Export events to your SIEM

At the end of this page you have one batch exporter enabled, and Quint is forwarding this workspace’s security events to it in batches. Creating or changing an exporter needs the Admin or Owner role. Every enabled batch exporter also receives the admin audit log as a second stream beside telemetry. You do not configure that separately; Settings › Audit shows how far it has got.

Before you start

The destination’s endpoint and credential, created in the other product first. Amazon S3 is the exception: it uses federated AWS IAM and there is no secret to enter.
Decide which of the seven event types this exporter should carry; see Integrations overview.

Create an exporter

Open the exporter form

Open Integrations under Workspace. In Event export, click Create exporter and choose the destination.

Fill in the destination's fields

Streams events to Splunk HTTP Event Collector. Fields: HEC URL (required), HEC token (required, secret), Index (default main), Sourcetype (default quint:event).

Indexes events into Elasticsearch or OpenSearch. Fields: Cluster URL (required), then exactly one credential: API key, or Username and Password. Index defaults to quint-events.

Sends events to Microsoft Sentinel through the Azure Monitor Logs Ingestion API. Fields: Directory (tenant) ID (required), Application (client) ID (required), Client secret (required, secret), Logs Ingestion URL (required), Data collection rule immutable ID (required, starts with dcr-), Stream name (default Custom-QuintEvent_CL).The Connect form lists the Azure steps in order: create a data collection endpoint in your workspace’s region, create a custom table named QuintEvent with a new data collection rule that uses that endpoint, register an app in Microsoft Entra ID with a client secret, and give that app the Monitoring Metrics Publisher role on the rule.The connection test sends one row to your QuintEvent table with quint_stream set to probe. If you have analytics rules or workbooks on that table, filter out rows where quint_stream is probe.The older connection method, a workspace ID with a primary (shared) key, is no longer accepted: Microsoft ended support for it (the HTTP Data Collector API) on 14 September 2026.

Test the connection where it is offered

Datadog, Elastic / OpenSearch, Microsoft Sentinel and Sumo Logic offer a connection test. Run it before you save. Splunk and Amazon S3 do not; the first batch is the test.

Save and enable

Click Create exporter, then Enable. A disabled exporter keeps its settings and sends nothing.

Confirm the audit stream

Open Settings › Audit. Under Streaming, the new destination appears with its State, Audit rows delivered and Audit cursor. If the table instead says “No batch exporter is configured, so the audit log is not streamed anywhere yet.”, the exporter is not enabled.

Change or remove an exporter

Edit or Replace settings changes the fields. A secret you replace is never shown back to you.
Disable pauses delivery and keeps the settings.
Remove deletes the exporter. Events already delivered stay where they landed.

If this fails

What you see	What it means	What to do
The connection test fails	The endpoint or credential was rejected by the destination	Check the URL and paste the credential again. For Elastic, enter one credential kind only, not both.
Nothing arrives in the destination after Enable	The exporter’s filter matches no events yet, or the destination refuses the batches	Widen the filter. For Splunk, confirm the HEC token is enabled and the index exists.
Batches do not land in the bucket	Your bucket policy does not allow Quint’s federated access, or Region is wrong	Check Bucket and Region. Ask your Quint contact what to allow in your bucket policy.
Settings › Audit shows “No batch exporter is configured, so the audit log is not streamed anywhere yet.”	No exporter is enabled	Click Enable on the exporter.
Audit rows delivered stays at zero	No settings change has been recorded since the exporter was enabled, or delivery is failing	Make one settings change and wait for the next batch. If the count stays at zero, see Get support.

Events are kept for 14 to 45 days and divergence findings for 14 days. An exporter is how you keep them longer. See Workspace, data region and retention.

Webhooks and event fields, for the fields in each exported event
Compliance and audit, for the audit log inside the dashboard

Get Started

Install the Endpoint

Use the Dashboard

Policies

Integrations

Settings

Troubleshooting

Reference

Export events to your SIEM

Before you start

Create an exporter

Change or remove an exporter

If this fails

Next

​Before you start

​Create an exporter

​Change or remove an exporter

​If this fails

​Next

Before you start

Create an exporter

Change or remove an exporter

If this fails

Next