OpenCTI
Leak events are written into OpenCTI as Incident records.
How it works
The connection uses an API token. The record is created with the data-leak type, its source is Dark Radar and it carries the severity.
If the same event returns, no new record is created and the existing one is updated. Because OpenCTI derives a record’s permanent identifier from its name, a short code specific to the event is added to each name.
Limits
Only Incident records are created; other records are not read, changed or deleted.
The record carries classification only: leak type, severity, state.
The leaked value itself is not written to the record.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.