Sends to the tools you already run.

Push IOCs and incident data to Splunk via HTTP Event Collector.

# splunk HEC push (example)
curl -k https://splunk.corp:8088/services/collector \
  -H "Authorization: Splunk YOUR_TOKEN" \
  -d '{"event":{"type":"ioc","value":"..."}}'

Push enriched IOCs and victim events to Elasticsearch.

# elastic push (example)
POST /offsys-iocs/_doc
{"indicator":"203.0.113.42","type":"ipv4",
 "threat.group":"LOCKBYTE","confidence":85}

Stream threat indicators and incidents into Sentinel workspaces.

# sentinel — push via Log Analytics API
POST https://{workspace}.ods.opinsights.azure.com
Content-Type: application/json
Authorization: Bearer {token}

Pull STIX 2.1 collections into any TAXII-compatible threat intel platform.

# TAXII 2.1 discovery
GET https://api.offsysintel.com/taxii2/
Accept: application/taxii+json;version=2.1
Authorization: Bearer YOUR_API_KEY

Export any data set in the format your tooling expects.

# STIX 2.1 bundle export
GET /api/v1/exports/stix?since=2026-10-01
Accept: application/stix+json
Authorization: Bearer YOUR_API_KEY

Full programmatic access with API-key authentication.

# example: list recent victims
curl https://api.offsysintel.com/v1/victims \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Receive watchlist matches and activity spikes in a Slack channel.

# Slack webhook (configured in the UI)
Channel: #sec-alerts
Conditions: watchlist match, activity spike
Format: structured card with evidence link

Get alerts delivered to a Telegram group or personal chat.

# Telegram bot (configured in the UI)
Bot: @OffsysIntelBot
Chat: your group or DM
Conditions: watchlist match, new gang, new CVE

Alert emails with evidence links, plus scheduled briefing delivery.

# email alerts (configured in the UI)
To: soc@company.com
Conditions: all 8 alert types
Includes: evidence link, compliance clock status