Pages
Integrations — Ideas v4

Source: qdash /integrations — c61 JTBD affordance pass, 2026-08-13

This pass keeps the jobs-to-be-done framing and adds the next layer: what can the operator do from each job? The page needs a small, repeatable affordance grammar: inspect local truth, simulate with current data, export a packet, configure intent, and graduate a route toward live delivery.

Frame

Affordances follow the job

A connector catalog gives every route the same weight. A job surface gives each action a reason: if the job is "wake responders," the affordances are replay, edit severities, send a test later, and inspect would-fire rows. If the job is "hand evidence to auditors," the affordances are export, preview packet, archive later, and prove what stayed local.

Inspect
Open the local proof: events, findings, route replay, packet contents.
Simulate
Run current telemetry through a route without sending anything.
Export
Produce an explicit local handoff: CSV, JSON, packet, schema.
Configure
Author intent that qdash can persist today: severities, scope, destination shape.
Go live
Future affordance: credentials, test-send, retry queue, health state.
RuleEvery visible connector must answer one job and one affordance.If it cannot, it belongs below the fold or behind "more routes."
Iteration A

Job launchpad with action handles

The first screen can stay job-first while adding strong, compact handles. Each job gets one primary action, one local proof value, and a small set of secondary affordances.

Prove nothing leaves

live

Trust starts with a receipt before downstream routes enter the conversation.

Local proof
0 bytes
network sent by qdash this session

Get findings into SOC

projected

Analysts need qdash findings and event context inside SIEM search.

Local proof
148.9k + 9
events and findings ready for Splunk/Sentinel payloads

Wake responders

dry-run

Severity routing already carries operator intent; the missing layer is delivery.

Local proof
10
would-fire actions this week

Hand evidence to auditors

local now

GRC needs a packet today and durable archive options later.

Local proof
87%
SOC 2 evidence coverage in local packet

Verify ownership

projected

Observed identities become trusted when joined to the customer org.

Local proof
14 / 4
observed identities / human mappings still needed

Move findings to remediation

projected

Findings need owners, tickets, and evidence links to become work.

Local proof
9
findings ready to draft as issues
Iteration B

A job workspace

When a job opens, the page becomes a small workspace: current proof on the left, routes in the middle, and the action stack on the right. The affordances are concrete enough that an engineer can see the product/API work implied by each button.

Get findings into the SOC
Turn qdash findings and supporting agent events into a SIEM-ready stream. Today the payload can be previewed; live delivery needs endpoint config, credential storage, retries, and health checks.
projected route
9
findings
2
high severity
148.9k
events
7
egress entities
Payload affordance
{
"event.kind": "finding",
"finding.uid": "F-009",
"severity": "high",
"actor.email": "sofia@meridian.dev",
"control.id": "credential-redaction",
"evidence.source": "local qcontrol stream"
}
Iteration C

Affordance matrix

This table is the product checklist. It shows which affordances each job should expose, and it keeps "projected" honest by distinguishing local actions from product-missing live paths.

JobInspectSimulateConfigureExportGo live
Get findings into SOC
projected route
sample event
148.9k events
HEC / OCSF
sample bundle
not wired
Wake responders
dry-run
10 actions
this week
saved rules
route audit
not wired
Hand evidence to auditors
local now
41 controls
148.9k rows
future schedule
works now
not wired
Verify ownership
projected join
14 identities
alias hints
manual today
identity audit
not wired
Iteration D

Recipes for accomplishing the job

Recipes turn affordances into short paths. This is useful when the operator does not think in integration names at all; they think in outcomes like "SOC handoff by Friday" or "evidence packet for the auditor."

SOC handoff by Friday
Give analysts a credible preview before delivery exists.
projected
1
Preview Splunk payload
Show representative finding + event context from local telemetry.
2
Copy schema bundle
HEC JSON / OCSF target shape for SOC review.
3
Estimate daily volume
2.1k events/day based on current local stream.
4
Request live route
Product gap becomes endpoint config + credential store + health.
Responder routing review
Tune severity routes without sending anything.
dry-run
1
Replay this week
Show the 2 pages, 7 messages, and 1 digest that would have fired.
2
Edit severity matrix
Persist high/medium/low/info routing intent.
3
Export route audit
Give security leadership a local decision record.
4
Define test-send
Future live affordance, not implied today.
Auditor evidence packet
Produce today’s proof while naming archive paths.
live/local
1
Inspect packet contents
41 controls, findings, local storage claim, and coverage.
2
Export SOC 2 packet
Explicit operator download; nothing automatic leaves qdash.
3
Preview S3 archive
Projected retention path based on 148,912 append-only events.
4
Record local receipt
0 bytes sent by qdash remains visible beside the export.
Coda

What changes from v3

v3 answered why each integration is on the page. v4 makes the next interaction visible: inspect, simulate, export, configure, or advance toward live. That is the bridge from a thoughtful framing to an operator-ready product surface.

Affordances make jobs real
A job card becomes actionable when it has verbs: inspect, replay, export, configure, request.
Projected stops being passive
Projected routes expose local previews and missing live pieces instead of inert future-state cards.
The API punch list emerges
Disable, test-send, credential store, endpoint validation, retry queue, and health states become visible work.

Qpoint Brand Style Guide