# Integrations overview
URL: /integrate
Foxborne sends nothing out of your network until an admin turns on egress for a destination. The Connect group of the console holds the integration catalog, the alert rules and the automations, and a delivery ledger records every message that leaves.
A self-hosted deployment starts with no path out. It sends no telemetry, crash reports or license checks, and it calls no map or tile service. Each destination on these pages stays off until an admin turns on its egress.
The console groups this work under **Connect** in the sidebar, between **Data** and **Administration**:
| Page | Address | What the page says it holds |
| ---------------- | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Integrations** | `/app/integrations` | "Where Foxborne sends alerts, tickets, logs and exports, and what it listens on. Egress is off by default, and an admin turns on each destination." |
| **Alerts** | `/app/alerts` | "Alert rules decide who hears about a finding, how fast and with how much detail." |
| **Automations** | `/app/automations` | "What Foxborne does on its own when a sortie closes out or an alert fires." |
The sidebar counts flag what needs a person. **Integrations** shows, in amber, how many deliveries sit in the dead-letter queue. **Automations** shows how many runs are held for approval.
## The Integrations page [#the-integrations-page]
**Integrations** has four tabs, each with its own address:
| Tab | Address | What it shows |
| ------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Destinations** | `/app/integrations` | The outbound catalog in three groups, each destination's data class and its **Egress** switch. **Add destination** sets up one that is not configured yet. |
| **Ingest** | `/app/integrations/ingest` | The endpoints Foxborne listens on and the files it imports, each with its state |
| **Exports** | `/app/integrations/exports` | Every export requested from an incident and the export formats. **Approval policy** opens the approval rules and the named approvers, and **New export** starts one. |
| **Delivery ledger** | `/app/integrations/ledger` | Every outbound delivery in the last 7 days, with its payload SHA-256 and the response |
Select any row to open its drawer. A destination's drawer shows **This deployment** (what your program configured), **How it connects**, **Government suitability**, any **Recent change** and the **Sources** behind each claim. The sources are shown as text: "this deployment has no route to them."
## Five families [#five-families]
The catalog sorts integrations into five families. The **Air-gapped** column repeats the console's wording: **Yes** means the integration works with no network path out of the enclave.
### Notify [#notify]
"Alerts to people: email, chat, pagers and webhooks." See [Alerts](/integrate/alerts) and [Webhooks](/integrate/webhooks).
| Integration | Protocol | Auth | Air-gapped |
| --------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------- | ---------- |
| Email (SMTP relay) | SMTP submission, 587 STARTTLS or 465 TLS | SMTP AUTH (OAuth for Exchange Online) or relay allowlist | Yes |
| Mattermost | HTTPS webhook or REST | Secret webhook URL or bot token | Yes |
| Microsoft Teams (GCC High, DoD) | Teams bot, or Graph REST at `graph.microsoft.us` or `dod-graph.microsoft.us` | Entra ID (`login.microsoftonline.us`) | No |
| Microsoft Teams (commercial, GCC) | Workflows webhook | Tenant OAuth token option | No |
| GovSlack | HTTPS webhook or Web API on `slack-gov.com` | Webhook URL or bot token | No |
| PagerDuty | Events API v2 | Routing key | No |
| AWS SNS (GovCloud) | SNS Publish over HTTPS | IAM role (SigV4) | No |
| Generic webhook (HMAC) | HTTPS JSON with Standard Webhooks headers | HMAC-SHA256, optional mTLS | Yes |
| Alertmanager and Grafana | Alertmanager API v2 `/api/v2/alerts`, or a metrics endpoint Grafana queries | mTLS or bearer through a proxy | Yes |
### Ticketing [#ticketing]
"Issues that hold the case link, so work is tracked where the team already tracks it." See [Ticketing](/integrate/ticketing).
| Integration | Protocol | Auth | Air-gapped |
| --------------------------------------- | ------------------------------------- | ------------------------------------------------ | ---------------------- |
| Jira Data Center | REST v2 | Personal access token (Bearer) | Yes, until end of life |
| Jira Cloud (Atlassian Government Cloud) | REST v3 | OAuth 2.0 (3LO) | No |
| ServiceNow (GCC, NSC) | Table API; Event Management `jsonv2` | OAuth 2.0 or a web-service-only integration user | No |
| GitLab self-managed | Issues API v4, or alert HTTP endpoint | Project access token; alert Bearer key | Yes |
### Forward logs [#forward-logs]
"Findings, the audit log and normalized events for your SIEM or data platform." See [Forward logs to your SIEM](/integrate/siem).
| Integration | Protocol | Auth | Air-gapped |
| --------------------------- | ----------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------- |
| Syslog over TLS | RFC 5424 over RFC 5425 on 6514, with RFC 9662 cipher suites | Mutual X.509 | Yes |
| Splunk HEC | HTTPS JSON to `/services/collector/event`, with ack | HEC token | Yes (Enterprise) |
| Elasticsearch or OpenSearch | HTTPS `_bulk` NDJSON | API key or mTLS | Yes (self-managed) |
| Microsoft Sentinel | Logs Ingestion API (DCR) | Entra client credentials, audience `monitor.azure.us` | No |
| Kafka | Kafka protocol | mTLS, or SASL SCRAM or OAUTHBEARER, plus ACLs | Yes (self-managed) |
| OTLP export | OTLP/HTTP `/v1/logs` | mTLS or bearer | Yes |
| AWS SQS or EventBridge | SendMessage, PutEvents | IAM role | No |
| S3 with Object Lock | S3 PutObject via FIPS endpoint | IAM role | Only with an on-prem S3-compatible store (vendor-specific) |
A destination outside the enclave shows **Needs a network path out** until it is configured: both Teams entries, GovSlack, PagerDuty, Jira Cloud, ServiceNow and Sentinel. AWS SNS and AWS SQS or EventBridge show **Needs a VPC endpoint**, because egress is denied at the VPC.
