IOC Feeds and YARA rules
Download all IOCs as CSV, JSON lines or in the Elastic Common Schema format (ECS). Note: IOCs likely to cause false positives, such as filenames or port numbers, have been removed. Please limit downloads to once per hour, as updates are infrequent. You can also subscribe to a MISP feed of all reports and download all collected YARA rules in a single rule file.
Domain Feeds
These feeds contain the domains from the past 180 days which have the IDS flag set .
Product-Specific Feeds
Checkpoint
These Checkpoint feeds contain IOCs from the past 180 days which have the IDS flag set.
Fortinet
These Fortinet feeds contain IOCs from the past 180 days which have the IDS flag set .
Microsoft Defender for Endpoint
These MDE feeds contain IOCs from the past 30 days which have the IDS flag set .
You can view the list of IOCs here and the list of reports here .
Last updated: 20 January 2025 at 14:42:40