CTI platform
- OpenCTI: Import the bundles straight into your knowledge graph with pycti
- MISP: Upload the bundles through the STIX 2 import endpoint
SIEM
- Microsoft Sentinel: Push indicators through the Upload Indicators (STIX objects) API
- Splunk: Feed Enterprise Security's threat-intel framework with a threatlist input
- Elastic Security: Poll the bundles with an httpjson input into threat.indicator fields
- IBM QRadar: Bulk-load extracted indicators into reference sets
SOAR
- Cortex XSOAR: A Generic JSON Feed instance over the bundle URLs
- Tines: A four-action story: poll the manifest, fetch, dedupe, dispatch
Network edge
- Suricata: Datasets from the DNS feed, matched on dns.query at the wire
- pfSense / OPNsense: Firewall aliases and DNSBL lists derived from the feeds
Cloud
- AWS GuardDuty: A threat intel set kept fresh from the extracted IP list
- AWS WAF: An IP set your web ACLs block, updated from the feed
The feeds
Two bundles per ecosystem: dns.stix.json (malicious domains and IPs) and urls.stix.json (C2 and exfiltration endpoints), for generic, npm, pypi, go, cargo, rubygems, maven, packagist and nuget. Every bundle ships a .sha256 sidecar, index.json manifests the set, and DNS TXT records carry the live locators. Licensed AGPL-3.0.