Integrations, Flows, and Reporting
Integrations move data; flows move work
Two mechanisms dominate. Integrations bring external security data in or push actions out through spokes and REST: scanner imports for VR, EDR/email actions for containment, SIEM alert ingestion for SIR, enrichment lookups for observables. Flows (Flow Designer) orchestrate what happens once data arrives - record-created/updated triggers, scheduled runs, inbound email, or a manual playbook run - using actions, subflows, approvals, and task generation.
Know the troubleshooting order for a broken integration: integration user and roles → credential or credential alias → connectivity (MID Server for on-premise endpoints, firewall allow-lists) → schedule → transform map and field mapping. Data landing in the wrong field is a mapping problem; no data at all is usually credentials or connectivity.
Reporting
Reports and dashboards are built on the application tables - sn_si_incident for security incidents, vulnerable item and remediation task tables for VR - not on the ITSM incident table. Performance Analytics adds time-series indicators such as MTTD, MTTR, and open-critical trending, and requires its own entitlement. Separate operational dashboards (current workload, SLA at risk) from executive reporting (trends, coverage).
Traps
- Assuming a dashboard is visible to everyone; sharing is explicit and filters still respect viewer ACLs.
- Choosing Flow Designer when the question describes legacy Workflow behavior, or the reverse.
- Believing an integration is "configured" once credentials exist - schedules and mappings still must be set.
- Reporting on the ITSM incident table instead of the security incident table.
Worked example
A nightly Tenable import creates zero records. Verify the integration user's VR roles, then the credential alias, then whether the scheduled flow actually executed (flow execution history), and only then inspect the transform map.
Rule of thumb: inbound problems are usually permissions or mapping; outbound problems are usually network or credentials.