SIEM Integration Credential exposure, straight into Splunk and your SIEM.
Our Splunkbase add-on brings DarkStrata into Splunk and Enterprise Security. For Sentinel, QRadar, ArcSight and threat-intel platforms, the API exports STIX 2.1, CEF and LEEF.
sourcetype=darkstrata:stix:observed-data
| stats count by darkstrata_source_type, darkstrata_flow| darkstrata_source_type | darkstrata_flow | count |
|---|---|---|
| BREACH | OUTBOUND | 64 |
| MALWARE | OUTBOUND | 38 |
| MALWARE | INBOUND | 11 |
| BREACH | INBOUND | 7 |
Built for Splunk
The DarkStrata Threat Intelligence Add-on runs on Splunk Enterprise and Splunk Cloud. Enterprise Security unlocks the rest.
- Modular inputs
- Two inputs pull STIX 2.1 incrementally: indicators into darkstrata:stix:observed-data, alert bundles into darkstrata:stix:alert.
- CIM mapping
- Fields map to the Authentication and Threat Intelligence data models, with event types, tags, macros and lookups.
- Threat-intel collectionsEnterprise Security
- Feed the Enterprise Security threat-intelligence framework.
- Correlation searchesEnterprise Security
- Raise notable events when credentials are exposed.
- Adaptive responseEnterprise Security
- Update, close, reopen or enrich a DarkStrata alert from the notable event, kept in sync both ways.
Every other SIEM: four formats
Each export is a REST endpoint on api.darkstrata.io. Pick the format your platform reads natively.
| Format | Endpoint | Best for |
|---|---|---|
| STIX 2.1 bundle | /v1/stix/alerts
/v1/stix/indicators | Threat-intel platforms, OpenCTI, Elastic and Splunk ES |
| Splunk observed-data | /v1/stix/alerts?format=splunk | Splunk ES without the add-on. Chosen automatically for Splunk clients. |
| CEF | /v1/siem/events?format=cef | ArcSight and Microsoft Sentinel |
| LEEF | /v1/siem/events?format=leef | IBM QRadar. Chosen automatically for QRadar clients. |
Controls on every export
since- Fetch only what is new since your last sync.
hash_emails- Replace employee email addresses with a SHA-256 hash.
confidence_threshold- Leave out anything below the confidence you set (0-100).
detail / include- Summary or full STIX bundles, with identities on request.
TAXII 2.1 server endpoints are in development. Until then, poll the REST endpoints above on a schedule.
What a STIX export contains
Credential exposure maps to standard STIX 2.1 objects, so your platform needs no custom parser.
report- An alert, as a container that groups its indicators, identities and relationships.
indicator- A compromised credential, with a pattern such as [user-account:account_login = '…'] for automated detection.
identity- The exposed user, for correlation with Active Directory, Entra ID and other identity systems.
observed-data- The Splunk ES format: credentials as observed-data with embedded user-account and domain-name objects.
relationship- Links each indicator to the identity it affects (indicates → identity).
How severity maps
Each exposure gets a threat score from 1 to 5. Every format carries it in its own scale.
| Threat score | Label | STIX confidence | CEF / LEEF severity |
|---|---|---|---|
| 1 | Info | 20 | 2 |
| 2 | Needs review | 40 | 4 |
| 3 | Medium | 60 | 6 |
| 4 | High | 80 | 8 |
| 5 | Critical | 100 | 10 |
The DarkStrata extension
A STIX 2.1 property extension carries the credential context that standard objects have no field for.
Extension definition
extension-definition--d6132570-7659-4922-9fc4-420e4f8cba63source- MALWARE (infostealer) or BREACH.
flow- INBOUND if the credential was used on your own services, OUTBOUND if on a third-party service.
service_url- The site the credential was captured for.
threat_score- 1-5, based on password strength, source recency and credential type.
password_strength- weak, medium or strong.
credential_type- EP (email and password) or UP (username and password).
discovered_at- When DarkStrata found it (ISO 8601).
alert_id- The DarkStrata alert it belongs to, when there is one.
asset_hostname- The monitored asset involved, when there is one.
Keep reading
- SplunkbaseThe DarkStrata Threat Intelligence Add-on listing.(opens in a new tab)
- In your stackReference architectures alongside your SIEM, CTI and MDR.
- STIX exportParameters, schemas and a full example bundle.(opens in a new tab)
- CEF and LEEF exportParameters and response format for SIEM events.(opens in a new tab)
Ready to Integrate Your SIEM?
Start exporting credential intelligence in STIX, CEF or LEEF today.