations/crowdstrike.md): Connect CrowdStrike Falcon to Clarion to poll detections and cases from your Falcon tenant and surface them as signals and issues. - [SentinelOne](https://docs.cantina.security/clarion/integrations/sentinelone.md): Forward Singularity Endpoint threat detections from SentinelOne into Clarion as issues. - [Huntress](https://docs.cantina.security/clarion/integrations/huntress.md): Connect Huntress to Clarion for endpoint detection and response (EDR) data enrichment during issue triage. - [Microsoft Defender XDR](https://docs.cantina.security/clarion/integrations/microsoft-defender-xdr.md): Poll Defender XDR security incidents from Microsoft Graph and triage them with identity-aware playbooks. - [Wiz](https://docs.cantina.security/clarion/integrations/wiz.md): Connect Wiz to Clarion to ingest prioritized cloud security Issues, sync your cloud inventory, and let agents investigate and comment back in Wiz. - [Falco](https://docs.cantina.security/clarion/integrations/falco.md): Runtime security on your hosts over SSH — ingest Falco alerts and let agents inspect and kill suspicious sessions. - [Splunk](https://docs.cantina.security/clarion/integrations/splunk.md): Connect Splunk to Clarion so agents can forward an issue's details and original payload to your Splunk HTTP Event Collector (HEC) during triage. - [Datadog](https://docs.cantina.security/clarion/integrations/datadog.md): Connect Datadog so agents can query your logs, APM, events, and service catalog — and manage Datadog cases — during triage. - [Grafana](https://docs.cantina.security/clarion/integrations/grafana.md): Connect Grafana to Clarion to receive alerting notifications for AI-powered triage and response. - [Better Stack](https://docs.cantina.security/clarion/integrations/betterstack.md): Uptime monitoring, incident alerts, and telemetry queries — connect Better Stack so agents can investigate and act on outages. - [Status Page](https://docs.cantina.security/clarion/integrations/status-page.md): Crawl a third-party status page and raise an issue when your vendors publish an incident. - [DNS Monitor](https://docs.cantina.security/clarion/integrations/dns.md): Built-in DNS monitoring — watch your zones for record, subdomain, and email-authentication changes with no external service. - [Envoy](https://docs.cantina.security/clarion/integrations/envoy.md): Workplace context — office locations, employees, and who is signed in on site — for physical-world corroboration during triage. - [Hypernative](https://docs.cantina.security/clarion/integrations/hypernative.md): Connect Hypernative to Clarion for on-chain threat monitoring and AI-powered alert triage. - [Hexagate](https://docs.cantina.security/clarion/integrations/hexagate.md): Connect Hexagate to Clarion to receive on-chain monitor alerts for AI-powered triage and response. - [Tenderly](https://docs.cantina.security/clarion/integrations/tenderly.md): Connect Tenderly to Clarion to receive smart contract monitoring alerts for AI-powered triage and response. - [Guardrail](https://docs.cantina.security/clarion/integrations/guardrail.md): Connect Guardrail to Clarion to receive Guard alerts for AI-powered triage and response. - [Cantina Bug Bounty](https://docs.cantina.security/clarion/integrations/cantina-bbp.md): Route Cantina bug bounty submissions into Clarion for automatic triage, spam filtering, and remediation PRs. - [Iru](https://docs.cantina.security/clarion/integrations/iru.md): Connect Iru to Clarion so agents can look up devices, users, applications, and vulnerabilities from your Iru tenant during issue triage. - [Apex](https://docs.cantina.security/clarion/integrations/apex.md): Connect Apex to Clarion to ingest security findings from your repositories and code scanning workflows. - [NightVision](https://docs.cantina.security/clarion/integrations/nightvision.md): Bring DAST findings into Clarion so agents can look up vulnerability issues, scans, and targets during triage. - [GitHub](https://docs.cantina.security/clarion/integrations/github.md): Connect GitHub so Clarion ingests repository security events, discovers your repos into the Brain, and lets agents open remediation pull requests. - [Vercel](https://docs.cantina.security/clarion/integrations/vercel.md): Monitor deployments, runtime errors, firewall attacks, and domain health — and sweep for unintended public exposure. - [Supabase](https://docs.cantina.security/clarion/integrations/supabase.md): Give