> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations overview

> How Cymph connects to the systems you already run — and what each connector reads and writes.

An integration is a connection between a Cymph workspace and a system you already operate: a SIEM, a SOAR platform, a ticketing system, a documentation space, or a cloud account. Integrations let Cymph pull context in (detection rules, assets, existing content) and push work out (deployed playbooks, published documentation, tasks, backups).

Integrations are configured **per workspace**, under **Manage → Integrations**. When you create one you can choose to share it with the rest of your organisation, so other workspaces can reuse the same instance without re-entering credentials.

See [Manage integrations](/integrations/manage) for creating, testing, editing, and deleting them.

## Available integrations

<CardGroup cols={2}>
  <Card title="Content sources" icon="file-text" href="/integrations/content/github">
    Import playbooks and documentation from — and publish documentation back to — GitHub, GitLab, GitBook, SharePoint, and Confluence.
  </Card>

  <Card title="Detection sources" icon="radar" href="/integrations/detection/wazuh">
    Derive preset scope from what you actually detect, using Wazuh, Microsoft Sentinel, or Splunk Enterprise Security.
  </Card>

  <Card title="Cloud & assets" icon="cloud" href="/integrations/cloud/aws">
    Discover and import cloud resources as Cymph assets from AWS and Azure.
  </Card>

  <Card title="SOAR & automation" icon="workflow" href="/integrations/automation/n8n">
    Deploy playbooks as executable workflows to Cortex XSOAR, n8n, and StackStorm.
  </Card>

  <Card title="Ticketing & case management" icon="ticket" href="/integrations/ticketing/jira">
    Deploy playbook steps into JIRA, ServiceNow, and DFIR-IRIS.
  </Card>

  <Card title="Notifications" icon="bell" href="/integrations/notifications/slack">
    Send execution and task notifications to a Slack channel.
  </Card>
</CardGroup>

## What each integration can do

| Integration                                                      | Import content | Deploy workflow | Publish docs | Import assets | Detection scope | Backups |
| ---------------------------------------------------------------- | :------------: | :-------------: | :----------: | :-----------: | :-------------: | :-----: |
| [GitHub](/integrations/content/github)                           |        ✓       |        —        |       ✓      |       —       |        —        |    ✓    |
| [GitLab](/integrations/content/gitlab)                           |        ✓       |        —        |       ✓      |       —       |        —        |    —    |
| [GitBook](/integrations/content/gitbook)                         |        ✓       |        —        |     ✓ \*     |       —       |        —        |    —    |
| [SharePoint](/integrations/content/sharepoint)                   |        ✓       |        —        |       ✓      |       —       |        —        |    —    |
| [Confluence](/integrations/content/confluence)                   |        ✓       |        —        |     ✓ \*     |       —       |        —        |    —    |
| [Wazuh](/integrations/detection/wazuh)                           |        —       |        —        |       —      |       ✓       |        ✓        |    —    |
| [Microsoft Sentinel](/integrations/detection/microsoft-sentinel) |        —       |        —        |       —      |       —       |        ✓        |    —    |
| [Splunk Enterprise Security](/integrations/detection/splunk-es)  |        —       |        —        |       —      |       —       |        ✓        |    —    |
| [AWS](/integrations/cloud/aws)                                   |        —       |        —        |       —      |       ✓       |        —        |    —    |
| [Azure](/integrations/cloud/azure)                               |        —       |        —        |       —      |       ✓       |        —        |    —    |
| [Cortex XSOAR](/integrations/automation/cortex-xsoar)            |        ✓       |        ✓        |       —      |       —       |        —        |    —    |
| [n8n](/integrations/automation/n8n)                              |        ✓       |        ✓        |       —      |       —       |        —        |    —    |
| [StackStorm](/integrations/automation/stackstorm)                |        —       |        ✓        |       —      |       —       |        —        |    —    |
| [Splunk SOAR](/integrations/automation/splunk-soar)              |        ✓       |      — \*\*     |       —      |       —       |        —        |    —    |
| [JIRA](/integrations/ticketing/jira)                             |        —       |        ✓        |       —      |       —       |        —        |    —    |
| [ServiceNow](/integrations/ticketing/servicenow)                 |        —       |        ✓        |       —      |       —       |        —        |    —    |
| [DFIR-IRIS](/integrations/ticketing/dfir-iris)                   |        —       |        ✓        |       —      |       —       |        —        |    —    |

\* Markdown only — GitBook and Confluence do not accept PDF.<br />
\*\* Splunk SOAR imports playbooks but cannot yet be deployed to — see [its limitations](/integrations/automation/splunk-soar#limitations).

[Slack](/integrations/notifications/slack) is not in the table because it does none of the above: it is a one-way notification target that posts execution and task updates to a channel.

## Deploying playbooks

There are two distinct kinds of deployment, and an integration supports one or the other — never both:

* **Workflow** — the playbook is translated into an executable artefact on the target: an XSOAR or n8n workflow, a StackStorm action, a JIRA or ServiceNow ticket, a DFIR-IRIS case task.
* **Documentation** — the playbook is published as a document: either a Markdown file, or a summary report PDF including metadata, contributors, and the workflow image.

<Info>
  Publishing documentation is a **write** operation, so it needs broader credentials than importing does. Every content-source page states its read-only requirement and the additional permission publishing needs, side by side — check the Permissions section before granting anything.
</Info>

## Network access

Most integrations require Cymph to make **outbound** connections to an endpoint you operate. If that endpoint sits behind a firewall or a source-IP allowlist, you will need to permit Cymph's egress addresses — see [Egress control](/integrations/manage#egress-control).