TFTHREATFADE
ProductDetectionHow it worksIntegrationsResearchValidationSecurity & TrustDocsPlaygroundPricingEnterprise
GitHub
ProductDetectionHow it worksIntegrationsResearchValidationSecurity & TrustDocsPlaygroundPricingEnterprise
HomeInteroperability

Know exactly how ThreatFade connects.

Every listed destination is labeled as an export, adapter or compatibility surface. Repository tests establish implementation correctness; they do not prove live connectivity to every third-party deployment.

Authoritative registryv0.9.0-dev

Native integration is deliberately not used as a blanket label. The current engine's enterprise integration layer is an adapter/export boundary with shared authentication, TLS, retry, idempotency, audit and dead-letter controls.

JSON

ThreatFade -> consumer

EXPORTTESTED
Protocol / format
JSON
Meaning of status
ThreatFade produces data another system can consume.

Sigma-compatible

ThreatFade -> consumer

EXPORTTESTED
Protocol / format
Sigma-compatible output
Meaning of status
ThreatFade produces data another system can consume.

STIX 2.1-compatible

ThreatFade -> consumer

EXPORTTESTED
Protocol / format
STIX 2.1-compatible output
Meaning of status
ThreatFade produces data another system can consume.

Elastic

ThreatFade -> Elastic

ADAPTERTESTED
Protocol / format
ECS-shaped JSON
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

Microsoft Sentinel

ThreatFade -> Sentinel

ADAPTERTESTED
Protocol / format
Azure Monitor Logs Ingestion-shaped records
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

IBM QRadar

ThreatFade -> QRadar

ADAPTERTESTED
Protocol / format
CEF payload
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

Graylog

ThreatFade -> Graylog

ADAPTERTESTED
Protocol / format
GELF-shaped JSON
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

Wazuh

ThreatFade -> Wazuh

ADAPTERTESTED
Protocol / format
Alert-shaped JSON
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

MISP

ThreatFade -> MISP

ADAPTERTESTED
Protocol / format
Event/attribute payload
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

OpenCTI

ThreatFade -> OpenCTI

ADAPTERTESTED
Protocol / format
GraphQL request envelope
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.
Limitation
Target schema/mutation must be validated against the deployed OpenCTI release.

TheHive

ThreatFade -> TheHive

ADAPTERTESTED
Protocol / format
Case/task-compatible payload
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.
Limitation
Exact route/version mapping is deployment-specific.

SOAR

ThreatFade -> SOAR

ADAPTERTESTED
Protocol / format
Vendor-neutral webhook envelope
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.

FusionOps

ThreatFade -> FusionOps

ADAPTERTESTED
Protocol / format
Existing FusionOps API/event boundary
Meaning of status
ThreatFade translates its canonical event into a bounded external-system interface; this is not a native vendor integration claim.
Limitation
FusionOps remains an external system; its contract is authoritative.

MITRE ATT&CK

ThreatFade -> ATT&CK context

COMPATIBLETESTED
Protocol / format
ATT&CK mappings in evidence/detection context
Meaning of status
ThreatFade uses an ecosystem format or mapping without claiming a native vendor connector.

CTI

ThreatFade -> CTI consumers

EXPORTTESTED
Protocol / format
MISP/OpenCTI adapter paths
Meaning of status
ThreatFade produces data another system can consume.

Deployment boundary

Destination authentication and receiver configuration remain deployment-specific. For example, Sentinel requires the configured Azure Logs Ingestion boundary; QRadar receives CEF through the deployment-selected transport; OpenCTI and TheHive mappings must match the target release.

THREATFADE / TINLANCE LIMITEDSource on GitHub