# Sources & connectors > Correlate 42 threat intelligence feeds and TAXII, MISP and CSV connectors in one deduplicated, scored graph, with reference data and your own channels. Source: https://wahukeza.com/platform/sources Correlate · Sources & connectors ## Forty-plus sources. One graph. Every source graded and licensed. 21 built-in integrations and 21 reviewed presets, generic connectors for anything that speaks TAXII, MISP or CSV, reference data that adds context without minting indicators, and 13 channels that produce intelligence nobody else has, because it came from your own sensors, endpoints, customers and staff. - 21 built-in integrations own client, rate limit and resilience policy each - 21 catalogue presets URL, format, type, grade and licence pre-decided - 5 generic connectors any TAXII 2.1, MISP, CSV/JSON or snort.org list - 8 reference sources CVE data, advisories, suffix rules, the Security wire - 13 first-party channels sensors, decoys, canaries, endpoints, phones, routers, users, customers The catalogue ## Everything the platform can ingest, as the Integrations page shows it. Each tile carries what an analyst needs to trust it: what it contributes, its Admiralty grade, and whether you may legally redistribute what it gives you. typeanyapp-packageautocertificatecidrcvedomainemailhashipja3stixurl - ### abuse.ch ThreatFox Built-in IOC feed. Malware family and threat type on every IOC. ipdomainurlhash - ### abuse.ch URLhaus Built-in Malware URLs url - ### abuse.ch MalwareBazaar Built-in Samples & hashes. Also the hash lookup used by the artifact pipeline. hash - ### AbuseIPDB Built-in IP reputation ip - ### AlienVault OTX Built-in Community pulses ipdomainurlhash - ### VirusTotal Built-in On-demand enrichment hashurldomainip - ### Shodan Built-in Network enrichment, your own key. Ports, services and banners; also passive discovery for attack-surface seeds. ip - ### OpenPhish Built-in Phishing URLs url - ### PhishTank Built-in Verified phishing url - ### CISA KEV Built-in Exploited vulnerabilities cve - ### MISP feeds Built-in Any MISP manifest ipdomainurlhashemail - ### crt.sh Built-in Certificate transparency. Lookalike discovery and attack-surface discovery. domain - ### RDAP Built-in Registration data. Registration age, abuse contacts for takedowns, ownership matching for attack-surface seeds; WHOIS fallback where a registry has no RDAP. domain - ### Have I Been Pwned Built-in Leaked credentials. Masked, TLP:RED, admin-only. email - ### Ransomware leak sites Built-in Victim posts. Matched against your brands and assets. domain - ### ICANN CZDS Built-in Zone files. Newly registered lookalikes. domain - ### Censys Built-in Certificates and hosts, your own key. Passive attack-surface discovery with the customer’s key. domainipcertificate - ### Have I Been Pwned: stealer logs Built-in Infostealer exposure. Your e-banking host and mail domain; needs HIBP Pro and a verified domain. Masked and hashed. email - ### GitHub code search Built-in Leaked secrets in public code. Your identifiers searched with your token; 22 cited secret patterns; masked, hashed, never tested. - ### Apple App Store Built-in Fake-app listings. Icon similarity and foreign developer; apps are never downloaded or run. app-package - ### Aptoide Built-in Fake-app listings. Android third-party store; apps are never downloaded or run. app-package - ### abuse.ch Feodo Tracker IP blocklist Preset Catalogue preset ipgrade Bredistributable - ### abuse.ch SSLBL JA3 fingerprints Preset Catalogue preset ja3grade Bredistributable - ### abuse.ch SSLBL certificate fingerprints Preset Catalogue preset certificategrade Bredistributable - ### Spamhaus DROP Preset Catalogue preset cidrgrade Binternal only - ### Emerging Threats compromised IPs Preset Catalogue preset ipgrade Cinternal only - ### Emerging Threats block IPs Preset Catalogue preset autograde Cinternal only - ### SANS DShield block list Preset Catalogue preset cidrgrade Binternal only - ### CINS Army list Preset Catalogue preset ipgrade Cinternal only - ### blocklist.de (all) Preset Catalogue preset ipgrade Cinternal only - ### GreenSnow Preset Catalogue preset ipgrade Cinternal only - ### Binary Defense banlist Preset Catalogue preset ipgrade Cinternal only - ### IPsum (level 3) Preset Catalogue preset ipgrade Cinternal only - ### FireHOL level 1 Preset Catalogue preset autograde Cinternal only - ### Tor exit nodes Preset Catalogue preset ipgrade Dredistributable - ### Cisco Talos IP block list Preset Catalogue preset stixgrade Cinternal only - ### PhishStats phishing URLs Preset Catalogue preset urlgrade Cinternal only - ### VX Vault URL list Preset Catalogue preset urlgrade Cinternal only - ### CIRCL OSINT feed Preset Catalogue preset stixgrade Cinternal only - ### Botvrij.eu OSINT feed Preset Catalogue preset stixgrade Cinternal only - ### DigitalSide Threat-Intel Preset Catalogue preset stixgrade Credistributable - ### MITRE ATT&CK Enterprise Preset Catalogue preset stixgrade Aredistributable - ### Any TAXII 2.1 collection Generic Generic connector. Paged, cursor-tracked, STIX 2.1 objects. - ### Any MISP feed Generic Generic connector. Manifest plus events. - ### Any plain / CSV / JSON blocklist Generic Generic connector. HTTPS only; you map the columns. - ### snort.org terms-gated lists Generic Generic connector. Walks the terms wall; the operator accepts. - ### ThreatFox with custom parameters Generic Generic connector - ### NVD Reference CVE records. Versions and attack vectors for Confirmed / Potential CVE matching. cve - ### EPSS Reference Exploit prediction scores. A sort key for findings, never a severity change. cve - ### Public Suffix List Reference Registrable-domain rules. Mirrored, so ccTLD lookalikes such as .co.me are read correctly. - ### Red Hat Security Data API Reference Vendor advisories. Vulnerable packages on endpoints, backports handled. cve - ### Microsoft MSRC (Security Update Guide) Reference Vendor advisories. Microsoft products and Windows hotfixes on endpoints. cve - ### Debian security tracker Reference Vendor advisories. dpkg-correct version comparison. cve - ### Alpine secdb Reference Vendor advisories. Container and appliance hosts. cve - ### Security wire Reference News and advisories. CISA, NCSC UK, SANS ISC and Microsoft MSRC; CVEs flagged when they affect you. Context only. cve - ### Deception fabric First-party First-party channel. 