No connector marketplace. Just the protocols you already run.
A connector is software a vendor writes, bills for, and eventually abandons. We publish the open standards your stack was built to ingest, which makes the integration a URL and a key, and keeps it working after we stop paying attention to it.
Five rails out of one pipeline
Hover a rail and the destinations that consume it light up. Nothing below is a logo we licensed; it is a format we emit.
DELIVERY LAYER
hover a rail · the stacks it feeds light up
one URL · one keySTIX 2.1
objects & relationships
TAXII 2.1
subscription delivery
Sigma
detection rules
EDL
firewall blocklists
REST + X-API-Key
everything else
The wire format, the cadence, and what you have to do
Including the part most vendors leave for the implementation call: which side of the integration is your work.
STIX 2.1
Enterpriseobjects & relationships
on confirm
Indicators, campaigns, threat actors and the relationships between them, serialized as a standards-compliant STIX 2.1 bundle. An indicator never arrives naked: the bundle carries the malware family it belongs to, an `indicates` relationship tying the two together, and the confidence score and first-seen date behind it.
bundle.json · 412 objectsYour side Point your STIX ingest at the bundle endpoint with your API key. There is no schema to negotiate, because the schema is the standard.
MISPOpenCTI
TAXII 2.1
Enterprisesubscription delivery
poll · 5 min
The subscription form of the same data. Your platform polls a collection, gets what changed since its last cursor, and never asks a human to export anything. This is how most SIEMs prefer to be fed, and it is the path we recommend.
GET /taxii2/{root}/collections/{id}/objectsYour side Add the TAXII root and your key to the SIEM's threat-intel source list. Most stacks discover the collections automatically from there.
SplunkMicrosoft SentinelIBM QRadarOpenCTICortex XSOAR
Sigma
Enterprisedetection rules
on change
Detections rather than bare indicators. When a campaign is confirmed, the behavioral rule ships as Sigma, or converted on demand to the query language your SIEM actually runs: Splunk SPL, Microsoft Sentinel KQL or QRadar AQL. You pull the target, not a translation project. Intelligence that arrives as a rule your SOC can paste in is intelligence it can execute the same day.
GET /sigma/{campaign_id}/{target}Your side Pull the campaign's rules as Sigma into your detection-as-code pipeline, or request the SPL/KQL/AQL target and skip the conversion. Rules land as a merge request, and a human reviews it. That is the only human step in the chain, by design.
SplunkMicrosoft SentinelIBM QRadarElastic Security
EDL
Enterprisefirewall blocklists
ttl · 15 min
A plain-text external dynamic list of hosts, domains and IPs tied to active campaigns. Unglamorous, and the fastest path from "we confirmed the infrastructure" to "it is blocked at your perimeter".
GET /delivery/edl/network-blocklistYour side Paste the URL into your firewall's EDL configuration and set the refresh interval. That is the entire integration.
Palo Alto NGFWFortinet FortiGate
REST + X-API-Key
everything else
on demand
Everything the console shows, the API serves: same data, same permissions, same audit log. This is the rail your own automation runs on, and it is available on every tier rather than reserved as an upsell.
curl -H "X-API-Key: ●●●" /sherlog/leak/search?q=Your side Generate a key in the console. There is a versioned reference for every endpoint in your workspace.
Elastic SecurityTheHiveCortex XSOAR
Examples, not a compatibility matrix
Anything that speaks TAXII, STIX, Sigma or a plain-text list works. These are simply the stacks our customers were already running.
SIEM & analytics
Splunk
Ingest via the TAXII threat-intel input; pull detections pre-converted to SPL rather than porting Sigma yourself.
TAXIISigma
Microsoft Sentinel
Add the TAXII collection as a threat-intelligence data connector; detections arrive as KQL on request.
TAXIISigma
IBM QRadar
Indicators land as reference sets over TAXII; detections convert to AQL for the standard rule engine.
TAXIISigma
Elastic Security
Sigma rules convert to EQL/KQL; the REST rail backs custom enrichment transforms.
SigmaREST
Threat intel platform
MISP
STIX bundles import natively, relationships intact.
STIX
OpenCTI
Point OpenCTI's TAXII connector at the collection; the actor and campaign graph carries over.
TAXIISTIX
SOAR & case management
TheHive
The REST rail creates cases and attaches the evidence chain: post, screenshot, timestamp.
REST
Cortex XSOAR
Feed via TAXII, enrich playbooks via REST.
TAXIIREST
Network & perimeter
Palo Alto NGFW
EDL URL plus a refresh interval. No agent, no connector, no professional services.
EDL
Fortinet FortiGate
Consumed as an external threat feed on the standard polling schedule.
EDL
Product names belong to their owners. No partnership, endorsement or certification is claimed or implied.
Your stack already speaks these.
The integration is a URL and a key.
NDA-friendly briefings · global coverage · no slideware