SIEM Integration Credential exposure, straight into Splunk and your SIEM.
Our Splunkbase add-on brings DarkStrata into Splunk and Enterprise Security. For Sentinel, QRadar, ArcSight and threat-intel platforms, the API exports STIX 2.1, CEF and LEEF. Every finding is tagged with its MITRE ATT&CK® techniques.
sourcetype=darkstrata:stix:observed-data
| stats count by source_type, flow_direction| source_type | flow_direction | count |
|---|---|---|
| breach | outbound | 64 |
| malware | outbound | 38 |
| malware | inbound | 11 |
| breach | inbound | 7 |
Built for Splunk
The DarkStrata Threat Intelligence Add-on runs on Splunk Enterprise and Splunk Cloud. Enterprise Security unlocks the rest.
- Modular inputs
- Two inputs pull STIX 2.1 incrementally: indicators into darkstrata:stix:observed-data, alert bundles into darkstrata:stix:alert.
- CIM mapping
- Fields map to the Authentication and Threat Intelligence data models, with event types, tags, macros and lookups.
- MITRE ATT&CK
- From add-on 1.2.0, technique IDs land in mitre_technique_id, and the correlation searches carry mitre_attack annotations onto notable events.
- Threat-intel collectionsEnterprise Security
- Feed the Enterprise Security threat-intelligence framework.
- Correlation searchesEnterprise Security
- Raise notable events when credentials are exposed.
- Adaptive responseEnterprise Security
- Update, close, reopen or enrich a DarkStrata alert from the notable event, kept in sync both ways.
Every other SIEM: four formats
Each export is a REST endpoint on api.darkstrata.io. Pick the format your platform reads natively.
| Format | Endpoint | Best for |
|---|---|---|
| STIX 2.1 bundle | /v1/stix/alerts
/v1/stix/indicators | Threat-intel platforms, OpenCTI, Elastic and Splunk ES |
| Splunk observed-data | /v1/stix/alerts?format=splunk | Splunk ES without the add-on. Chosen automatically for Splunk clients. |
| CEF | /v1/siem/events?format=cef | ArcSight and Microsoft Sentinel |
| LEEF | /v1/siem/events?format=leef | IBM QRadar. Chosen automatically for QRadar clients. |
Controls on every export
since- Fetch only what is new since your last sync.
hash_emails- Replace employee email addresses with a SHA-256 hash.
confidence_threshold- Leave out anything below the confidence you set (0-100).
detail / include- Summary or full STIX bundles, with identities on request.
TAXII 2.1 server endpoints are in development. Until then, poll the REST endpoints above on a schedule.
What a STIX export contains
Credential exposure maps to standard STIX 2.1 objects, so your platform needs no custom parser.
report- An alert, as a container that groups its indicators, identities and relationships.
indicator- A compromised credential, with a pattern such as [user-account:account_login = '…'] for automated detection.
identity- The exposed user, for correlation with Active Directory, Entra ID and other identity systems.
observed-data- The Splunk ES format: credentials as observed-data with embedded user-account and domain-name objects.
relationship- Links each indicator to the identity it affects (indicates → identity).
How severity maps
Each exposure gets a threat score from 1 to 5. Every format carries it in its own scale.
| Threat score | Label | STIX confidence | CEF / LEEF severity |
|---|---|---|---|
| 1 | Info | 20 | 2 |
| 2 | Needs review | 40 | 4 |
| 3 | Medium | 60 | 6 |
| 4 | High | 80 | 8 |
| 5 | Critical | 100 | 10 |
The DarkStrata extension
A STIX 2.1 property extension carries the credential context that standard objects have no field for.
Extension definition
extension-definition--d6132570-7659-4922-9fc4-420e4f8cba63source- MALWARE (infostealer) or BREACH.
flow- INBOUND if the credential was used on your own services, OUTBOUND if on a third-party service.
service_url- The site the credential was captured for.
threat_score- 1-5, based on password strength, source recency and credential type.
password_strength- weak, medium or strong.
credential_type- EP (email and password) or UP (username and password).
discovered_at- When DarkStrata found it (ISO 8601).
alert_id- The DarkStrata alert it belongs to, when there is one.
asset_hostname- The monitored asset involved, when there is one.
provenance- Infostealer findings only: VERIFIED_FRESH (in no known breach), PASSWORD_REUSE_CONFIRMED (a real infection whose password had already leaked), POSSIBLE_COMBOLIST (recycled list content) or INSUFFICIENT_DATA.
mitre- The MITRE ATT&CK® techniques the finding evidences (observed) or implies (inferred), with the infostealer family's ATT&CK Software ID where one exists.
MITRE ATT&CK® in every format
Every finding is tagged with the ATT&CK techniques the artefact evidences (observed) or implies (inferred). Valid Accounts (T1078) is never tagged on a raw finding: nothing in the data proves an attacker used the credential.
Finding classes, D3FEND and the Navigator layer- CEF
- Technique IDs in cs6 (MitreTechniques), tactic IDs in flexString1 (MitreTactics) and the ATT&CK Software ID in flexString2 (MalwareFamily). Comma-separated; left out when empty.
- CEF signature ID
- The CEF Device Event Class ID names the finding class: credential-exposure:stealer-fresh, :stealer-reuse, :combolist, :breach, or :stealer when provenance is not yet known.
- LEEF
- mitreTechniques, mitreTactics and malwareFamily. Source and flow travel in sourceType and flowDirection, and devTimeFormat describes devTime.
- STIX indicator
- Indicators carry kill_chain_phases (mitre-attack) for each tactic and an external reference (mitre-attack) for each technique, linking to attack.mitre.org.
- Splunk observed-data
- Observed-data carries one mitre:<technique ID> label per technique, so searches can filter on labels.
Keep reading
- SplunkbaseThe DarkStrata Threat Intelligence Add-on listing.(opens in a new tab)
- In your stackReference architectures alongside your SIEM, CTI and MDR.
- STIX exportParameters, schemas and a full example bundle.(opens in a new tab)
- CEF and LEEF exportParameters and response format for SIEM events.(opens in a new tab)
Ready to Integrate Your SIEM?
Start exporting credential intelligence in STIX, CEF or LEEF today.