Quickstart
Connect your first source, send a test event, and see the finding it raises.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
You need a ShellOrbit account and admin access to the system you want to watch: a GitHub organization, an AWS account, an Okta or Auth0 tenant, or your own app. Nothing to install.
1. Create a source
In the dashboard, open Settings, Integrations and choose Add source. Pick the kind, name it for the system and environment, and save. ShellOrbit shows two values:
URL https://hooks.shellorbit.com/e/ik_7f3a91c2d4
Secret shown once; copy it nowTreat both as credentials. The URL accepts events; the secret proves they came from your system.
2. Paste them into the system
Follow the guide for the kind you chose: GitHub, AWS, Okta, Auth0, your app, or anything else. Each lists the exact screens and fields.
3. Send a test event
Press Send a test event on the source. ShellOrbit runs a sample event of that kind through the ready-made rules and raises a test finding, so you can see what a real one looks like and check your alerts. Then send the vendor’s own test, where it has one, and open the source’s events: each shows whether its signature checked out.
4. Decide who hears about it
Critical and high findings email owners and admins on every plan. Add more addresses, and from Starter a Slack, Discord, or Teams channel, in Settings, Alerts. See alerts.
Next
- Rules: what each source detects, and how to add your own.
- Silent sources: hear when a source stops sending.
- Verified domains and tripwires: leaked keys on your site and fake secrets that alert when used.