Integrations 3 min read

IOC & STIX Exports

Export indicators of compromise in CSV, JSON, or STIX 2.1 format for integration with security tools.

ThreatCluster extracts indicators of compromise (IOCs) from the articles within each cluster. You can export these indicators in several formats for use in SIEMs, firewalls, threat intel platforms, and other security tools.

What IOCs Are Extracted

ThreatCluster automatically identifies and extracts the following indicator types from cluster articles:

Type Examples
IP addresses IPv4 and IPv6, including CIDR notation
Domains Fully qualified domain names associated with C2, phishing, or infrastructure
URLs Full URLs referenced in articles, defanged or otherwise
File hashes MD5, SHA-1, and SHA-256

Each IOC is tagged with its source article, the date it was observed, and any associated context (e.g., malware family, threat actor).

Note: IOC extraction is automated and may include false positives. Review exported indicators before pushing them into blocking rules.

Export Formats

CSV

A flat file with one indicator per row. Columns include type, value, first seen, source article, and associated cluster. Suitable for spreadsheets and simple ingestion scripts.

JSON

Structured output containing full indicator metadata, including context tags and confidence levels. Useful for programmatic processing and API-based ingestion.

STIX 2.1

Standards-compliant STIX 2.1 bundles containing Indicator, Malware, Threat Actor, and Relationship objects. Compatible with any platform that supports the STIX standard (MISP, OpenCTI, Anomali, etc.).

Exporting from a Cluster Page

  1. Open any cluster.
  2. Scroll to the Indicators section or click the IOCs tab.
  3. Review the extracted indicators. Use the checkboxes to select specific items, or leave all selected.
  4. Click Export and choose your format (CSV, JSON, or STIX 2.1).
  5. The file downloads immediately.
Tip: Use the filter bar in the Indicators section to narrow by type (e.g., show only IP addresses) before exporting.

Bulk Export from a Feed

You can export IOCs across multiple clusters at once from any feed view.

  1. Go to your feed (default or custom).
  2. Select the clusters you want to include using the checkboxes.
  3. Click Bulk Actions > Export IOCs.
  4. Choose your format and download.

Bulk exports merge indicators from all selected clusters and deduplicate automatically.

MISP Feed Integration

ThreatCluster can serve as a MISP-compatible feed, allowing your MISP instance to pull indicators directly.

  1. Navigate to Settings > Integrations > MISP.
  2. Enable the MISP feed and copy the feed URL.
  3. In your MISP instance, add a new feed with the ThreatCluster URL and the provided authentication token.

The MISP feed serves indicators in MISP's expected JSON format and updates automatically as new clusters are processed.

Note: For detailed setup instructions, visit the /misp-integration page within ThreatCluster.

ATT&CK Navigator Export

When a cluster is mapped to MITRE ATT&CK techniques, you can export a Navigator layer file.

  1. Open a cluster and go to the ATT&CK Mapping section.
  2. Click Export Navigator Layer.
  3. Import the downloaded JSON file into ATT&CK Navigator to visualize technique coverage.

This is useful for overlaying cluster activity onto your existing Navigator layers to identify gaps or trends.