Correlate · Sources & connectors

Forty-plus sources. One graph. Every source graded and licensed.

21 built-in integrations and 21 reviewed presets, generic connectors for anything that speaks TAXII, MISP or CSV, reference data that adds context without minting indicators, and 13 channels that produce intelligence nobody else has, because it came from your own sensors, endpoints, customers and staff.

Browse the catalogue How ingestion works

21
built-in integrations
own client, rate limit and resilience policy each
21
catalogue presets
URL, format, type, grade and licence pre-decided
5
generic connectors
any TAXII 2.1, MISP, CSV/JSON or snort.org list
8
reference sources
CVE data, advisories, suffix rules, the Security wire
13
first-party channels
sensors, decoys, canaries, endpoints, phones, routers, users, customers

The catalogue

Everything the platform can ingest, as the Integrations page shows it.

Each tile carries what an analyst needs to trust it: what it contributes, its Admiralty grade, and whether you may legally redistribute what it gives you.

type

Reference sources add context (CVE detail, exploit likelihood, vendor fixes, registrable-domain rules, news) and never become indicators themselves. Shodan, Censys and GitHub code search use your own key or token. Commercial source licences are yours to hold and are not included in a Wahukeza licence. Every external fetch can be switched off per deployment.

Generated from the platform’s connector catalogue on 2026-11-07. Every preset URL is HTTPS; a list fetched over cleartext is a list an on-path attacker can rewrite, and the platform would then enforce it.

Provenance

The redistributable flag.

Every source is marked for whether its data may legally be resold. Your outbound feeds (STIX, TAXII, MISP, blocklists) emit only what you are allowed to pass on. Most people building a feed business discover this in a contract review; here it is a property of the source.

Trust

Grades are earned, and measured.

Sources carry an Admiralty reliability grade that feeds scoring. Aggregated reputation lists of unknown provenance sit at C; abuse.ch and DigitalSide are redistributable; MITRE ATT&CK is declared A. A feed-quality job then measures each connector’s corroboration, uniqueness and allowlist collisions, and shows them beside the tile.

One write path

Every IOC, from every source, takes the same road.

Recurring jobs, the manual ingest endpoint, per-source pulls, STIX bundle import and the connectors all call the same service. Nothing writes to the indicator store around it.

01
Fetch
One named HTTP client per source with its own rate limiter and a retry / circuit-breaker / timeout policy. Instances of a connector share the vendor’s allowance: twenty blocklist instances never get twenty budgets.
02
Parse
Three parsers cover the catalogue: plain / CSV / JSON lists, MISP manifests and TAXII 2.1 collections. A preset is data, not code: adding a feed ships with the release and adds no new outbound surface.
03
Upsert
Every IOC is deduplicated by (type, value). A second source for the same value becomes another row under one indicator. That is what correlation is.
04
Correlate
Confidence and severity are recomputed from source count, source reliability grade, recency, threat type, relationships, honeypot activity and edge sightings.
05
Allowlist
CIDR containment and wildcard e-mail patterns force an indicator Clean before anything downstream sees it.
06
Alert & act
Alert rules dispatch to Slack, Teams, e-mail, webhook, PagerDuty, Opsgenie, the in-app inbox or, with Mobile Notifications, Web Push; playbooks run their action catalogue. Bulk feeds take a set-based path with deferred correlation.

Bring your own

Commercial feeds, ISAC feeds, your last vendor’s export.

If it is a TAXII 2.1 collection, a MISP feed or a list over HTTPS, it is a connector instance with a schedule: no code, no new parser, secrets write-only.

# POST /api/integrations/instances

{
  "connectorId": "taxii-feed",
  "name": "Sector ISAC: indicators",
  "config": {
    "apiRoot": "https://taxii.example-isac.org/api/v21/",
    "collectionId": "…",
    "pageLimit": "100"
  },
  "secrets": { "password": "•••" },
  "schedule": "0 */2 * * *",
  "grade": "B",
  "redistributable": false
}

# test → run → measure quality → it is a source like any other

Wire in your feeds this week.

Bring the TAXII endpoint or CSV you already pay for; we will show correlation across it and a sensor in one session.

Book a demo Next: the sensor fleet

Forty-plus sources. One graph. Every source graded and licensed.

Everything the platform can ingest, as the Integrations page shows it.

abuse.ch ThreatFox

abuse.ch URLhaus

abuse.ch MalwareBazaar

AbuseIPDB

AlienVault OTX

VirusTotal

Shodan

OpenPhish

PhishTank

CISA KEV

MISP feeds

crt.sh

RDAP

Have I Been Pwned

Ransomware leak sites

ICANN CZDS

Censys

Have I Been Pwned: stealer logs

GitHub code search

Apple App Store

Aptoide

abuse.ch Feodo Tracker IP blocklist

abuse.ch SSLBL JA3 fingerprints

abuse.ch SSLBL certificate fingerprints

Spamhaus DROP

Emerging Threats compromised IPs

Emerging Threats block IPs

SANS DShield block list

CINS Army list

blocklist.de (all)

GreenSnow

Binary Defense banlist

IPsum (level 3)

FireHOL level 1

Tor exit nodes

Cisco Talos IP block list

PhishStats phishing URLs

VX Vault URL list

CIRCL OSINT feed

Botvrij.eu OSINT feed

DigitalSide Threat-Intel

MITRE ATT&CK Enterprise

Any TAXII 2.1 collection

Any MISP feed

Any plain / CSV / JSON blocklist

snort.org terms-gated lists

ThreatFox with custom parameters

NVD

EPSS

Public Suffix List

Red Hat Security Data API

Microsoft MSRC (Security Update Guide)

Debian security tracker

Alpine secdb

Security wire

Deception fabric

Decoy groups

Canary tokens

Page canary

Customer scam reports

Endpoint Intelligence

Android agent

Availability collectors

Outlook “Report to CTI” add-in

Phishing report mailbox

Edge sightings

Collective-immunity exchange

Artifact pipeline

The redistributable flag.

Grades are earned, and measured.

Every IOC, from every source, takes the same road.

Fetch

Parse

Upsert

Correlate

Allowlist

Alert & act

Commercial feeds, ISAC feeds, your last vendor’s export.