Integrationsagent-as-actor · grounded in qcontrol telemetry

Engineering · Integrations

What's working today, what each connector would carry, and the blind spots an export would inherit.

Live integrations run now; projected connectors are off by default. Each shows the real local payload it would carry so you can size a rollout and pick what to wire first — and a coverage gap, because exporting now omits the unmonitored agents we can't see.

Bottom line

Live now: qcontrol stream (52.4k events) + 7-finding export. Wire SIEM first — it carries all events + every finding into the SOC. But every sink inherits a blind spot: 1 unmonitored agent aren't captured, so exports land incomplete.

Do nextExport findings now →Instrument 1 shadow agent →

Export-gap warning · 1 unmonitored agent

completeness · SOC / GRC

Exporting now would carry blind spots: 1 installed agent report no telemetry, so its behavior isn't captured in any sink below. Every connector would land an incomplete picture — relevant to SOC detection and GRC evidence completeness.

not exported: Zed Agent

Live — working today

running

qcontrol event stream

live

Local ingest of agent activity into the control plane. Already capturing everything the projected connectors below would draw from — for the 7 monitored agents only.

52.4k

events ingested

agents

sessions

Findings export

live

7 findings exportable right now — pull the worklist into a file or hand it to a downstream tool.

fields: severity · title · framework · entity_id · remediation

Projected outbound connectors

off by default · ranked · payload & coverage shown

SIEM / detection

recommended first

payload52.4k events + 7 findings — all telemetry + the full finding worklist into the SOC pipeline

Splunk

projected · off

would stream all 52.4k events + 7 findings into your SOC detection pipeline

coverage gap: omits 1 unmonitored agent (Zed Agent)

Microsoft Sentinel

projected · off

would forward all 52.4k events + 7 findings as analytics-rule input

coverage gap: omits 1 unmonitored agent (Zed Agent)

Identity

payload5 of 8 agents (org_id present) — only agents already bound to an org identity map to your IdP

Okta / Entra ID

projected · off

would map the 5 agent identities carrying an org_id to your IdP

coverage gap: 3 agents have no org_id (incl. 1 shadow) — not mappable

GRC / evidence archive

payload100% append-only (52.4k events) — every captured event lands immutably for long-horizon evidence

Amazon S3 (Iceberg)

projected · off

would append 100% of captured events (52.4k) to an immutable, append-only evidence table

coverage gap: omits 1 unmonitored agent (Zed Agent)

Snowflake

projected · off

would land 100% of captured events (52.4k) for long-horizon GRC querying

coverage gap: omits 1 unmonitored agent (Zed Agent)

Alerting / ticketing

supporting

payload2 high findings only — high-severity findings only — not the full event stream

PagerDuty

projected · off

would page on high findings only (2 open now)

coverage gap: omits 1 unmonitored agent (Zed Agent)

Slack

projected · off

would notify a channel on high findings only (2 open now)

coverage gap: omits 1 unmonitored agent (Zed Agent)

Jira

projected · off

would open a ticket per high finding (2 open now)

coverage gap: omits 1 unmonitored agent (Zed Agent)

Local-only

qcontrol binds 127.0.0.1 — nothing leaves this machine unless you export it. Connectors are projected and off by default; the payload counts above describe local readiness, not transmitted volume — and every count is bounded to the 7 monitored agents.

Fields: stats.events · findings.length · agents[].org_id · shadowAgents() — payload & coverage gap derived from app/data/c16-fleet.ts (qcontrol /api shape).