Integrations
Read-only, and specific about it
Every integration below names the actual views, endpoints and files it reads, and the exact permission each requires. No integration needs write access to anything.
Sources, not connectors
An integration here does not move your data anywhere. It reads metadata so an investigation has evidence.
That distinction matters more than it sounds. A connector in most products means a pipe: it extracts your data and puts it somewhere else. Nothing on this page does that. These are read-only metadata sources — catalog views, scheduler tables, run history, and the counts that are already being recorded — collected by an agent inside your network and scoped to a specific incident.
They are also deliberately not ranked. The topology is assembled from every provider that can reach something, and none of them is treated as authoritative — because on most of these platforms the definition that actually executes is not the one in source control.
| Where the definition lives | Platforms | How it is read |
|---|---|---|
| Definition lives in a service | Glue, Data Factory, Databricks, Fivetran | Read through the service API — there is no file |
| Definition lives in a database | SQL Agent, SSIS, Oracle, Informatica | Read from catalog and repository tables |
| Definition is in git, behaviour is not | Airflow, dbt | Connections, variables and artefacts read separately |
| No definition anywhere | Bespoke services, cron | Inferred from logs, config and write activity |
Databases
SQL Server
Reads catalog metadata, procedure bodies and write activity — the definitions git never sees.
ReadPostgreSQL
pg_stat_user_tables for write activity, pg_proc for function bodies, pg_stat_activity for live blocking.
ReadMySQL
performance_schema for per-table write counts, information_schema for routines and structure.
ReadOracle Database
ALL_SOURCE for PL/SQL bodies, DBA_TAB_MODIFICATIONS for write activity, DBA_SCHEDULER_JOBS for schedules.
ReadSchedulers
SQL Server Agent
Job steps are rows in msdb, not files in git. Reads sysjobs, sysjobsteps and sysjobhistory.
ReadSSIS
SSISDB holds executions, per-component row counts and the parameter values actually used.
Readcron & systemd timers
The scheduler with no database. Reads crontabs, timer units and journal history.
ReadOrchestrators
Apache Airflow
The metadata database holds connections, variables, pools and manual state — none of it in git.
Readdbt
manifest.json is the model graph; run_results.json is what actually happened. Both are artefacts, not APIs.
ReadDatabricks
Jobs API for run history and task graphs; system tables for lineage and query history.
ReadCloud ETL
AWS Glue
For visual jobs there is no file. The DAG is service state, read through GetJob.
ReadAzure Data Factory
Pipeline JSON lives in the factory unless git integration is enabled — and live mode is the default.
ReadFivetran
Sync history and schema change events via API, plus the _fivetran_synced column in every target.
ReadInformatica PowerCenter
The repository database holds mappings, sessions and run statistics — including per-target row counts.
ReadWarehouses
Snowflake
ACCOUNT_USAGE gives a year of query, copy and task history — including rows loaded and rows rejected.
ReadBigQuery
INFORMATION_SCHEMA.JOBS gives every statement, its referenced tables and its output row count.
ReadAmazon Redshift
STL_LOAD_ERRORS is the reject table you already have and probably never query.
ReadClickHouse
system.query_log carries read_rows and written_rows per statement; system.parts carries real write activity.
ReadQueues and streams
Apache Kafka
Consumer lag is the leading indicator. Reads group offsets, topic ends and partition assignment.
ReadRabbitMQ
Queue depth, consumer count and dead-letter queues — the last of which is usually the finding.
ReadCustom services
No API and no metadata database — structured logs, config files and the tables they write to.
ReadWhat every integration has in common
- Read-only. No integration requires write access to anything.
- A finite query catalogue. The statements the agent may run are held in a file on your host and approved by your team — see the agent.
- Redaction before transmission. Applied inside your network, not on ingest.
- Scoped to an incident. Collection is not continuous; topology discovery is the one exception and reads metadata only.
- A stated limit. Every page above says what its source cannot tell you.
The full posture — threat model, what crosses the boundary, retention and access — is on the security page.
Get started
Bring us a pipeline that broke last week
The fastest way to evaluate this is a real incident you already know the answer to. If Decim gets it wrong, that is a far more useful demo than one where it doesn't.