Appearance
Integrations
Watchmont connects external tooling and folds its data into the same dashboards and reports as Microsoft 365. Integrations are configured once at the platform level (Admin › Settings › Integrations, SuperAdmin only) and then mapped per client.
The catalogue
Ten integrations across five groups.
PSA & Billing
| Integration | What it brings | Mapped to |
|---|---|---|
| HaloPSA | Service-desk tickets, clients and invoices in reports | A Halo client |
| Giacom | Microsoft licence wholesale cost, renewals, price-change alerts | A Giacom customer (or several) |
Security
| Integration | What it brings | Mapped to |
|---|---|---|
| RoboShadow | Vulnerability scanning, device posture, dark-web breach monitoring | A RoboShadow organisation |
| Heimdal | Endpoint threat prevention and DNS security posture | A Heimdal customer |
| uSecure | Phishing simulations and awareness training; instant compromise alerts | A uSecure account |
Backup
| Integration | What it brings | Mapped to |
|---|---|---|
| Acronis | Backup and recovery health per client (see the Backups page) | An Acronis customer tenant |
Network
| Integration | What it brings | Mapped to |
|---|---|---|
| Cisco Meraki | Cloud-managed network devices, clients and security events | A Meraki organisation |
| UniFi | Ubiquiti network devices and controller health | A UniFi site |
| 3CX Phone System | Hosted PBX call reporting per client | A 3CX instance |
Monitoring
| Integration | What it brings | Mapped to |
|---|---|---|
| Status Pages | Public status-page monitoring | A status page |
How mapping works
Most integrations expose a list of their own organisations or customers. On each integration card you either:
- Auto-map by name (matches your client names against the integration's org names), or
- Manually map each client to the right org from a dropdown.
Some clients hold licences or data under a parent-company account, so a few integrations (such as Giacom) let you map more than one source name to a single client.
Where the data shows up
- Dedicated pages such as Reports › RoboShadow, Reports › Heimdal, and Infrastructure › Backups.
- Report sections inside the Master Report and Management Summary (Halo tickets and invoices, RoboShadow vulnerabilities, uSecure phishing, and more).
- Alerts raised by the network and phishing integrations appear in the normal alerts feed.
Credentials and secrets
Integration credentials (API keys, refresh tokens) are stored in AWS Secrets Manager, never in the database or the browser. Only non-secret config (organisation IDs, mappings, enabled flags) lives in the app config store.
Setting one up
- Go to Admin › Settings › Integrations (SuperAdmin only).
- Open the integration card and enter its credentials (usually an API key or refresh token).
- Click Test connection to confirm the credentials work, then enable it.
- In the mapping table, Auto-map by name or map each client manually.
- Open the relevant page or report section for a mapped client to confirm data loads.
Common gotchas
| Vendor | Watch for |
|---|---|
| RoboShadow | Bearer tokens last about an hour and are minted from a refresh token on demand. A 403 usually means the organisation has IP-locking, so the platform's egress address would need allow-listing. |
| HaloPSA | The API application must be granted the relevant read scopes (for example, invoicing) in the Halo portal, or those endpoints return 403. |
| Giacom | Clients can appear under near-duplicate customer accounts. Map every relevant name so licences merge correctly. |
| Heimdal | Some endpoints return HTTP 200 with an error message rather than a proper status, and are rate limited to about 10 requests per minute. |
| Acronis | The task API needs newest-first paging and can hang when throttled, so requests carry a hard timeout. |
| UniFi | The cloud API only returns devices for hardware Cloud Gateways. Self-hosted controller sites need the direct controller API and a network path to it. |