Integrations

Dark Radar delivers leak and threat findings to your SIEM, service management, on-call and messaging systems, and synchronizes employee accounts with your identity provider.

Contact salesRead API documentation

Built-in channels

Our own channels with no third-party setup: email, phone calls, WhatsApp and an MCP server for your AI client.

  • One-way

    MCP

    Runs breach lookups from your own AI client.

    • MCP
  • One-way

    Email

    Emails leak and scan notices to the addresses you choose.

    • SMTP
  • One-way

    Phone call

    Calls the people on your on-call list in order for critical and high findings.

    • On-call
  • One-way

    WhatsApp

    Sends notices to your WhatsApp group that the Dark Radar number has joined.

    • WhatsApp

SIEM & security analytics

Leak events reach your SIEM and log platform in standard formats, so analysts correlate findings with the rules they already run.

  • One-way

    Splunk

    Forwards leak events to Splunk over HEC.

    Covers: CrowdStrike Falcon Next-Gen SIEM

    • SIEM
    • HEC
  • One-way

    Microsoft Sentinel

    Forwards leak events to your Microsoft Sentinel workspace.

    • SIEM
  • One-way

    Elastic Security

    Forwards leak events to your Elastic Security cluster.

    • SIEM
  • One-way

    Google SecOps

    Forwards leak events to your Google SecOps instance.

    • SIEM
  • One-way

    Cortex XSIAM

    Forwards leak events to your Cortex XSIAM tenant.

    • SIEM
    • SOAR
    • XDR
  • One-way

    Graylog

    Forwards leak events to Graylog over GELF.

    • Log
    • GELF
  • One-way

    Wazuh

    Forwards leak events to Wazuh.

    • SIEM
    • XDR
  • One-way

    Datadog

    Forwards leak events to Datadog.

    • Log
  • One-way

    Sumo Logic

    Forwards leak events to Sumo Logic.

    • SIEM
  • One-way

    Syslog

    Forwards events in CEF or LEEF to any SIEM collector.

    Covers: IBM QRadar, ArcSight, LogRhythm, Securonix, Rapid7 InsightIDR, Exabeam

    • CEF
    • LEEF

Identity & access management

Your employee directory defines the accounts we monitor. On supported providers, a leaked account is signed out of its sessions with your approval.

  • Response

    Microsoft Entra ID

    Synchronizes employee accounts and, with your approval, signs a leaked account out of its sessions.

    • IAM
  • Response

    Okta

    Synchronizes employee accounts and, with your approval, signs a leaked account out of its sessions.

    • IAM
  • Response

    Keycloak

    Synchronizes employee accounts and, with your approval, signs a leaked account out of its sessions.

    • IAM
  • One-way

    Google Workspace

    Synchronizes employee accounts with your asset group.

    • IAM
  • Response

    Auth0

    With your approval, signs a leaked employee account out of its sessions.

    • IAM
  • Response

    PingOne

    With your approval, signs a leaked employee account out of its sessions.

    • IAM
  • One-way

    SCIM 2.0

    Synchronizes employee accounts with your asset group.

    Covers: CyberArk Identity

    • IAM
    • SCIM 2.0
  • One-way

    LDAP / Active Directory

    Synchronizes on-premises directory accounts with your asset group.

    • IAM

Threat intelligence platforms

Selected events move to your threat intelligence platform as STIX 2.1 and sit alongside your other sources.

  • Exchange

    TAXII 2.1

    Exports selected events as a STIX bundle to your TAXII collection.

    Covers: MISP

    • STIX 2.1
    • TAXII 2.1
  • Exchange

    OpenCTI

    Opens a leak incident in OpenCTI.

    • STIX 2.1

IT service management

Each finding becomes a record where your team already works, and its status stays up to date in Dark Radar.

  • Bi-directional

    ServiceNow

    Opens a record in ServiceNow and tracks its status.

    • ITSM
  • Bi-directional

    Jira

    Opens an issue in Jira and tracks its status.

    • ITSM
  • Bi-directional

    GitHub

    Opens an issue in GitHub and tracks its status.

    • ITSM
  • Bi-directional

    GitLab

    Opens a confidential issue in GitLab and tracks its status.

    • ITSM
  • Bi-directional

    Linear

    Opens an issue in Linear and tracks its status.

    • ITSM

Incident response & on-call

Urgent findings reach the person on your rotation through the paging system you already use.

  • One-way

    PagerDuty

    Pages your on-call team about a leak.

    • On-call
  • One-way

    Jira Service Management

    Alerts your on-call team through Jira Service Management.

    • On-call
    • ITSM
  • One-way

    Opsgenie

    Pages your on-call team about a leak.

    • On-call

Team messaging

Leak and scan notices land in the channel your team already uses.

  • One-way

    Slack

    Sends leak and scan notices to your Slack channel.

  • One-way

    Microsoft Teams

    Sends leak and scan notices to your Microsoft Teams channel.

  • One-way

    Google Chat

    Sends leak and scan notices to your Google Chat space.

  • One-way

    Webex

    Sends leak and scan notices to your Webex room.

  • One-way

    Mattermost

    Sends leak and scan notices to your Mattermost channel.

  • One-way

    Rocket.Chat

    Sends leak and scan notices to your Rocket.Chat channel.

  • One-way

    Discord

    Sends leak and scan notices to your Discord channel.

  • One-way

    Telegram

    Sends leak and scan notices to your Telegram chat.

Archive & data lake

Events are written to your storage in an open schema for long-term retention and your own analysis.

  • One-way

    S3 / OCSF

    Writes leak events in OCSF to your S3-compatible object store.

    • S3
    • OCSF

Developer tools

For systems not listed here, events arrive at your own endpoint as signed requests, and all data is also available over the API.

  • One-way

    Webhook

    Sends events as JSON to your own endpoint, with optional request signing.

    • JSON
    • HMAC