agents read-only access to a Supabase project — security advisors, auth and Postgres logs, schema, and SQL — during an investigation. - [Replit](https://docs.cantina.security/clarion/integrations/replit.md): Connect your Replit Enterprise Account to Clarion so the exposure agent can find deployments that are reachable from the public internet but were never meant to be. - [Jira](https://docs.cantina.security/clarion/integrations/jira.md): Connect Jira Cloud to Clarion with an Atlassian service account so agents can create, look up, and search issues during triage. - [Linear](https://docs.cantina.security/clarion/integrations/linear.md): Connect Linear to Clarion so agents can create issues authored by the Clarion app, not by a person on your team. - [Pylon](https://docs.cantina.security/clarion/integrations/pylon.md): Connect Pylon to Clarion so agents can read customer-support issues, message threads, accounts, and knowledge base articles — and triage the issues your Pylon triggers send over. - [Notion](https://docs.cantina.security/clarion/integrations/notion.md): Connect Notion to Clarion with a connection token so agents can search and read your docs, runbooks, and databases for context during triage. - [Confluence](https://docs.cantina.security/clarion/integrations/confluence.md): Connect Confluence Cloud to Clarion with an Atlassian service account so agents can read and search documentation for context during triage. - [Slack](https://docs.cantina.security/clarion/integrations/slack.md): Install the Clarion app for Slack — what Clarion does, how it works inside Slack, where to find the Add to Slack button, and how your data is handled. - [Telegram](https://docs.cantina.security/clarion/integrations/telegram.md): Deliver Clarion approvals, clarifications, and alerts to a Telegram chat through your own bot. - [Twilio (SMS & phone)](https://docs.cantina.security/clarion/integrations/twilio.md): Reach members by SMS or a voice call for high-urgency events. - [PagerDuty](https://docs.cantina.security/clarion/integrations/pagerduty.md): Connect PagerDuty to Clarion so agents can page your on-call rotation through PagerDuty's Events API v2 during triage. - [incident.io](https://docs.cantina.security/clarion/integrations/incident-io.md): Connect incident.io to Clarion so agents can create alerts in incident.io and use its incident-management tools during triage. - [Halo](https://docs.cantina.security/clarion/integrations/halo.md): Connect Halo (HaloPSA) to Clarion so agents can triage the tickets your service desk raises, and search, create, update, close, and comment on Halo tickets during investigations. - [Tailscale](https://docs.cantina.security/clarion/integrations/tailscale.md): Connect Tailscale to Clarion to receive network and identity events — device approvals, key expiry, policy changes, and user lifecycle — as issues. - [Zscaler](https://docs.cantina.security/clarion/integrations/zscaler.md): Receive Zscaler Internet Access security and UEBA alerts as Clarion issues over a per-monitor webhook. - [Generic Webhook](https://docs.cantina.security/clarion/integrations/generic-webhook.md): Send events from any service to Clarion via HTTP webhook for AI-powered triage and response. - [Custom MCP](https://docs.cantina.security/clarion/integrations/custom-mcp.md): Connect any MCP-compatible HTTP server to extend Clarion agents with your own tools. - [Custom toolset (API)](https://docs.cantina.security/clarion/integrations/custom-toolset.md): Turn any REST API into agent tools by pointing Clarion at its documentation. - [Claude Code](https://docs.cantina.security/clarion/integrations/claude-code.md): Ingest OpenTelemetry from your developers' Claude Code installs to govern MCP servers, spot external accounts, and catch credential-shaped tool use. - [Devin](https://docs.cantina.security/clarion/integrations/devin.md): Connect a Devin Teams organization so Clarion agents can read and write org skills, search sessions, ask Devin to investigate a question, and, with an Admin service user, look up members. - [OpenClaw](https://docs.cantina.security/clarion/integrations/openclaw.md): Monitor AI agents for policy violations, unusual tool use, and skill activity via ClawSight telemetry. - [Clarion Terms of Service](https://docs.cantina.security/resources/clarion-terms.md): Terms governing use of Clarion. - [Getting Started with Cantina](https://docs.cantina.security/security-teams/getting-started.md): Your