> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations overview

> What the Integrations page connects: alert channels, event exporters for your SIEM, signed webhooks, and one read-only connector.

The **Integrations** page, under **Workspace** in the sidebar, is where Quint connects to the tools you already run. **Connected** lists every connection this workspace has, in one list. **Browse** is the catalog: search it, or filter it by category. What you can connect today is on the **Available now** shelf; open any other card to request it by email. Each connection moves data in one direction:

* **Quint reads from it**: SaaS tenants Quint connects to and reads, judged against posture rules (**Data Quint reads**). Quint only reads.
* **Quint sends events to it**: where Quint forwards this workspace's security events in batches (**SIEM & Observability**, and **Generic Webhook** under **Delivery**).
* **Quint sends alerts to it**: where alerts and approval requests arrive in real time (**Alerting**).

Connecting, editing, enabling or removing any destination needs the **Admin** or **Owner** role. Only **Admin** and **Owner** members can see which exporters and alert destinations are connected. **Read** and **Policy Writer** members see the catalog and any connected data sources (when the workspace has the inventory feature), plus a note that exporters and alert destinations are visible to workspace admins.

## The seven event types

Destinations route these event types. Each exporter or channel carries a filter, so you decide which of them reach which destination.

* Threat detections
* Incidents
* Divergences
* Policy blocks
* High-risk sessions
* Agent registered
* Machine health

## Destinations and what each one carries

An alert channel delivers one message per alert or approval request as it happens, one per security event (member, key or settings change) when its **Send security events** switch is on, and one message per scheduled summary (see [Alerts](https://docs.quintai.dev/policies/notifications.md)). A batch exporter delivers events in batches, and every enabled batch exporter also receives the admin audit log as a second stream (see **Settings › Audit**). The two groups do not overlap.

| Destination | Approval requests | Alerts | Policy recaps | Event export | Audit log stream |
| - | - | - | - | - | - |
| Slack | Yes | Yes | Yes | No | No |
| Microsoft Teams | Yes | Yes | Yes | No | No |
| PagerDuty | Block notices only, when a workload opts in | Yes | No | No | No |
| Alert Webhook | Yes, signed | Yes, signed | Yes, signed | No | No |
| Generic Webhook | No | No | No | Yes | Yes |
| Splunk | No | No | No | Yes | Yes |
| Datadog | No | No | No | Yes | Yes |
| Elastic / OpenSearch | No | No | No | Yes | Yes |
| Microsoft Sentinel | No | No | No | Yes | Yes |
| Sumo Logic | No | No | No | Yes | Yes |
| Amazon S3 | No | No | No | Yes | Yes |
| Amazon S3 (Parquet) | No | No | No | Yes | Yes |

Slack, Teams and PagerDuty are verified live when you save them. An alert webhook is verified with a signed test ping before it can be enabled. Amazon S3 destinations use federated AWS IAM, so Quint stores no secret for them.

Approval requests also wait in the **Approvals** inbox whether or not a channel is connected. A channel is a second place to see them, with a link back to the request.

## Data Quint reads

The **Microsoft Power Platform (Copilot Studio)** connector, in preview, reads Copilot Studio agents, environments, apps and flows, and the tenant's admin settings and DLP policies, and records posture findings about them. Quint only reads. The connection uses an app registration you create and a dedicated service account that signs in with a device code, and it is not a destination for events. For the rights the connection holds, see [Permissions and data](https://docs.quintai.dev/integrations/agentless-coverage.md#permissions-and-data).

For every agentless source and its status, see [Agentless coverage](https://docs.quintai.dev/integrations/agentless-coverage.md).

> [!NOTE]
>
> Alert channels and exporters are what send data out of Quint. Nothing on this page changes what agents on your machines may do. Rules do that; see [How policies work](https://docs.quintai.dev/policies/how-policies-work.md).

## Next

* [Alerts and approvals in Slack, Teams and PagerDuty](https://docs.quintai.dev/integrations/alerts-in-slack-teams-pagerduty.md)
* [Export events to your SIEM](https://docs.quintai.dev/integrations/export-to-your-siem.md)
* [Webhooks and event fields](https://docs.quintai.dev/integrations/webhooks-and-event-fields.md)
* [Notifications and built-in alerts](https://docs.quintai.dev/settings/notifications.md), for what fires an alert in the first place


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.