TAXII 2.1
Leak events are sent in STIX 2.1 format to a server that speaks TAXII 2.1.
How it works
The connection uses an API root address, a collection identifier and an identity. Authentication is either a username and password (HTTP Basic) or an access token; the specification requires clients to support Basic.
On saving, the collection is inspected: is the address right, is the collection open for writing, does it accept STIX 2.1. If one does not hold, the connection is not enabled.
After a delivery the server’s status record is read. The delivery counts as successful when the server says complete and the success count matches the number of objects sent. At most fifty objects go out at once.
Limits
incident; the leaked value itself is not sent.Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.