ioc-distributor

Automate IOC distribution by exporting threat intelligence data from OpenCTI and converting it into STIX, Suricata, and YARA formats for delivery to SIEMs and IDS/IPS platforms. The workflow handles validation, multi-format conversion, and configured endpoint delivery.

Yes, you can export OpenCTI indicators to YARA and Suricata formats. The Skill converts threat intelligence data into CSV, JSON, STIX 2.1, Suricata, and YARA formats for use across different security monitoring systems.

The best way to push threat intelligence feeds is through automated distribution. The Skill pushes IOC data to SIEMs, IDS/IPS platforms, MISP instances, syslog servers, and file shares through configured endpoints.

Yes, IOC validation is required before distributing STIX 2.1 indicators. The workflow aggregates indicators from sources like OpenCTI, validates confidence levels, manages expiration, and supports daily threat feed updates.

Yes, the IOC export workflow requires curl, jq, xmlstarlet, ssh, and scp dependencies. These tools facilitate data extraction, JSON processing, XML parsing, and secure remote file delivery to configured security endpoints.

Automated MISP integration handles IOC expiration and daily feed updates by validating confidence levels during the aggregation process. It converts validated indicators into multiple formats and distributes them to configured MISP instances.