> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Darktrace

> Ingest AI-powered network detections from Darktrace

Darktrace uses webhooks to forward Cyber AI Analyst and model breach alerts to Wirespeed in real-time.

## Prerequisites

* A Darktrace appliance with access to the Threat Visualizer
* Network connectivity from Darktrace to `https://api.wirespeed.co`

## Setup in Wirespeed

1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Darktrace**
2. Select **Webhook Details**
3. Copy the **Webhook URL** and **Webhook Secret** — you'll need these for the Darktrace configuration

## Setup in Darktrace

1. Login to **Darktrace Threat Visualizer**
2. Navigate to **Modules**
3. Select **HTTPS**
4. Click **Workflow Integrations**
5. Enable the integration and select the devices or subnets you want to monitor

### Configure HTTP/HTTPS Alerts

1. In the **Configuration for HTTP/HTTPS Alerts** section, click **New** to create a new alert configuration
2. Toggle **Send Alerts** to enabled
3. In the **URL** field, paste the **Webhook URL** from Wirespeed
4. Toggle **Show Advanced Options** to expand authentication settings
5. Set **Authentication** to **Basic**
6. Enter `wirespeed` as the **Username**
7. Enter the **Webhook Secret** from Wirespeed as the **Password**
8. Click **Verify alert settings** to test the connection
9. Save your configuration

## What Gets Ingested

Wirespeed receives and processes the following from Darktrace:

* **Cyber AI Analyst Incidents** — AI-generated investigation summaries
* **Model Breaches** — Behavioral detections from Darktrace's unsupervised ML models

Each detection is automatically enriched with device context and triaged using Wirespeed's verdict system.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Webhook verification fails">
    Ensure your Darktrace appliance can reach `https://api.wirespeed.co` on port 443. Check firewall rules and proxy settings.
  </Accordion>

  <Accordion title="No detections appearing">
    Verify that **Send Alerts** is enabled and that the devices you want to monitor are selected in the Workflow Integrations panel.
  </Accordion>

  <Accordion title="Authentication errors">
    Double-check that **Basic** authentication is selected, the username is exactly `wirespeed`, and the password matches your Webhook Secret from Wirespeed.
  </Accordion>
</AccordionGroup>