Integrations overview

A self-hosted deployment starts with no path out. It sends no telemetry, crash reports or license checks, and it calls no map or tile service. Each destination on these pages stays off until an admin turns on its egress.

The console groups this work under Connect in the sidebar, between Data and Administration:

The sidebar counts flag what needs a person. Integrations shows, in amber, how many deliveries sit in the dead-letter queue. Automations shows how many runs are held for approval.

The Integrations page#

Integrations has four tabs, each with its own address:

Select any row to open its drawer. A destination's drawer shows This deployment (what your program configured), How it connects, Government suitability, any Recent change and the Sources behind each claim. The sources are shown as text: "this deployment has no route to them."

Five families#

The catalog sorts integrations into five families. The Air-gapped column repeats the console's wording: Yes means the integration works with no network path out of the enclave.

Notify#

"Alerts to people: email, chat, pagers and webhooks." See Alerts and Webhooks.

Ticketing#

"Issues that hold the case link, so work is tracked where the team already tracks it." See Ticketing.

Forward logs#

"Findings, the audit log and normalized events for your SIEM or data platform." See Forward logs to your SIEM.

A destination outside the enclave shows Needs a network path out until it is configured: both Teams entries, GovSlack, PagerDuty, Jira Cloud, ServiceNow and Sentinel. AWS SNS and AWS SQS or EventBridge show Needs a VPC endpoint, because egress is denied at the VPC.

Ingest#

"Endpoints Foxborne listens on, and the files it imports." Connections Foxborne reads from, such as a log bucket, stay on Sources. See Stream logs to Foxborne and Push bundles with the Ingest API.

Planned The TENA gateway, an adapter for the DoD test-range middleware, is a later phase, and nothing listens for it yet.

Export#

"Every format works air-gapped. Destinations are a download, an on-premises share, removable media or S3 in GovCloud." See Export formats and evidence bundles.

Egress, data classes and the ledger#

An admin turns on each destination with a host allowlist, a protocol, a credential reference and a data class. The data class decides what may leave in each message:

• L0: "Metadata: rule, severity, vehicle alias, UTC time and case link."
• L1: "Summary with values. Treat it as CUI."
• L2: "Evidence files. They move only through Export, with approval."

Everything outside the enclave gets L0 by default, and L1 goes only to destinations your program has authorized for CUI. Egress, data classes and the delivery ledger sets out each guardrail and the ledger that records every delivery.

Works without any network path out#

An air-gapped enclave can run a complete set of integrations. Every entry below reads Yes in the Air-gapped column:

• Notify: Email (SMTP relay) through your own relay, Mattermost, Generic webhook (HMAC) and Alertmanager and Grafana.
• Ticketing: GitLab self-managed, and Jira Data Center until its end of life on 28 March 2029.
• Forward logs: Syslog over TLS, Splunk HEC with Splunk Enterprise, OTLP export and self-managed Elasticsearch, OpenSearch or Kafka.
• Ingest: every endpoint except the S3 bucket watch, including File import and the HTTPS ingest API.
• Export: every format.

In the example dataset, six destinations have egress on, and the Destinations tab reads "all inside the enclave". They are Syslog over TLS, Email (SMTP relay), Mattermost, Jira Data Center, Splunk HEC and Generic webhook (HMAC).

Next#