← All integrationsINTEGRATION · SECURITY OPERATIONS

Kapālins for BMC

Your SOC keeps working in BMC Helix ITSM. Kapālins pushes every AI finding, block and incident there as the Helix ITSM incident API, one incident per finding, with the person, the rule and the evidence on each one.

See it governed liveSetup in four steps

No new console for the SOC

Analysts triage AI findings in BMC, next to everything else, in its own field names.

AI-specific signal you do not have today

Prompt injection, sensitive data in prompts, unapproved models and agent tool calls, mapped to MITRE ATLAS before they arrive.

Every finding once

Deduplicated on the Kapālins event id, so a retry never doubles a ticket, and every attempt is in the push log.

WHAT ARRIVES

What lands in BMC.

Each incident carries its severity, the person, the rule that fired, what was stopped, and a link back to the evidence. "Ship to ITSM" on the card sends it on demand; findings you choose are pushed as they happen.

  • Sent as the Helix ITSM incident API, one incident per finding
  • Credential: an instance user allowed to create incidents
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
CONTEXT

Mapped to the attack. Priced in dollars.

Every finding carries the MITRE ATLAS technique it belongs to and the plane that caught it. Click the technique and Kapālins shows its residual risk and a modelled annual loss, so the SOC can rank AI findings by what they could cost.

  • Bayesian FAIR on your own telemetry, labelled as modelled
  • Prompt injection, jailbreak, tool misuse, data exfiltration
Kapālins Threat Map: a MITRE ATLAS technique opened to its modelled loss exposure
Console replay · illustrative data
A replay of the Kapālins console: posture, the MITRE ATLAS matrix, then one technique opened to its residual risk and a modelled annual loss from Bayesian FAIR with sector priors. Loss figures are modelled; key names are illustrative.
SOURCE

Everything behind the finding.

The full record stays in Kapālins: the request, the verdict and the rule, so an analyst in your SIEM can pivot to the evidence.

  • Nothing is pulled from your SIEM
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
Setup

Four steps.

  1. Create the destination credentialAn instance user allowed to create incidents, created in BMC.
  2. Add the destinationSecurity operations › BMC › paste the credential and endpoint.
  3. Choose what to pushFindings, blocks or incidents, with a minimum severity.
  4. Send a testKapālins pushes a test event and shows the response.
Request a briefing

See BMC governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins read anything from BMC?

No. The integration is one-way: Kapālins pushes, nothing is pulled.

Can I limit what is pushed?

Yes. Choose the finding types and the minimum severity; the rest stays in Kapālins.

What if a push fails?

The attempt and the response are recorded in the push log and shown on the integration; the next attempt retries it.