guide to setting up and using Cantina as an organization - [API Access](https://docs.cantina.security/security-teams/getting-started/api-access.md): Programmatic access to Cantina for client organizations - [SSO Configuration](https://docs.cantina.security/security-teams/getting-started/sso.md): Learn how to configure SSO enforcement for your Cantina organization - [Security solutions](https://docs.cantina.security/security-teams/services.md): Human-delivered security services powered by the Spearbit network, each plugging into the same find, prioritize, remediate, and prove-closure loop. - [Smart Contract Security Audits](https://docs.cantina.security/security-teams/services/smart-contract-audits.md): Comprehensive security audits by Spearbit and Cantina - [Application Security Audits](https://docs.cantina.security/security-teams/services/application-security-audits.md): Comprehensive application infrastructure and application security assessments - [Competitions](https://docs.cantina.security/security-teams/services/competitions.md): Collaborative security audit competitions with expert validation - [Bug Bounty](https://docs.cantina.security/security-teams/services/bug-bounty.md): Managed bug bounty programs for ongoing vulnerability discovery - [Penetration Testing](https://docs.cantina.security/security-teams/services/penetration-testing.md): Comprehensive penetration testing for on-chain and off-chain infrastructure - [Managed Detection and Response](https://docs.cantina.security/security-teams/services/managed-detection-and-response.md): 24/7 incident response and security monitoring - [Advisory](https://docs.cantina.security/security-teams/services/advisory.md): Strategic security advisory and executive-level guidance - [Multisig Security](https://docs.cantina.security/security-teams/services/multisig-security.md): Multi-signature wallet protection and key management solutions - [How Cantina Audits Work](https://docs.cantina.security/security-teams/services/how-audits-work.md): Structured, expert-led reviews of your codebase conducted by vetted security researchers - [Cantina Code for Companies](https://docs.cantina.security/security-teams/cantina-code.md): See findings submitted in real time and collaborate with security researchers through Cantina Code. - [Managing Findings](https://docs.cantina.security/security-teams/cantina-code/managing-findings.md): Efficiently manage and prioritize security findings - [Working with Reports](https://docs.cantina.security/security-teams/cantina-code/working-with-reports.md): Understand and act on security reports - [Building agents on the platform](https://docs.cantina.security/security-teams/community/building-agents.md): Build your own security agents and skills on top of the platform, within guardrails your team controls. - [Sharing and reusing](https://docs.cantina.security/security-teams/community/sharing.md): Publish agents and skills, and draw on what the community has already shared. - [Community guidelines](https://docs.cantina.security/security-teams/community/guidelines.md): Contribution standards that keep shared agents and skills safe, clear, and useful for everyone. - [Joining Cantina](https://docs.cantina.security/researchers/joining.md): Get started as a security researcher on Cantina - [KYC and Payments](https://docs.cantina.security/researchers/joining/kyc.md): Set up your payment information to receive rewards - [Payout Process](https://docs.cantina.security/researchers/joining/payout-process.md): Payment requirements, statuses, and support for earnings from competitions, security reviews, and bug bounty programs. - [Participation Guides](https://docs.cantina.security/researchers/participation.md): Essential guidelines for participating in Cantina engagements - [Bug Bounty](https://docs.cantina.security/researchers/participation/bounties.md): Overview of Cantina bug bounty programs - getting started, statuses, payouts, deposits, and mediation - [New Bounty Platform](https://docs.cantina.security/researchers/participation/new-bounty-platform.md): Cantina bounties are moving to a rebuilt platform. Where to submit, how balances and rewards work during the migration, and which bounties have moved. - [Bug Bounty Participation](https://docs.cantina.security/researchers/participation/bug-bounty.md): Guidelines for participating in Cantina bug bounty programs - [Bug Bounty Finding