17 deployable personas plus the Cowrie SSH and Telnet hive. - ### Decoy groups First-party First-party channel. Coherent internal decoys; a pivot between members is visible. - ### Canary tokens First-party First-party channel. Honey credentials and beacon URLs; a trigger pages Critical and never becomes an indicator. - ### Page canary First-party First-party channel. Fires when your login page renders off your domain. - ### Customer scam reports First-party First-party channel. Public report-a-scam form and mailbox; confirmed only by corroboration or an analyst. - ### Endpoint Intelligence First-party First-party channel. Managed osquery on Linux and Windows. - ### Android agent First-party First-party channel. Work-profile posture, sideloaded apps and blocking. - ### Availability collectors First-party First-party channel. cti-flow (NetFlow, IPFIX, SNMP) and cti-vitals host counters; aggregates only. - ### Outlook “Report to CTI” add-in First-party First-party channel. One button on the message-read surface. - ### Phishing report mailbox First-party First-party channel. Forward as attachment from any client. - ### Edge sightings First-party First-party channel. What your firewalls actually blocked. - ### Collective-immunity exchange First-party First-party channel. Give-to-get between instances, and sector sharing groups. - ### Artifact pipeline First-party First-party channel. Hashes and relations minted from captured payloads. Reference sources add context (CVE detail, exploit likelihood, vendor fixes, registrable-domain rules, news) and never become indicators themselves. Shodan, Censys and GitHub code search use your own key or token. Commercial source licences are yours to hold and are not included in a Wahukeza licence. Every external fetch can be switched off per deployment. Generated from the platform’s connector catalogue on 2026-11-07. Every preset URL is HTTPS; a list fetched over cleartext is a list an on-path attacker can rewrite, and the platform would then enforce it. Provenance ### The redistributable flag. Every source is marked for whether its data may legally be resold. Your outbound feeds (STIX, TAXII, MISP, blocklists) emit only what you are allowed to pass on. Most people building a feed business discover this in a contract review; here it is a property of the source. Trust ### Grades are earned, and measured. Sources carry an Admiralty reliability grade that feeds scoring. Aggregated reputation lists of unknown provenance sit at C; abuse.ch and DigitalSide are redistributable; MITRE ATT&CK is declared A. A feed-quality job then measures each connector’s corroboration, uniqueness and allowlist collisions, and shows them beside the tile. One write path ## Every IOC, from every source, takes the same road. Recurring jobs, the manual ingest endpoint, per-source pulls, STIX bundle import and the connectors all call the same service. Nothing writes to the indicator store around it. 1. 01 ### Fetch One named HTTP client per source with its own rate limiter and a retry / circuit-breaker / timeout policy. Instances of a connector share the vendor’s allowance: twenty blocklist instances never get twenty budgets. 2. 02 ### Parse Three parsers cover the catalogue: plain / CSV / JSON lists, MISP manifests and TAXII 2.1 collections. A preset is data, not code: adding a feed ships with the release and adds no new outbound surface. 3. 03 ### Upsert Every IOC is deduplicated by (type, value). A second source for the same value becomes another row under one indicator. That is what correlation is. 4. 04 ### Correlate Confidence and severity are recomputed from source count, source reliability grade, recency, threat type, relationships, honeypot activity and edge sightings. 5. 05 ### Allowlist CIDR containment and wildcard e-mail patterns force an indicator Clean before anything downstream sees it. 6. 06 ### Alert & act Alert rules dispatch to Slack, Teams, e-mail, webhook, PagerDuty, Opsgenie, the in-app inbox or, with Mobile Notifications, Web Push; playbooks run their action catalogue. Bulk feeds take a set-based path with deferred correlation. Bring your own ## Commercial feeds, ISAC feeds, your last vendor’s export. If it is a TAXII 2.1 collection, a MISP feed or a list over HTTPS, it is a connector instance with a schedule: no code, no new parser, secrets write-only. \# POST /api/integrations/instances { "connectorId": "taxii-feed", "name": "Sector ISAC: indicators", "config": { "apiRoot": "https://taxii.example-isac.org/api/v21/", "collectionId": "…", "pageLimit": "100" }, "secrets": { "password": "•••" }, "schedule": "0 \*/2 \* \* \*", "grade": "B", "redistributable": false } \# test → run → measure quality → it is a source like any other ## Wire in your feeds this week. Bring the TAXII endpoint or CSV you already pay for; we will show correlation across it and a sensor in one session. [Book a demo](https://wahukeza.com/contact?intent=demo) [Next: the sensor fleet](https://wahukeza.com/platform/sensors)