karl/NetScaler_forensik
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add public search indicators to default catalog and Sigma rules

Browse Source
This commit is contained in:
StasonJatham committed 2026-10-05 16:54:16 +02:00
1 parent b709b311d0
commit 837a7ec184
10 files changed
+1384 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

THREAT_INTELLIGENCE.txt
+8 -3
View File
@@ -1,15 +1,20 @@
PUBLIC THREAT INTELLIGENCE INVENTORY
Review date: 2026-10-01
Source review date: 2026-10-01
Catalog update: 2026-10-05
52 source records; all 37 distinct URLs supplied for this review checked.
246 unique indicator values; 41 behavior patterns; 47 Sigma rules.
262 unique indicator values; 41 behavior patterns; 57 Sigma rules.
CANONICAL DATA AND TRACEABILITY
config/threat_intel.json is the complete inventory in the source release.
The installed package includes identical data/threat_intel.json and public_sigma.yml.
Each IOC has a stable ID, literal type/value and all source observations. Those
Each IOC has a stable ID and literal type/value. Sixteen additional public search
candidates have no published attribution in this inventory: their source lists
are empty and provenance is unattributed_public_indicator. They are low-confidence
reference_only candidates, not independently verified malicious indicators.
The other indicators retain their existing source observations. Those
observations retain reporting context, confidence, source dates and roles. MISP
attribute types, comments and to_ids flags are retained even when they conflict.
Each source links to the indicator IDs and Sigma rule IDs derived from it.