Integrations

blackpot.io is alpha software and its integration surface is deliberately small. Today there are three ways to get data out: webhooks for canary trips, a command-line STIX 2.1 / MISP exporter, and direct read access to the Postgres capture database. A versioned REST API is on the roadmap and is not available yet.

1. Canary-trip webhooks

Set any of BP_SLACK_WEBHOOK, BP_TEAMS_WEBHOOK, BP_PAGERDUTY_ROUTING_KEY or BP_GENERIC_WEBHOOK (with an optional BP_GENERIC_WEBHOOK_AUTH header value) and the daemon posts to that target whenever a session-bound decoy credential is used from somewhere else. Delivery is asynchronous with retries and backoff, so a slow endpoint never blocks a sensor. The generic webhook body is JSON:

{
  "schema": "blackpot.canary.trip.v1",
  "at": "2026-08-29T04:24:57.118Z",
  "token": { "kind": "aws_access_key", "value": "AKIA…EXAMPLE", ... },
  "session": {
    "remote_ip": "203.0.113.42",
    "geo": { "country": "XX", "asn": "AS64500" },
    "tier": "TARGETED_RECON",
    ...
  }
}

Slack, Teams and PagerDuty targets receive the same event formatted for that service. These connectors are implemented and tested in code; the alpha deployment itself currently alerts through its own channel rather than any of them.

2. STIX 2.1 / MISP export

blackpot-export is a command-line tool that reads the capture database and writes sessions and recovered C2 indicators as STIX 2.1 JSON or NDJSON, or pushes them as events into a MISP instance:

# last 24h as STIX 2.1 on stdout
blackpot-export -format stix -since 24h

# last 7 days, targeted and above, into MISP
MISP_URL=https://misp.example.net MISP_KEY=… \
  blackpot-export -format misp -since 7d -min-tier TARGETED_RECON

3. Database access

Everything the console shows lives in Postgres (attacker_sessions, c2_indicators, malware_samples, enforcement_events and friends). For a self-hosted deployment the simplest SIEM integration is a read-only role on that database.

4. Roadmap: REST API

A token-authenticated REST API for sessions, dossiers and enforcement history is planned but not built. If you need it, tell us what you would call first: [email protected].

Where next

Return to the docs index, or read the security posture.