The Events Builder Connector accepts a provided payload, parses it, and creates an event  object in ThreatQ with attributes and related indicators.   The events ingested into ThreatQ can include related objects such as Sources, Targets, Identities, and Assets.

The payload is defined in the command used to execute the driver using a payload flag. 

You can also identify your private IP Addresses in the connector’s UI configuration page in ThreatQ to prevent them from being added as Indicators.