From finding to ticket to resolved, automatically
LoopProof is a serverless pipeline that runs in your AWS account. No agent to deploy, no secrets to rotate by hand, no manual queue.
Five steps. No agent.
Nothing is filed until you confirm in step 4.
Install the connector
One module block in Terraform. It creates an EventBridge rule that forwards Security Hub "Findings Imported V2" events (High, Critical and Fatal) across accounts to LoopProof's bus. No IAM user, no access key, no agent process.
Connect Linear
Authorize LoopProof's OAuth app in your Linear workspace. Findings will be filed as the LoopProof app, not as a person. The scheduler's jobs run as the app actor, so there is no Linear user seat to manage.
Self-check
LoopProof assumes the connector role, confirms the account identity with STS, and provisions an isolated schema. If the connector role does not work, wrong trust policy or wrong ExternalId, the check says why before anything is filed.
Import and preview
LoopProof imports your open findings and shows what would become tickets: team, severity label, one ticket per remediation. Nothing is filed in Linear until you confirm. This is the step to review team routing and severity mapping.
Go live
Enable ticketing. From this point, new High, Critical and Fatal findings from GuardDuty and Inspector become Linear tickets automatically. The resolution goes back when the ticket is closed.
The connector
The connector module creates an IAM role in your account that LoopProof assumes with sts:AssumeRole. The trust policy requires your ExternalId, which LoopProof generates at random and stores in Secrets Manager. No static credentials, no access key, no agent process running in your account.
The connector role's only permissions are reading Security Hub findings and forwarding events to LoopProof's EventBridge bus.
Ingest
Each GuardDuty or Inspector finding arrives on the findings bus as an event. Two things happen simultaneously:
- Firehose writes the raw event to your prefix in S3 within 15 minutes. Every event, whether ticketed or not, is archived.
- The ingest worker folds the finding into the tenant's schema: deduplication, severity mapping, team routing.
A finding whose ticket already exists is a no-op. A finding that is a LoopProof echo (the Close that LoopProof writes back to Security Hub) is dropped at the EventBridge rule, before it reaches the queue.
Ticketing and grouping
The scheduler picks up file-ticket jobs and creates the Linear ticket with the right team and severity label. Inspector raises one finding per resource; LoopProof groups by shared remediation, so one package upgrade is one ticket, not one per affected resource. If Linear is unavailable or over budget, the ticket is held and the tenant's admins are emailed.
Shipped Resolution written back
When an engineer closes the Linear ticket, Linear's webhook fires. LoopProof receives it, validates the signature, and calls Security Hub BatchUpdateFindings to mark the finding Resolved with comment: forward=false. That marker is the echo filter: the Close event arrives on the findings bus and is dropped at the EventBridge rule, so the finding is not re-ticketed.
Shipped The record
Every action: finding ingested, ticket filed, finding resolved, operator command run, is recorded in the tenant's audit trail with a timestamp and the operator identity. The raw Security Hub event is in S3. The record is independent of Security Hub's 90-day deletion window.
Design partners get dedicated onboarding
One call with the founding team. Walk through your account structure, apply the connector module, see the first finding in Linear.