MOCK← Phase 4|
Admin
/
Integrations

qdash ingests qcontrol's live event stream and exports findings locally — both work today. Outbound connectors are projected; each shows the real local volume it would carry. qdash binds 127.0.0.1 — nothing leaves unless you export it.

mock In the lab nothing is sent: every delivery below is simulated, and saving a connector saves nothing.

Connectors

Projected outbound destinations — each shows the real local volume it would carry.

Sources & enrichment

Bring identity and ownership context into qdash. Sources enrich locally — nothing is sent.

Okta / Entra IDWould match 14 observed harness identities against your IdP

Security & observability

Investigate qdash activity alongside your SIEM and observability stack.

Custom webhook active
21high routed
SplunkWould stream 48k events + 22 findings
Microsoft SentinelWould stream 22 findings + 37 egress destinations

Notifications & response

Alert teams or open incidents where people already respond. Severity routing here is consumed by Alerts.

Slack active
21high routed1medium routed
PagerDutyWould page on 21 high-severity findings
Email digestWould digest routed findings on a daily schedule

Remediation tracking

Turn findings into owned, trackable work for remediation.

JiraWould open tickets for 22 findings

Evidence & compliance

Retain evidence for audit, GRC analytics, and reporting.

Amazon S3 (Iceberg)Would archive 48k append-only events
SnowflakeWould land 22 findings for GRC analytics
S3-compatible storageWould archive 48k append-only events to your own object store

Live — working today

Inbound ingest and local export, both live now.

qcontrol event stream live · inbound

qcontrol's run + scan streams over a local socket, ingested append-only into SQLite in real time.
48k events · 14 harnesses · 1284 sessions · 14 MCP servers ingested

Findings export live · local

22 findings exportable now — a client-side download, no backend, stays on 127.0.0.1.

qdash binds 127.0.0.1 and stores everything append-only in local SQLite. Outbound connectors are projected and off by default — the counts describe local readiness, not transmitted volume. Alert-channel severity routing is authored on each connector's page and consumed by Alerts.

newNot in qdash yet: where each channel sends, by severity, and every delivery it made.

Notifications

2 of 4 connected

Where findings go, by severity. A channel takes the findings whose severity it sends.

Channel
Sends
Status
Slack
Slack
#sec-alerts
highmedium
Connectedlast delivery 11:40
{ }
Custom webhook
alerts.example.com/qdash
high
Connectednothing delivered yet
PagerDuty
PagerDuty
on-call
highwhen connected
Not connected
Microsoft Teams
Microsoft Teams
Posts selected findings to a channel
—
Not connected

Deliveries

3 total

Every notification sent, newest first. Drills are included: a drill is a test run of the real alert path, tagged with its id.

Time
What
Severity
Channel
Result
11:40
Unsanctioned MCP server in use · browser-tools
mediumSlackDelivered
09:12
MCP server changed since review · jira-sync
mediumSlackDelivered
Oct 26
Approved model providers only · deepseek.com
mediumSlackDelivered