Splunk
Leak events are written into Splunk as events.
How it works
The connection runs over the HTTP Event Collector. Events are sent to the selected index with the darkradar:event sourcetype. CrowdStrike Falcon NG-SIEM (LogScale) uses the same contract and connects the same way.
Delivery is one-way. No data is read from Splunk, no search is run, no administrative endpoint is touched.
Splunk’s acknowledgement means the record was received. When it becomes visible in a search depends on Splunk’s indexing speed.
Fields delivered
| Field | Content |
|---|---|
source | darkradar |
sourcetype | darkradar:event |
index | The index selected during setup |
event.kind | Event type: leak, scan summary, scan failure, test |
event.eventId | Event identifier |
event.title | Event title |
event.summary | One-sentence summary |
event.severity | critical · high · medium · low · info |
event.link | The event’s address in the panel |
The leaked value itself is not sent. Passwords, cookies and session data are not part of the record.
Limits
The token carries permission to write events only.
The address must be
https; internal network and cloud metadata addresses are refused.Turning the connection off stops delivery and deletes the token.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.