# Overview

Tenzir offers a layered integration architecture. It ranges from turn-key packages at the top to native protocol connectors at the core.

## Packages

[Packages](https://preview.docs.tenzir.com/375/375/explanations/packages.md) are 1-click deployable integrations that deliver instant value. They bundle pipelines, [Enrichment](https://preview.docs.tenzir.com/375/375/explanations/enrichment.md), and configurations for common security tools like Splunk, CrowdStrike, Elastic, SentinelOne, Palo Alto, and many more.

Browse our freely available [package library on GitHub](https://github.com/tenzir/library). You can also use [Use agent skills](https://preview.docs.tenzir.com/375/375/guides/ai-workbench/use-agent-skills.md) to generate custom packages with AI assistance.

## Core Integrations

Core integrations are native connectors to the ecosystem, enabling communication over numerous protocols and APIs:

* **Cloud storage**: [S3](https://preview.docs.tenzir.com/375/375/integrations/amazon/s3.md), [Cloud Storage](https://preview.docs.tenzir.com/375/375/integrations/google/cloud-storage.md), [Azure Blob Storage](https://preview.docs.tenzir.com/375/375/integrations/microsoft/azure-blob-storage.md)
* **Cloud logging**: [CloudWatch](https://preview.docs.tenzir.com/375/375/integrations/amazon/cloudwatch.md), [Cloud Logging](https://preview.docs.tenzir.com/375/375/integrations/google/cloud-logging.md)
* **Cloud APIs**: [Graph](https://preview.docs.tenzir.com/375/375/integrations/microsoft/graph.md)
* **Message queues**: [Kafka](https://preview.docs.tenzir.com/375/375/integrations/kafka.md), [NATS](https://preview.docs.tenzir.com/375/375/integrations/nats.md), [SQS](https://preview.docs.tenzir.com/375/375/integrations/amazon/sqs.md), [AMQP](https://preview.docs.tenzir.com/375/375/integrations/amqp.md)
* **Databases and analytics**: [Snowflake](https://preview.docs.tenzir.com/375/375/integrations/snowflake.md), [ClickHouse](https://preview.docs.tenzir.com/375/375/integrations/clickhouse.md), [Microsoft SQL Server](https://preview.docs.tenzir.com/375/375/integrations/microsoft/sql-server.md), [MySQL](https://preview.docs.tenzir.com/375/375/integrations/mysql.md), [Prometheus](https://preview.docs.tenzir.com/375/375/integrations/prometheus.md)
* **Network protocols**: [TCP](https://preview.docs.tenzir.com/375/375/integrations/tcp.md), [UDP](https://preview.docs.tenzir.com/375/375/integrations/udp.md), [HTTP(S)](https://preview.docs.tenzir.com/375/375/integrations/http.md), [Syslog](https://preview.docs.tenzir.com/375/375/integrations/syslog.md)

Under the hood, core integrations use a C++ plugin abstraction to provide an [operator](https://preview.docs.tenzir.com/375/375/reference/operators.md), [function](https://preview.docs.tenzir.com/375/375/reference/functions.md), or [context](https://preview.docs.tenzir.com/375/375/explanations/enrichment.md) that you can use in TQL to directly interface with the respective resource, such as a TCP socket or cloud storage bucket. We typically implement this functionality using the respective SDK, such as the [AWS SDK](https://aws.amazon.com/sdk-for-cpp/), [Google Cloud SDK](https://cloud.google.com/cpp), or [librdkafka](https://github.com/confluentinc/librdkafka), though some integrations require a custom implementation.

Dedicated operators

For some applications, we provide a **dedicated operator** that dramatically simplifies the user experience. For example, [`to_splunk`](https://preview.docs.tenzir.com/375/375/reference/operators/to_splunk.md) and [`accept_opensearch`](https://preview.docs.tenzir.com/375/375/reference/operators/accept_opensearch.md) offer a streamlined interface compared to composing generic HTTP or protocol operators.

## Contents

- [Messaging](https://preview.docs.tenzir.com/375/integrations/amqp.md)
- [Protocols](https://preview.docs.tenzir.com/375/integrations/file.md)
- [Data Tools](https://preview.docs.tenzir.com/375/integrations/clickhouse.md)
- [Security Tools](https://preview.docs.tenzir.com/375/integrations/arcsight.md)