Documentation
Everything you need to get vendor security monitoring up and running.
Getting started
From zero to your first security alert in under 5 minutes.
1. Add your vendors
Search by vendor name and Gjall auto-discovers their status page, CVE feed, and GitHub advisories. You can import dozens at once using bulk add.
2. We start monitoring immediately
Gjall scans NVD CVEs, CISA KEV, vendor status pages, and breach feeds. Historical alerts from the last 30 days backfill automatically.
3. Set up Slack notifications
Paste your Slack webhook URL in Settings → Notifications. You'll get a message whenever a high or critical alert is detected.
4. Review AI triage
Claude analyzes each alert against your vendor criticality level and answers: does this actually affect me? This cuts noise by ~70%.
5. Generate your first report
Head to Reports and click 'Generate'. You get a SOC 2 CC9.2-mapped PDF with all alerts, risk scores, and remediation evidence.
Adding vendors
Gjall maintains a registry of 500+ common SaaS vendors with pre-configured monitoring rules. Type a vendor name in the search bar to find it — the registry includes canonical names, aliases, CVE keywords, and status page URLs.
If a vendor isn’t in the registry, use the Request vendor link that appears in search results. Community-requested vendors are typically added within 48 hours.
Vendor criticality
Gjall uses AI to suggest a criticality level (critical / high / medium / low) based on what the vendor does and how it integrates with typical business workflows. You can override this at any time. Criticality affects alert prioritization and AI triage decisions.
Understanding alerts
Each alert has a severity level (critical / high / medium / low) and a source type.
NVD CVE
National Vulnerability Database — every published CVE
CISA KEV
Known Exploited Vulnerabilities — actively exploited CVEs
GitHub Advisory
GitHub Security Advisories for open-source dependencies
Status Incident
Vendor status page incidents — outages and degradations
Breach
Confirmed breach reports from public sources
AI triageruns automatically on every alert above medium severity. It considers the CVE description, your vendor’s criticality level, the EPSS exploitation probability score, and any existing mitigations to produce a plain-English summary and recommended actions.
You can acknowledge or silence alerts. Silenced alerts are hidden from the default view but remain in the audit trail.
Configuring notifications
All notification settings live in Settings.
Paste your Slack Incoming Webhook URL. Gjall sends one message per alert with severity, vendor, and a direct link to the alert detail.
Add an alert email address. You'll receive a digest of new alerts detected in each scan cycle.
Point a custom webhook URL at any endpoint. Gjall POSTs a JSON payload with the full alert record including CVE data and AI triage.
Audit reports
Gjall generates audit evidence packages mapped to SOC 2 CC9.2 (vendor risk management control). Auditors recognize the format — it includes all the fields they typically ask for.
To generate a report, go to Reports, choose a date range, and click Generate report. The report includes:
- All vendors and their current criticality level
- Alert history for the period with AI triage summaries
- Risk scores and score history
- SOC 2 control mapping with evidence narratives
- Remediation status (acknowledged / silenced / open)