Integrations

ThreatFade is designed as a specialized detection and evidence layer, not as a replacement for an enterprise SIEM or SOAR.

Supported output paths

The engine repository documents:

• JSON
• Splunk HEC
• CEF
• CSV
• Sigma-compatible output
• STIX 2.1-compatible bundles
• MITRE ATT&CK mapping
• FusionOps integration

Operational model

ThreatFade detection
       │
       ├── JSON
       ├── SIEM / Splunk HEC
       ├── CEF / CSV
       ├── Sigma-compatible
       ├── STIX 2.1-compatible
       └── FusionOps

The integration objective is to preserve evidence and context as detections move into existing operational workflows.

ATT&CK context

Detections can carry MITRE ATT&CK context before operational handoff. ATT&CK mapping is evidence context, not a claim that every mapped technique is independently confirmed in every detection.

FusionOps

The engine documents FusionOps as an operational integration path. Use the repository's integration implementation as the source of truth for deployment-specific configuration.