Wazuh
Leak events are written into the Wazuh manager as events.
How it works
The connection runs over the Wazuh manager API. Events arrive with the integration name dark-radar; you can turn them into alerts with your own rules.
Wazuh uses a short-lived session token. The token is not stored; a new one is fetched for every delivery.
Archiving has to be enabled on the manager for events to be written. While it is off the API returns success but the event is written nowhere.
Limits
Only events are written. Agents, rules and existing alerts are not read.
The leaked value itself is not in the event.
Turning the connection off stops writing and deletes the credentials.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.