> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations overview

> How Cymph connects to the systems you already run — and what each connector reads and writes.

An integration is a connection between a Cymph workspace and a system you already operate: a SIEM, a SOAR platform, a ticketing system, a documentation space, or a cloud account. Integrations let Cymph pull context in (detection rules, assets, existing content) and push work out (deployed playbooks, published documentation, tasks, backups).

Integrations are configured **per workspace**, under **Manage → Integrations**. When you create one you can choose to share it with the rest of your organisation, so other workspaces can reuse the same instance without re-entering credentials.

See [Manage integrations](/integrations/manage) for creating, testing, editing, and deleting them.

Some integrations can go further than a one-off exchange and be kept **mirrored on a schedule** — see the [Sync Center](/synchronizer/overview).

## Available integrations

<CardGroup cols={2}>
  <Card title="Content sources" icon="file-text" href="/integrations/content/github">
    Import playbooks and documentation from — and publish documentation back to — GitHub, GitLab, GitBook, SharePoint, and Confluence.
  </Card>

  <Card title="Detection sources" icon="radar" href="/integrations/detection/wazuh">
    Derive preset scope from what you actually detect, using Wazuh, Microsoft Sentinel, Splunk Enterprise Security, or Cortex XSIAM.
  </Card>

  <Card title="Cloud & assets" icon="cloud" href="/integrations/cloud/aws">
    Discover and import cloud resources as Cymph assets from AWS and Azure.
  </Card>

  <Card title="SOAR & automation" icon="workflow" href="/integrations/automation/n8n">
    Deploy playbooks as executable workflows to Cortex XSOAR, n8n, and StackStorm.
  </Card>

  <Card title="Ticketing & case management" icon="ticket" href="/integrations/ticketing/jira">
    Deploy playbook steps into JIRA, ServiceNow, and DFIR-IRIS.
  </Card>

  <Card title="Notifications" icon="bell" href="/integrations/notifications/slack">
    Send execution notifications to a Slack channel or by SMS through Twilio.
  </Card>

  <Card title="Sync Center" icon="refresh-cw" href="/synchronizer/overview">
    Keep an integration's resources mirrored in a workspace on a schedule, instead of importing them by hand.
  </Card>
</CardGroup>

## What each integration can do

| Integration | Import content | Deploy workflow | Publish docs | Import assets | Detection scope | Backups | Scheduled sync |
| - | :-: | :-: | :-: | :-: | :-: | :-: | :-: |
| [GitHub](/integrations/content/github) | ✓ | — | ✓ | — | — | ✓ | ✓ |
| [GitLab](/integrations/content/gitlab) | ✓ | — | ✓ | — | — | — | ✓ |
| [GitBook](/integrations/content/gitbook) | ✓ | — | ✓ \* | — | — | — | ✓ |
| [SharePoint](/integrations/content/sharepoint) | ✓ | — | ✓ | — | — | — | ✓ |
| [Confluence](/integrations/content/confluence) | ✓ | — | ✓ \* | — | — | — | ✓ |
| [Wazuh](/integrations/detection/wazuh) | — | — | — | ✓ | ✓ | — | ✓ |
| [Microsoft Sentinel](/integrations/detection/microsoft-sentinel) | — | — | — | — | ✓ | — | — |
| [Splunk Enterprise Security](/integrations/detection/splunk-es) | — | — | — | — | ✓ | — | — |
| [Cortex XSIAM](/integrations/detection/cortex-xsiam) | ✓ | — | — | — | ✓ | — | — |
| [AWS](/integrations/cloud/aws) | — | — | — | ✓ | — | — | ✓ |
| [Azure](/integrations/cloud/azure) | — | — | — | ✓ | — | — | ✓ |
| [Cortex XSOAR](/integrations/automation/cortex-xsoar) | ✓ | ✓ | — | — | — | — | ✓ |
| [n8n](/integrations/automation/n8n) | ✓ | ✓ | — | — | — | — | ✓ |
| [StackStorm](/integrations/automation/stackstorm) | — | ✓ | — | — | — | — | — |
| [Splunk SOAR](/integrations/automation/splunk-soar) | ✓ | — \*\* | — | — | — | — | ✓ |
| [JIRA](/integrations/ticketing/jira) | — | ✓ | — | — | — | — | — |
| [ServiceNow](/integrations/ticketing/servicenow) | — | ✓ | — | — | — | — | — |
| [DFIR-IRIS](/integrations/ticketing/dfir-iris) | — | ✓ | — | — | — | — | — |

\* Markdown only — GitBook and Confluence do not accept PDF.<br />
\*\* Splunk SOAR imports playbooks but cannot yet be deployed to — see [its limitations](/integrations/automation/splunk-soar#limitations).<br />
Scheduled sync covers assets for Wazuh, AWS, and Azure, and playbooks for Cortex XSOAR, n8n, and Splunk SOAR, and from the documentation kept in GitHub, GitLab, GitBook, SharePoint, and Confluence — see [What can be synced](/synchronizer/overview#what-can-be-synced).

[Slack](/integrations/notifications/slack) and [Twilio](/integrations/notifications/twilio) are not in the table because they do none of the above: they are one-way notification targets that post execution updates to a channel or send them as SMS.

## Deploying playbooks

There are two distinct kinds of deployment, and an integration supports one or the other — never both:

* **Workflow** — the playbook is translated into an executable artefact on the target: an XSOAR or n8n workflow, a StackStorm action, a JIRA or ServiceNow ticket, a DFIR-IRIS case task.
* **Documentation** — the playbook is published as a document: either a Markdown file, or a summary report PDF including metadata, contributors, and the workflow image.

<Info>
  Publishing documentation is a **write** operation, so it needs broader credentials than importing does. Every content-source page states its read-only requirement and the additional permission publishing needs, side by side — check the Permissions section before granting anything.
</Info>

## Network access

Most integrations require Cymph to make **outbound** connections to an endpoint you operate. If that endpoint sits behind a firewall or a source-IP allowlist, you will need to permit Cymph's egress addresses — see [Egress control](/integrations/manage#egress-control).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.