Statuses](https://docs.cantina.security/researchers/participation/bug-bounty-statuses.md): Understanding finding statuses for bug bounty programs - from submission to resolution - [Bug Bounty Payout](https://docs.cantina.security/researchers/participation/bug-bounty-payouts.md): Requirements, payment statuses, and support for receiving bug bounty payouts on Cantina - [Deposits for Bounty Submissions](https://docs.cantina.security/researchers/participation/deposits.md): Learn about deposit requirements for bounty submissions on Cantina - [Competition Participation](https://docs.cantina.security/researchers/participation/competitions.md): Rules and guidelines for participating in Cantina competitions - [Submission Guidelines](https://docs.cantina.security/researchers/participation/submission-guidelines.md): Best practices for submitting high-quality findings, including PoC requirements, validity criteria, and competition submission rules. - [Finding Submission Examples](https://docs.cantina.security/researchers/participation/examples.md): Real examples of good and bad security findings including Proof of Concept (PoC) code for smart contract audits. - [Security Review Process](https://docs.cantina.security/researchers/participation/security-review-process.md): Guide for researchers conducting security reviews on Cantina - [Cantina Tools](https://docs.cantina.security/researchers/tools.md): Tools available to security researchers on Cantina - [Communication Features](https://docs.cantina.security/researchers/tools/features.md): Communication tools for security researchers on Cantina Code - [Cantina Code Usage](https://docs.cantina.security/researchers/tools/cantina-code.md): How to use Cantina Code for security research - [Researcher Resources](https://docs.cantina.security/researchers/resources.md): Resources for growing your career on Cantina - [Competitions](https://docs.cantina.security/researchers/competitions.md): Quick links for Cantina security competition participation, teams, and payments. - [Evaluations and Standards](https://docs.cantina.security/standards.md): How we ensure fairness, clarity, and consistency - [Severity Classifications](https://docs.cantina.security/standards/severity.md): Standardized framework for vulnerability classification - [Bug Bounty Severity Classification](https://docs.cantina.security/standards/severity/bug-bounty.md): Cantina's bug bounty severity classification for smart contract vulnerabilities. Learn what's in scope vs out of scope for vulnerability rewards. - [Competition Finding Severity Criteria](https://docs.cantina.security/standards/severity/competition.md): Competition finding severity criteria including the mandatory PoC rule. Learn when Proof of Concept is required for high and medium severity submissions. - [Finding Labels and Status](https://docs.cantina.security/standards/severity/finding-categorization.md): Understanding finding statuses and labels - [Judging Processes](https://docs.cantina.security/standards/judging.md): How findings are evaluated, escalated, and scored - [Referral Program](https://docs.cantina.security/referrals.md): Earn rewards for growing the Cantina ecosystem - [FAQ](https://docs.cantina.security/resources/faq.md): Frequently asked questions about Cantina security audits, competitions, bounties, and researcher programs. - [Public Reports](https://docs.cantina.security/resources/public-reports.md): Browse published security reports from Cantina and Spearbit audits and competitions. - [Links](https://docs.cantina.security/resources/links.md): Official Cantina and Spearbit resources - [Clarion Privacy & Legal Disclosures](https://docs.cantina.security/resources/legal.md): Clarion-specific privacy and legal disclosures. - [Cantina Community Code of Conduct](https://docs.cantina.security/resources/code-of-conduct.md): Standards of conduct for Researchers, Sponsors, and Triagers on the Cantina platform. - [Support](https://docs.cantina.security/resources/support.md): How to get help with Cantina and Clarion. - [Client API Reference](https://docs.cantina.security/api.md): REST endpoints available to client organizations - [MCP access](https://docs.cantina.security/api/mcp-access.md): Connect external MCP clients (Claude Code, Cursor, CI scripts) to your Clarion workspace. ## OpenAPI Specs - [openapi-client](/api-reference/openapi-client.yaml) - [openapi](/api-reference/openapi.json) - [openapi](/api-reference/openapi.yaml) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.