Sumo Logic
Leak events are sent to Sumo Logic as records.
How it works
The connection uses the HTTP source address of a hosted collector. There is no separate key: the address itself is the authentication, so it is kept masked in the panel and only its domain is written to logs.
Records arrive with the darkradar/leaks category and the source name dark-radar. The body is JSON: kind, event_id, title, summary, severity, link, timestamp.
Limits
Only records are sent. Searches, dashboards and existing records are not read.
The leaked value itself is not in the record.
Turning the connection off stops delivery and deletes the address.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.