> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Export events to your SIEM

> Create an exporter to Splunk, Datadog, Elastic, Sentinel, Sumo Logic or Amazon S3, and confirm batches and the audit log arrive.

At the end of this page you have one batch exporter enabled, and Quint is forwarding this workspace's security events to it in batches. Creating or changing an exporter needs the **Admin** or **Owner** role.

Every enabled batch exporter also receives the admin audit log as a second stream beside telemetry. You do not configure that separately; **Settings › Audit** shows how far it has got.

## Before you start

* The destination's endpoint and credential, created in the other product first. Amazon S3 is the exception: it uses federated AWS IAM and there is no secret to enter.
* Decide which of the seven event types this exporter should carry; see [Integrations overview](https://docs.quintai.dev/integrations/overview.md).

## Create an exporter

**1. Open the exporter form**

Open **Integrations** under **Workspace**. In **Event export**, click **Create exporter** and choose the destination.

**2. Fill in the destination's fields**

> [tab] Splunk
>
> Streams events to Splunk HTTP Event Collector. Fields: **HEC URL** (required), **HEC token** (required, secret), **Index** (default `main`), **Sourcetype** (default `quint:event`).

> [tab] Datadog
>
> Streams events to Datadog Logs. Fields: **API key** (required, secret), **Datadog site** (**US1 (datadoghq.com)**, **US3**, **US5**, **EU1 (datadoghq.eu)** or **AP1**; default **US1**), **Service tag**, **Extra tags (comma-separated)**.

> [tab] Elastic / OpenSearch
>
> Indexes events into Elasticsearch or OpenSearch. Fields: **Cluster URL** (required), then exactly one credential: **API key**, or **Username** and **Password**. **Index** defaults to `quint-events`.

> [tab] Microsoft Sentinel
>
> Sends events to Microsoft Sentinel through the Azure Monitor Logs Ingestion API. Fields: **Directory (tenant) ID** (required), **Application (client) ID** (required), **Client secret** (required, secret), **Logs Ingestion URL** (required), **Data collection rule immutable ID** (required, starts with `dcr-`), **Stream name** (default `Custom-QuintEvent_CL`).
>
> The Connect form lists the Azure steps in order: create a data collection endpoint in your workspace's region, create a custom table named QuintEvent with a new data collection rule that uses that endpoint, register an app in Microsoft Entra ID with a client secret, and give that app the Monitoring Metrics Publisher role on the rule.
>
> The connection test sends one row to your QuintEvent table with `quint_stream` set to `probe`. If you have analytics rules or workbooks on that table, filter out rows where `quint_stream` is `probe`.
>
> The older connection method, a workspace ID with a primary (shared) key, is no longer accepted: Microsoft ended support for it (the HTTP Data Collector API) on 14 September 2026.

> [tab] Sumo Logic
>
> Streams events to a Sumo Logic hosted HTTP source. Fields: **HTTP source collector URL** (required, secret), **Source category**, **Source name**.

> [tab] Amazon S3
>
> Lands event batches as JSONL objects in your bucket. Fields: **Bucket** (required), **Region** (required), **Key prefix**. Authentication is federated AWS IAM; Quint stores no secret.

> [tab] Amazon S3 (Parquet)
>
> Lands event batches as Parquet objects for lakehouse and Athena ingestion. Fields: **Bucket**, **Region**, **Key prefix**. Federated AWS IAM, no stored secret.

**3. Test the connection where it is offered**

Datadog, Elastic / OpenSearch, Microsoft Sentinel and Sumo Logic offer a connection test. Run it before you save. Splunk and Amazon S3 do not; the first batch is the test.

**4. Save and enable**

Click **Create exporter**, then **Enable**. A disabled exporter keeps its settings and sends nothing.

**5. Confirm the audit stream**

Open **Settings › Audit**. Under **Streaming**, the new destination appears with its **State**, **Audit rows delivered** and **Audit cursor**. If the table instead says "No batch exporter is configured, so the audit log is not streamed anywhere yet.", the exporter is not enabled.

## Change or remove an exporter

* **Edit** or **Replace settings** changes the fields. A secret you replace is never shown back to you.
* **Disable** pauses delivery and keeps the settings.
* **Remove** deletes the exporter. Events already delivered stay where they landed.

## If this fails

| What you see | What it means | What to do |
| - | - | - |
| The connection test fails | The endpoint or credential was rejected by the destination | Check the URL and paste the credential again. For Elastic, enter one credential kind only, not both. |
| Nothing arrives in the destination after **Enable** | The exporter's filter matches no events yet, or the destination refuses the batches | Widen the filter. For Splunk, confirm the HEC token is enabled and the index exists. |
| Batches do not land in the bucket | Your bucket policy does not allow Quint's federated access, or **Region** is wrong | Check **Bucket** and **Region**. Ask your Quint contact what to allow in your bucket policy. |
| **Settings › Audit** shows "No batch exporter is configured, so the audit log is not streamed anywhere yet." | No exporter is enabled | Click **Enable** on the exporter. |
| **Audit rows delivered** stays at zero | No settings change has been recorded since the exporter was enabled, or delivery is failing | Make one settings change and wait for the next batch. If the count stays at zero, see [Get support](https://docs.quintai.dev/help/get-support.md). |

> [!NOTE]
>
> Events are kept for 14 to 45 days and divergence findings for 14 days. An exporter is how you keep them longer. See [Workspace, data region and retention](https://docs.quintai.dev/settings/workspace-and-data.md).

## Next

* [Webhooks and event fields](https://docs.quintai.dev/integrations/webhooks-and-event-fields.md), for the fields in each exported event
* [Compliance and audit](https://docs.quintai.dev/dashboard/compliance-and-audit.md), for the audit log inside the dashboard


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.