Ingest the free Vulnetix Malscan STIX 2.1 feeds into Splunk Enterprise Security: point a threatlist modular input at the per-ecosystem DNS and URL bundles so indicators land in the threat-intel framework and drive notable events.
The feeds
Free STIX 2.1 bundles at https://vulnetix.com/malscan-stix/{ecosystem}/{dns|urls}.stix.json — ecosystems generic, npm, pypi, go, cargo, rubygems, maven, packagist and nuget. DNS carries malicious domains and IPs; URLs carries C2 and exfiltration endpoints. Refreshed every 15 minutes, each bundle ships a .sha256 sidecar, index.json manifests the set, and a DNS TXT record per ecosystem carries the live locator. Licensed AGPL-3.0 — free to use and redistribute.
Wire the feeds into Splunk
Splunk ES's threat-intel framework downloads and parses STIX documents from a URL on an interval: one inputs.conf stanza per feed, and the indicators flow into the threatintel collections used by the correlation searches.
inputs.conf: threat-intel download stanza
# $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/local/inputs.conf [threatlist://vulnetix_malscan_dns_generic] url = https://vulnetix.com/malscan-stix/generic/dns.stix.json type = stix description = Vulnetix Malscan malicious domains and IPs (generic, 15-min refresh) interval = 900 disabled = false [threatlist://vulnetix_malscan_urls_generic] url = https://vulnetix.com/malscan-stix/generic/urls.stix.json type = stix description = Vulnetix Malscan C2 and exfil URLs (generic, 15-min refresh) interval = 900 disabled = false
Verify before you ingest
curl -fsSLO https://vulnetix.com/malscan-stix/generic/dns.stix.json REMOTE=$(curl -fsSL https://vulnetix.com/malscan-stix/generic/dns.stix.json.sha256 | cut -d' ' -f1) LOCAL=$(sha256sum dns.stix.json | cut -d' ' -f1) [ "$REMOTE" = "$LOCAL" ] && echo "verified" || echo "CHECKSUM MISMATCH: do not ingest"
Where the indicators come from
Every feed entry traces to a supply-chain malware campaign Vulnetix tracks. The Malscan engine matches the same indicators against dependencies already installed on disk; the Package Firewall blocks the packages that carry them at install time.
All STIX feed integrations → · The campaigns behind the feeds →