Integrations

Approach

There's no integration marketplace and no proprietary plugin format. Every upstream tool POSTs JSON to /api/v1/alerts - whether through a native webhook, a SOAR connector, or a 30-line script you wrote in 10 minutes.

SIEM - Splunk

Use a saved search with the Webhook alert action. Payload template:

{
  "source": "splunk",
  "external_id": "$result.sid$",
  "severity": "$result.severity$",
  "title": "$name$",
  "detected_at": "$result._time$",
  "asset": { "hostname": "$result.host$" },
  "raw": $result$
}

EDR - CrowdStrike Falcon

Use the Falcon Streaming API or the SOAR connector. Map DetectId → external_id, Severity → severity, Hostname → asset.hostname. Observables extracted from FileName, SHA256, RemoteIP.

EDR - SentinelOne / Microsoft Defender

Both support webhook notifications on threat creation. Same shape as above - map the native severity scale (Informational/Low/Medium/High/Critical) onto ir.mlab.sh severities (low, medium, high, critical).

Email gateway - Proofpoint / Mimecast

Most gateways can email alert digests. Two patterns:

SMTP → ingestion mailbox: have the gateway send to an inbox, run a small script polling IMAP and posting to /api/v1/alerts.
API pull: schedule a cron that queries the gateway API every N minutes and posts new threats.

Generic - a 30-line script

Anything that produces JSON can feed ir.mlab.sh. Example with jq turning Suricata eve.json alerts into ingest calls:

tail -F /var/log/suricata/eve.json | \
  jq -c 'select(.event_type=="alert") | {
    source: "suricata",
    external_id: (.alert.signature_id|tostring) + "-" + (.timestamp|tostring),
    severity: (if .alert.severity==1 then "high" elif .alert.severity==2 then "medium" else "low" end),
    title: .alert.signature,
    detected_at: .timestamp,
    asset: { hostname: .src_ip },
    observables: [
      { type: "ip", value: .src_ip },
      { type: "ip", value: .dest_ip }
    ],
    raw: .
  }' | \
  while read alert; do
    curl -s -XPOST -H "Authorization: Bearer $IR_API_KEY" \
         -H "Content-Type: application/json" \
         -d "$alert" \
         "$PUBLIC_URL/api/v1/alerts"
  done

Outbound - webhooks

Fire on case transitions (created, updated, resolved). Wire them into ticketing (Jira, ServiceNow), chat (Slack, Teams), or your incident commander runbook. See the API reference for payloads and signing.

Enrichment - mlab.sh

mlab.sh is on by default and answers for all nine observable types. Paste an mlab.sh API key under Settings > Integrations; it needs the scan.lookup and scan.domain scopes, and a key without them is refused. What comes back, per type:

Type	What mlab.sh adds
IP	Location, ISP, ASN, Tor exit node, proxy / hosting / mobile flags, reverse DNS, allocated block and abuse contact
Domain	DNS, TLS, mail authentication and subdomains, from a full domain scan (takes minutes)
URL	Findings such as credentials in the URL, a raw IP host or plaintext HTTP
Email	Risk score and band, disposable / role / free-provider flags, SPF, DKIM, DMARC and spoofability
Phone	Validity, line type, country and allocated carrier
MAC	Vendor, randomised or virtual address
Hash	Reference verdict, malware family, matching reference set, link to mlab.sh's own analysis of the sample
Crypto wallet	Sanctions and authorities, labels, categories and risk score. An EVM address checked on an assumed chain says so; pass the chain when you know it

Extract indicators from text

On an alert, Extract sends its title, description and triage notes to mlab.sh; on the Observables page, Extract from text takes anything you paste. mlab.sh lists the indicators it finds, typed, with the ones you already track marked, and nothing is created until you tick what to keep. Defanged text (hxxp://, [.], [at]) is read as the real indicator. Uses the same key and the scan.lookup scope.

Threat intel - STIX / MISP

Confirmed-bad observables from resolved cases can be pushed to a MISP instance or exported as STIX 2.1 bundles. Configure under Settings > Intel feeds.

Integrations

On this page