DSPM’s integrations live on the platform page Integrations → Notifications & Destinations, which every product shares. Open its Event Destinations tab and filter to Data Security. DSPM has no Integrations page of its own: the old /dspm/integrations address opens the shared page, filtered to Data Security. The page has four tabs: Notification Channels, Event Destinations, Ticket Rules and Issue Tracker. Only organization owners and admins can add or change destinations.

​
Event destinations

Choose a category (SIEM, XDR, SSE, DLP or Workflow), then add a destination:
Destination typeCategoriesConfiguration
Signed webhookSIEM, XDR, SSE, WorkflowHTTPS webhook URL (redirects are not followed) and a signing secret
Splunk HECSIEM, XDRHEC URL and token, optional index and sourcetype
Microsoft SentinelSIEMDirectory (tenant) ID, application (client) ID and client secret, data collection endpoint, DCR immutable ID, stream name and cloud. The application needs the Monitoring Metrics Publisher role on the data collection rule.
Syslog / CEF over TLSSIEM, XDR, SSECollector host, port, framing (octet counting or one message per line), optional hostname and CA certificate
Notification channelWorkflowA connected Slack, Microsoft Teams, email or PagerDuty channel
Each destination also takes a name, the products, the events, a minimum severity, the cloud accounts it covers, and whether it is enabled. There is no vendor-specific XDR or SSE connector: those categories use the generic types above. DSPM publishes these events:
EventWhen
Finding openedA new or reopened Finding
Finding resolvedA Finding closed
Incident opened, Incident updatedA data detection and response incident changes
Data access anomaly (DDR)Unusual access to a datastore
Scan failedA scan failed. The minimum severity does not filter this event.
Events carry asset, account, rule and data class names. They never carry a sampled or raw data value. Events are picked up every 30 seconds and retried with backoff for about two hours before they are dead-lettered. The tab shows delivered, failed and dead-lettered counts.

​
DLP exports

Under DLP, Data Security label and identifier exports produces files for your DLP tools. Nothing is pushed.
  • Sensitivity labels: datastores or objects with their sensitivity, as CSV or JSON, filtered by account, datastore type and sensitivity. Up to 50,000 rows.
  • Data identifiers: every built-in and custom classifier as an RE2 pattern with its keywords and validator, as CSV or JSON.

​
Ticket rules

A ticket rule opens a ticket for every new or reopened Finding that matches all its filters, the same way as a Finding’s Create Ticket action. Each Finding gets one ticket per tracker, from the first rule that matches.
1

Connect a tracker

On the Issue Tracker tab, connect Jira, GitHub Issues, Linear or ServiceNow.
2

Add a rule

On the Ticket Rules tab, select Add a ticket rule and set the name, the tracker, the minimum severity, the products, the DSPM policies and use cases, and the cloud accounts.
3

Check it

The rules table shows how many Findings each rule matched and how many tickets it opened.
Notification channels and the issue tracker are described in Notifications.