Engineering · Integrations
What's working today, and what your telemetry is ready to feed.
Live integrations run now; projected connectors are off by default and show the real local volume they'd carry, so you can size a rollout and pick what to wire first.
Bottom line
Live now: qcontrol stream (52.4k events) + findings export. Recommended first connector: SIEM (Splunk) — stream your 2 high findings into the SOC. Identity / GRC / alerting are next.
Live — working today
runningqcontrol event stream
liveLocal ingest of agent activity into the control plane. Already capturing everything the projected connectors below would draw from.
52.4k
events ingested
8
agents
61
sessions
Findings export
live7 findings exportable right now — pull the worklist into a file or hand it to a downstream tool.
fields: severity · title · framework · entity_id · remediation
Projected outbound connectors
off by default · ranked by what to wire firstSIEM / detection
recommended firstSplunk
projected · offwould stream 52.4k events + 2 high findings into your SOC detection pipeline
Microsoft Sentinel
projected · offwould forward 52.4k events + 7 findings as analytics-rule input
Identity
nextOkta / Entra ID
projected · offwould map 8 observed agent identities to your IdP
GRC / evidence archive
nextAmazon S3 (Iceberg)
projected · offwould append 52.4k events to an immutable, append-only evidence table
Snowflake
projected · offwould land 52.4k events for long-horizon GRC querying
Alerting / ticketing
supportingPagerDuty
projected · offwould page on high findings (2 open now)
Slack
projected · offwould notify a channel on high findings (2 open now)
Jira
projected · offwould open a ticket per high finding (2 open now)
Local-only
qcontrol binds 127.0.0.1 — nothing leaves this machine unless you export it. Connectors are projected and off by default; the counts above describe local readiness, not transmitted volume.
Fields: stats.events · stats.agents · stats.sessions · findings.length — from app/data/c16-fleet.ts (qcontrol /api shape).