Setting up connectors

The Integration Center is where you connect Qevlar to the security tools in your environment, see exactly which permissions Qevlar holds on each one, and diagnose a connection that has stopped working. This article covers the reworked Integration Center, available to all customers.

Where to find it

Go to Integrations in the main navigation. The Integration Center is available to admins only.

If your organization manages several customer environments, use the profile selector at the top of the page to switch between them. Integrations are configured per profile.

The integrations list

The page lists every integration available to the selected profile, split into two groups:

Connected integrations are listed first. Above the list, a summary line gives the state of the whole profile at a glance — for example All connected, 3 of 5 connected, or a message naming the integration that needs attention.

Select any row to open its detail panel on the right.

Connection status

Rather than a simple connected / not-connected flag, each integration carries a graded status based on a live check of the individual permissions Qevlar holds.

Status is re-checked automatically on a schedule, so a permission revoked on your side surfaces in the Integration Center rather than mid-investigation.

Integration details

Opening an integration shows its current status and the reason behind it, followed by:

• Connection details — when the connection was last tested, plus the configuration values in use (secrets are masked). Use Manage credentials to update them.
• Permission requirements — every permission Qevlar needs from this tool, and whether you have granted it.

Permission requirements

Permissions are grouped by what they let Qevlar do:

• Alert ingestion — pulling alerts and incidents into Qevlar
• Investigation — querying logs, entities and events while investigating
• Remediation — response actions taken in the connected tool
• Other

Each permission carries a level and a live status.

Select any permission to open its detail view, which shows:

• What the permission lets Qevlar do, in plain language
• When it was last checked
• How to activate — the steps to grant it in the connected tool, shown when the permission is not granted
• The exact scope name, so your security team can verify Qevlar is asking for least privilege
• Test permission — re-check this single permission without re-running everything

Testing a connection

From the actions menu on an open integration:

• Test All — re-checks the credentials and every permission, then updates the status.
• Read the docs — opens the setup guide for that specific connector.

To re-check a single permission instead, use Test permission in the permission detail view. This is the fastest way to confirm a fix after granting a scope on your side.

Permissions are also verified when you first save credentials, so a setup problem surfaces immediately rather than at the first investigation.

Data access

For integrations that expose multiple datasets, Data access in the actions menu shows which datasets Qevlar can read, grouped by type. Where the integration supports it, you can select the datasets Qevlar should use and save your choice. A dataset marked no longer available is one that was previously selected but is no longer exposed by the source.

For Splunk, datasets are configured by Qevlar. If you need them changed, email support@qevlar.com.

Adding an integration

1. Select Add connector at the top of the page.
2. Browse or filter the catalog by category and choose the tool you want to connect.
3. Enter the connection details. Each connector's own help article lists the exact credentials and permissions to prepare beforehand.
4. Save. Qevlar tests the credentials and every declared permission, then reports what is granted and what is missing.

Removing an integration

Select Delete from the actions menu and confirm.

Troubleshooting