Export events to your SIEM

Create an exporter to Splunk, Datadog, Elastic, Sentinel, Sumo Logic or Amazon S3, and confirm batches and the audit log arrive.

At the end of this page you have one batch exporter enabled, and Quint is forwarding this workspace’s security events to it in batches. Creating or changing an exporter needs the Admin or Owner role.

Every enabled batch exporter also receives the admin audit log as a second stream beside telemetry. You do not configure that separately; Settings › Audit shows how far it has got.

​

Before you start

• The destination’s endpoint and credential, created in the other product first. Amazon S3 is the exception: it uses federated AWS IAM and there is no secret to enter.
• Decide which of the seven event types this exporter should carry; see Integrations overview.

​

Create an exporter

1. Open the exporter form

   Open Integrations under Workspace. In Event export, click Create exporter and choose the destination.

2. Fill in the destination's fields

   Splunk

   Streams events to Splunk HTTP Event Collector. Fields: HEC URL (required), HEC token (required, secret), Index (default main), Sourcetype (default quint:event).

   Datadog

   Streams events to Datadog Logs. Fields: API key (required, secret), Datadog site (US1 (datadoghq.com), US3, US5, EU1 (datadoghq.eu) or AP1; default US1), Service tag, Extra tags (comma-separated).

   Elastic / OpenSearch

   Indexes events into Elasticsearch or OpenSearch. Fields: Cluster URL (required), then exactly one credential: API key, or Username and Password. Index defaults to quint-events.

   Microsoft Sentinel

   Sends events to Microsoft Sentinel through the Azure Monitor Logs Ingestion API. Fields: Directory (tenant) ID (required), Application (client) ID (required), Client secret (required, secret), Logs Ingestion URL (required), Data collection rule immutable ID (required, starts with dcr-), Stream name (default Custom-QuintEvent_CL).

   The Connect form lists the Azure steps in order: create a data collection endpoint in your workspace’s region, create a custom table named QuintEvent with a new data collection rule that uses that endpoint, register an app in Microsoft Entra ID with a client secret, and give that app the Monitoring Metrics Publisher role on the rule.

   The connection test sends one row to your QuintEvent table with quint_stream set to probe. If you have analytics rules or workbooks on that table, filter out rows where quint_stream is probe.

   The older connection method, a workspace ID with a primary (shared) key, is no longer accepted: Microsoft ended support for it (the HTTP Data Collector API) on 14 September 2026.

   Sumo Logic

   Streams events to a Sumo Logic hosted HTTP source. Fields: HTTP source collector URL (required, secret), Source category, Source name.

   Amazon S3

   Lands event batches as JSONL objects in your bucket. Fields: Bucket (required), Region (required), Key prefix. Authentication is federated AWS IAM; Quint stores no secret.

   Amazon S3 (Parquet)

   Lands event batches as Parquet objects for lakehouse and Athena ingestion. Fields: Bucket, Region, Key prefix. Federated AWS IAM, no stored secret.

3. Test the connection where it is offered

   Datadog, Elastic / OpenSearch, Microsoft Sentinel and Sumo Logic offer a connection test. Run it before you save. Splunk and Amazon S3 do not; the first batch is the test.

4. Save and enable

   Click Create exporter, then Enable. A disabled exporter keeps its settings and sends nothing.

5. Confirm the audit stream

   Open Settings › Audit. Under Streaming, the new destination appears with its State, Audit rows delivered and Audit cursor. If the table instead says “No batch exporter is configured, so the audit log is not streamed anywhere yet.”, the exporter is not enabled.

​

Change or remove an exporter

• Edit or Replace settings changes the fields. A secret you replace is never shown back to you.
• Disable pauses delivery and keeps the settings.
• Remove deletes the exporter. Events already delivered stay where they landed.

​

If this fails

What you see	What it means	What to do
The connection test fails	The endpoint or credential was rejected by the destination	Check the URL and paste the credential again. For Elastic, enter one credential kind only, not both.
Nothing arrives in the destination after Enable	The exporter’s filter matches no events yet, or the destination refuses the batches	Widen the filter. For Splunk, confirm the HEC token is enabled and the index exists.
Batches do not land in the bucket	Your bucket policy does not allow Quint’s federated access, or Region is wrong	Check Bucket and Region. Ask your Quint contact what to allow in your bucket policy.
Settings › Audit shows “No batch exporter is configured, so the audit log is not streamed anywhere yet.”	No exporter is enabled	Click Enable on the exporter.
Audit rows delivered stays at zero	No settings change has been recorded since the exporter was enabled, or delivery is failing	Make one settings change and wait for the next batch. If the count stays at zero, see Get support.

Events are kept for 14 to 45 days and divergence findings for 14 days. An exporter is how you keep them longer. See Workspace, data region and retention.

​

Next

• Webhooks and event fields, for the fields in each exported event
• Compliance and audit, for the audit log inside the dashboard