> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signal Data Sources

> Learn how integrations and custom push sources supply identity, training, email, endpoint, and cloud activity for human risk signals.

Signal data sources are the systems that supply activity for [human risk signals](/signals/overview). Living Security normalizes records from each source into a shared activity vocabulary. This gives teams one way to analyze related behavior across different tools.

## Common source categories

| Source category                 | Examples of useful activity                                  |
| ------------------------------- | ------------------------------------------------------------ |
| **Identity and access**         | Account lifecycle, authentication, access, and policy events |
| **Email and phishing**          | Reported messages, detected threats, and simulation activity |
| **Security awareness**          | Assignments, completions, assessments, and learner actions   |
| **Endpoint and cloud security** | Device posture, alert, data access, and exposure activity    |
| **Living Security**             | Platform training, phishing, and response activity           |
| **Custom push**                 | Customer-defined records sent through a managed push source  |

The activity available from a provider depends on its products, enabled APIs, permissions, and the Living Security connector.

## Supported and reporting sources

Living Security separates **compatibility** from **current data flow**:

* A **supported source** has a reviewed mapping that can supply the activity used by a signal.
* A **reporting source** has recently sent matching activity for a customer's environment.

This distinction helps a team answer two different questions: “Which systems can supply this signal?” and “Which systems supply it now?” A compatible source can be connected without reporting a specific activity, and a custom source can report an activity without a built-in provider mapping.

## Dormant signals

A signal with no listed built-in source is **dormant**, not broken. Its definition is ready, but no built-in mapping currently supplies matching activity. A future connector, mapping update, or Custom Push Source can activate it without changing the signal's meaning.

This model lets Living Security keep a stable signal vocabulary while integration coverage grows.

## Choose and prepare a source

Use this sequence when you assess an integration:

<Steps>
  <Step title="Start with the behavior">
    Define the risk or protective behavior you want to observe. Then identify the activity that provides evidence for it.
  </Step>

  <Step title="Review provider coverage">
    Check the provider guide for supported activity, prerequisites, permissions, and known limits. Similar products can expose different records or API access.
  </Step>

  <Step title="Connect and verify">
    Complete the provider setup, then confirm that records arrive and map to the expected people and activity types.
  </Step>

  <Step title="Use custom push when needed">
    If a built-in connector is not available, evaluate a [Custom Push Source](/integrations/managing/setup#custom-push-sources) for supported JSON or CSV data.
  </Step>
</Steps>

## Privacy and public documentation

Public provider and signal pages describe reviewed capabilities. They do not show whether a specific customer connected a provider, which people have matching activity, or how a customer's scorecards use a signal. That organization-specific state stays in the authenticated platform.

## Related documentation

<CardGroup cols={2}>
  <Card title="Integration Overview" icon="plug" href="/integrations/overview">
    Explore integration types and the connection workflow.
  </Card>

  <Card title="Set Up an Integration" icon="gear" href="/integrations/managing/setup">
    Prepare credentials, connect a provider, and verify data flow.
  </Card>

  <Card title="Human Risk Signals" icon="signal" href="/signals/overview">
    Learn how signal definitions turn activity into reusable indicators.
  </Card>

  <Card title="Human Risk Index" icon="gauge-high" href="/reference/hri">
    Learn how selected signals contribute to a human risk model.
  </Card>
</CardGroup>