> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/integrations/integration-fundamentals.md).

# Integration Fundamentals

Material’s flexible architecture is built to connect with virtually any tool in your environment, ensuring your cloud workspace data is accessible wherever your team does their best work.

You can integrate Material’s cloud workspace detection and response capabilities with the rest of your security and IT ecosystem by connecting to the rest of your stack with a built-in or custom integration.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2F3yVlbYvUADNWvH1I81lV%2Fimage.png?alt=media&amp;token=4b86738b-9f9a-4e43-abb4-441482437eb2" alt=""><figcaption></figcaption></figure>

### Integration Types

Material uses webhooks and event subscriptions to send data to downstream tools. Specific events like a change in severity, specific detection, user action in a message, and more trigger the outbound notifications.

* Native integrations in Material are pre-configured with recommended events. Often you just need to create your receiver and paste that information into the integration in Material. Follow the guides linked below.
* If you don't see your preferred tool listed, you can use a custom integration to connect to nearly any downstream tool.

Choose a category to learn more:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Identity</strong></td><td>Integrate with your preferred identity providers to verify end-user credentials, sync information, receive security alerts, etc.</td><td><a href="/integrations/integration-fundamentals/identity-integrations.md">Identity Integrations</a></td></tr><tr><td><strong>Messaging and Ticketing</strong></td><td>Integrate with any message or ticketing tool that's not listed in our native integrations with a custom message and ticket integration.</td><td><a href="/integrations/integration-fundamentals/messaging-and-ticketing-integrations.md">Messaging and Ticketing Integrations</a></td></tr><tr><td><strong>SIEM</strong></td><td>Integrate your SIEM (Security Information and Event Management) tools with Material to send data like logs and threat data to use downstream for automated SIEM playbooks and more.</td><td><a href="/integrations/integration-fundamentals/siem-integrations.md">SIEM Integrations</a></td></tr><tr><td><strong>SOAR</strong></td><td>Material pushes workspace events to your SOAR (Security Orchestration, Automation, and Response) in real-time. When a critical incident occurs, your playbooks trigger instantly with the full picture already attached, drastically cutting down your mean time to respond.</td><td><a href="/integrations/integration-fundamentals/soar-integrations.md">SOAR Integrations</a></td></tr><tr><td><strong>Webhook</strong></td><td>Trigger outbound delivery based on a specific event like a change in severity, specific detection, user action in a message, and more.<br><br>Use this option when no other category fits your tool.</td><td><a href="/integrations/integration-fundamentals/custom-webhooks.md">Custom Webhooks</a></td></tr></tbody></table>

## Events

{% hint style="info" %}
Beginning in version 1.51:

* Existing subscriptions using the `case` events **still work and you can still edit them**
* `case` events can't be use for **new** subscriptions

[Learn more here.](https://docs.material.security/reference/case-event-migration-version-1.51)
{% endhint %}

<details>

<summary>How to view event documentation</summary>

1. Log in to Material.
2. From the toolbar in the upper-right, click **Integrations.**
3. Expand **API.**
4. From the left, browse the documentation or click **Tokens** to create API tokens.

![](https://docs.material.security/~gitbook/image?url=https%3A%2F%2F3441929823-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FDXSwW7QZtKgywlqSARjL%252Fuploads%252FDxsGsJiBZXUjNH7Fw8mn%252Fimage.png%3Falt%3Dmedia%26token%3D8eaf8f33-22ea-4e9c-a22c-22d8221e094a\&width=768\&dpr=3\&quality=100\&sign=ac26e06a\&sv=2)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/integrations/integration-fundamentals.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.