### Ingest [#ingest]
"Endpoints Foxborne listens on, and the files it imports." Connections Foxborne reads from, such as a log bucket, stay on **Sources**. See [Stream logs to Foxborne](/collect/streaming) and [Push bundles with the Ingest API](/collect/sources/ingest-api).
| Endpoint | Protocol | Air-gapped | State in the example dataset |
| -------------------------- | --------------------------------------------------------------- | ----------------------------------- | ---------------------------------------- |
| HTTPS ingest API | HTTPS POST, chunked and resumable, Content-Digest | Yes | **Listening**, used by Bench rig uploads |
| S3 bucket watch | S3 ObjectCreated to SQS | No; use a watched directory on-prem | **Listening**, used by Fleet log archive |
| Fluent Bit or Vector agent | `http`, `s3` or `opentelemetry` outputs | Yes | Off |
| OTLP receiver | OTLP/HTTP on 4318 | Yes | Off |
| journald receiver | systemd-journal-remote protocol, HTTPS 19532 | Yes | Off |
| Syslog receiver | RFC 5425 TLS on 6514 | Yes | Off |
| MAVLink log-pull agent | MAVLink `LOG_*` or MAVLink FTP over the ground link, then HTTPS | Yes | Off |
| File import | Upload, drop folder or removable media | Yes | **On, 4 formats**, used by Import files |
| TENA gateway (later phase) | TENA middleware adapter | Yes (range network) | **Later phase** |
The TENA gateway, an adapter for the DoD test-range middleware, is a later phase, and nothing listens for it yet.
### Export [#export]
"Every format works air-gapped. Destinations are a download, an on-premises share, removable media or S3 in GovCloud." See [Export formats and evidence bundles](/integrate/exports).
| Format | Class | What the console says it holds |
| ------------------------------------ | ----- | ------------------------------------------------------------------------------------------------------- |
| MCAP | L2 | The aligned timeline for Foxglove and ROS 2 tools, with the case ID and source SHA-256s in its metadata |
| Apache Parquet | L2 | One table per signal family, UTC timestamps in microseconds, for fleet analytics |
| CSV and JSONL | L2 | CSV for spreadsheets and scripts, JSON Lines for SIEM and stream loaders |
| Original files with SHA-256 manifest | L2 | Byte-identical originals and a sha256sum-style manifest, checked again on export |
| BagIt evidence bundle | L2 | An RFC 8493 bag with SHA-256 and SHA-512 manifests and the case metadata in `bag-info.txt` |
| PDF case file with CUI markings | L1 | The report, with CUI in the banner and footer of every page and the designation indicator on the first |
| MATLAB .mat v7.3 | L2 | HDF5-based, for flight-test engineers' MATLAB and Simulink tools |
## Egress, data classes and the ledger [#egress-data-classes-and-the-ledger]
An admin turns on each destination with a host allowlist, a protocol, a credential reference and a data class. The data class decides what may leave in each message:
* **L0:** "Metadata: rule, severity, vehicle alias, UTC time and case link."
* **L1:** "Summary with values. Treat it as CUI."
* **L2:** "Evidence files. They move only through Export, with approval."
Everything outside the enclave gets L0 by default, and L1 goes only to destinations your program has authorized for CUI. [Egress, data classes and the delivery ledger](/integrate/egress-controls) sets out each guardrail and the ledger that records every delivery.
## Works without any network path out [#works-without-any-network-path-out]
An air-gapped enclave can run a complete set of integrations. Every entry below reads **Yes** in the **Air-gapped** column:
* **Notify:** Email (SMTP relay) through your own relay, Mattermost, Generic webhook (HMAC) and Alertmanager and Grafana.
* **Ticketing:** GitLab self-managed, and Jira Data Center until its end of life on 28 March 2029.
* **Forward logs:** Syslog over TLS, Splunk HEC with Splunk Enterprise, OTLP export and self-managed Elasticsearch, OpenSearch or Kafka.
* **Ingest:** every endpoint except the S3 bucket watch, including File import and the HTTPS ingest API.
* **Export:** every format.
In the example dataset, six destinations have egress on, and the **Destinations** tab reads "all inside the enclave". They are Syslog over TLS, Email (SMTP relay), Mattermost, Jira Data Center, Splunk HEC and Generic webhook (HMAC).
## Next [#next]
Who turns egress on, what may leave and how every delivery is recorded.
Six alert rules, their routes and the destinations that carry them.
Sortie closeout, failsafe evidence, repeat faults and retention.
Signed run and case events to a receiver you run.
The audit log, the ledger and findings for your SIEM.
Issues that carry the case link, with status sync from Jira Data Center.
Seven formats, four destinations and the approval rules.
The ingest endpoints and what each one listens on.