Source: qdash /integrations — c61 idea 1 refinements, 2026-08-13
Round two narrows the aperture to Idea 1: the integrations page as an operator truth table, not a marketplace. The job is to show what is live, what is only dry-run intent, what is projected but quantified from local telemetry, and what the operator should wire first. Projected is treated as measured readiness: no pipe exists, but qdash can prove what would flow through it.
What this page is for
The operator arrives with two kinds of fear: hidden exfiltration and fake readiness. This page earns trust by making both inspectable. It does not sell connectors as logos; it ranks them by current operational value.
Lead with the ledger
The loopback promise becomes a top-level object with numbers attached. Before the operator scans connectors, they can see the four truths that govern the entire page: local ingest, local exports, zero outbound bytes, and dry-run routing intent.
Directory by operator question
The directory keeps the single-table honesty of Idea 1, but each row now answers the question an operator actually has. "Connector" alone is not enough; the useful column is the operational decision it supports.
| Connector | Truth state | Operator question | Proof from local log | Next action |
|---|---|---|---|---|
| qcqcontrol event stream Telemetry · inbound | live last event 4s ago | Am I seeing the fleet? Primary source of truth for all other rows. | 148,912 events · 34 agents · 412 sessions · 9 MCP servers ingested. | |
| ↓Findings export Evidence · local export | local last export Sat 11:27 | Can I hand evidence to GRC today? A file leaves only when the operator asks for it. | 9 findings · JSON / CSV · generated client-side from local state. | |
| ↓Security packet Evidence · local export | local last packet Sat 11:27 | Can I prove control coverage? Turns local findings into an audit-facing packet. | SOC 2 evidence · 41 controls · 87% coverage. | |
| PdPagerDuty Alerting · outbound | dry-run rules saved Mon 09:40 | Who gets woken up? High-severity routing intent exists before delivery. | Would have paged 2 high findings this week; nothing sent. | |
| SlSlack Alerting · outbound | dry-run rules saved Mon 09:40 | Where does the SOC see triage? Channels are named, but no webhook delivery is live. | Would have sent 7 high/medium messages this week. | |
| SpSplunk SIEM · outbound | projected no endpoint configured | Can this feed my SIEM? The adoption gate for SOC teams. | Would stream 148,912 events + 9 findings · HEC JSON / OCSF 2004. | |
| S3Amazon S3 (Iceberg) Evidence archive · outbound | projected no bucket configured | Can I retain an append-only trail? The audit-retention answer for security and GRC. | Would archive 148,912 local events as OCSF to Parquet/Iceberg. | |
| IdOkta / Entra ID Identity · join | projected no IdP join | Are these agents org-backed? Turns observed identities into verified users and groups. | Would verify 14 observed identities and reduce unmapped ownership. | |
| JiJira Ticketing · outbound | projected no project mapped | Can findings enter the work queue? Converts security discoveries into owned remediation. | Would open tickets for 9 findings · issue + ADF target shape. |
Projected means payload preview
This is the refinement that gives projected teeth. A projected connector expands into the exact bundle it would carry today, the schema it would target, the blockers that keep it from being live, and the operator value unlocked by wiring it.
What should we wire first?
The page should not make the operator browse twelve equally weighted cards. It should rank the connector gaps by adoption value, observed local volume, and how much product work remains before a real delivery path exists.
| Rank | Connector | Why operator cares | Local proof | Product gap | Action |
|---|---|---|---|---|---|
| 01 | Splunk SIEM / detection | SOC adoption gate: findings and raw agent events need to land where analysts already search. | 148,912 events + 9 findings ready for HEC JSON / OCSF. | schema mostly ready; delivery path missing | |
| 02 | PagerDuty Alerting | High findings need an escalation path with test-send and failure visibility. | 2 high findings would have paged this week. | routing exists; endpoint + failure queue missing | |
| 03 | Amazon S3 (Iceberg) Evidence archive | GRC and security leaders need durable retention without manually downloading packets. | 148,912 append-only events can be archived. | payload known; bucket credentials and batching missing | |
| 04 | Okta / Entra ID Identity | Observed identities need org verification before team ownership is trusted. | 14 identities would be joined; 4 remain human-mapped. | join logic projected; highest cross-page leverage | |
| 05 | Jira Ticketing | Findings become accountable only when they enter remediation work. | 9 findings would create issues with evidence links. | issue shape known; ownership and sync missing |
Composed Idea 1
The strongest version of Idea 1 is a management surface, not a shelf. The page leads with a ledger, renders every connector exactly once, lets projected rows expand into payload previews, and keeps a small priority queue in view so the next build choice is obvious.