--- title: IOC Feeds slug: ioc-feeds image: https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/SvwWk-oum0am1vqB8zqSg_flare-logomark-full-color-1.png docTags: createdAt: 2026-06-24T02:01:49.805Z --- The Intelligence Browser IOC Feeds turn research into proactive defense. They strengthen your threat detection and response posture by pushing intelligence directly into your security stack. Feeds deliver threat intelligence from Flare into your existing security tooling (SIEM, SOAR, EDR, TIP, or firewalls) in the following formats: 1. **[Industry-Standard STIX/TAXII Format: ](https://api.docs.flare.io/guides/ioc-feeds)**This is delivered as two TAXII feeds: - **Flare CTI Feed: ** Carries the intelligence objects themselves, including indicators, malware, threat actors, campaigns, and the other entity types. - **Flare CTI Relationship Feed:** Carries the STIX relationships that connect those objects to one another, for example linking an indicator to the malware, campaign, and threat actor it belongs to. :::Paragraph{indent="3"} Both feeds use the same configuration. They use TAXII 2.1, with basic authentication using your Flare API key. Each feed points to its own TAXII endpoint and collection, which Flare provides. ::: 2. [Intelligence Browser API:](https://api.docs.flare.io/api-reference/v4/endpoints/public/list-entities) The Intelligence Browser API offers a second automation option for users not currently utilizing STIX/TAXII. # Key Features - **Broad IOC coverage: **Support for the core indicator types security teams rely on, such as domains, URLs, IPs, file hashes, campaigns, threat actor profiles, and intrusion sets. - **STIX/TAXII delivery**: All feeds use STIX 2.1 for the intelligence format and TAXII 2.1 as the transport protocol. This is the industry standard and most SIEMs, SOARs, TIPs, and EDRs support it natively. Your existing tooling can consume these feeds without custom integration work. - **STIX object relationships:** Indicators are delivered with their full relationship context intact. An indicator links to the campaign it belongs to, which links to the threat actor behind it, which links to the associated malware family. Your TIP receives queryable, traversable intelligence, not a flat list. - **Standard API Support:** For users not currently using STIX/TAXII, threat intelligence can be accessed using the standard API as well. :::hint{type="info"} Access to this feature requires an add-on. Please reach out to your CSM for more information. ::: # Trials For trial accounts, once the CTI Module is enabled, these IOC feeds will begin populating **from the moment the tenant is created.** This does not backfill historical intelligence, so objects published before the feed existed will not appear in the collection. *** # Walkthrough Click through the following product tour to learn how to integrate the IOC Feed into your existing security stack. :::Iframe{iframeHeight="0" code="
"} ::: # Configuring the IOC Feed in OpenCTI Flare delivers intelligence through two TAXII feeds: 1. The **Flare CTI Feed** carries the indicators (IOCs) along with their context objects, such as malware, campaigns, and tools. 2. The **Flare CTI Relationship Feed **carries the relationship objects that connect each indicator to the malware, campaigns, and threat actors it belongs to, so the intelligence arrives connected rather than as isolated objects Follow these steps to configure Flare's IOC feed in OpenCTI: ::::WorkflowBlock :::WorkflowBlockItem Create a new TAXII feed in OpenCTI, and use the following configuration for the Flare CTI Feed: - **Name:** Flare CTI Feed - **TAXII server URL**: https\://api.flare.io/taxii2/cti/ - **TAXII version**: TAXII 2.1 - **TAXII collection**: f1a4ec71-0c00-4f5f-9dbd-e8a4cd33aa66 - **Authentication type**: Basic user / password ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/92__EpIox4aOBECY-T4uv_image.png" size="70" isUploading="false" width="674" height="672" darkWidth="674" darkHeight="672" position="flex-start" showCaption="false"} This points to Flare's TAXII server using TAXII 2.1 and the TAXII Collection ID Flare provides, authenticating with Basic auth (api-key as the username, a Flare API key as the password). An empty** Import from date** pulls the full collection. ::: :::WorkflowBlockItem Create a second TAXII feed, and use the following configuration for the Flare CTI Relationship Feed: - **Name:** Flare CTI Relationship Feed - **TAXII server URL:** https\://api.flare.io/taxii2/cti/relationships/ - **TAXII version**: TAXII 2.1 - **TAXII Collection:** f1a4e540-2c14-4d5f-8bbc-2e7eb31ad104 - **Authentication type:** Basic user / password ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/5k1B4QA1lResFTDCgOcF__image.png" size="70" isUploading="false" width="690" height="684" darkWidth="690" darkHeight="684" position="flex-start" showCaption="false"} This points to the relationships endpoint using TAXII 2.1 and its own TAXII Collection, with the same Basic auth (api-key as the username, a Flare API key as the password). Ingesting it alongside the main feed is what links each indicator to its malware, campaigns, and actors ::: :::WorkflowBlockItem With both feeds configured and active, the TIP polls Flare's TAXII server on a schedule and pulls new and updated objects automatically. No manual exports or imports are involved once the connection is in place. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/Nx6jtsNhsFbP4fCRnjsXQ_image.png) ::: :::WorkflowBlockItem As ingestion runs, indicators flow into the platform. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/lg-7U2PcDFamaq2aSXIwV_image.png) ::: :::WorkflowBlockItem Each indicator arrives with full context showing STIX pattern, a score and confidence level, kill chain phases, execution, and other information. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/uowmJ7Z2OG7ImzLv6Fwwk_image.png) With this context in place, the TIP can apply the indicators to detection and blocking rules. ::: :::: *** # Integrating the IOC Feed with MISP Flare delivers intelligence through two TAXII feeds: 1. The **Flare CTI Feed** carries the indicators (IOCs) along with their context objects, such as malware, campaigns, and tools. 2. The **Flare CTI Relationship Feed **carries the relationship objects that connect each indicator to the malware, campaigns, and threat actors it belongs to, so the intelligence arrives connected rather than as isolated objects Follow these steps to configure Flare's IOC feed in MISP: :::::WorkflowBlock ::::WorkflowBlockItem ### Set up the Environment - Create a dedicated Flare API key for this integration. A dedicated key limits exposure if it’s ever compromised and lets you disable or revoke it without affecting your other integrations. See [API Keys documentation](docId\:MUFLZ4fa2xFLlfBc8TIYZ) for instructions on creating and managing API keys. - Create and activate a virtual environment, then install the two client libraries: ```python python3 -m venv .venv && . .venv/bin/activate pip install pymisp taxii2-client ``` - Set your connection details as environment variables, replacing the placeholder values with your own: ```python export FLARE_API_KEY="paste-your-flare-api-key" export FLARE_SDO_COLLECTION_URL="https://api.flare.io/taxii2/cti/collections//" export FLARE_SRO_COLLECTION_URL="https://api.flare.io/taxii2/cti/relationships/collections//" export MISP_URL="https://your-misp.example.com" export MISP_KEY="your-misp-automation-key" export MISP_VERIFY_SSL="true" # "false" only for a self-signed lab instance ``` :::hint{type="info"} - `FLARE_SDO_COLLECTION_URL` points to the Flare CTI Feed, and - `FLARE_SRO_COLLECTION_URL` points to the Flare CTI Relationship Feed. Set - `MISP_VERIFY_SSL` to false only for a self-signed lab instance. ::: :::: ::::WorkflowBlockItem ### Test the connection Run this script first to confirm your API key works and to list the collections your key can reach. :::ExpandableHeading View script ```python #!/usr/bin/env python3 import os from taxii2client.v21 import Server server = Server("https://api.flare.io/taxii2/", user="api-key", password=os.environ["FLARE_API_KEY"]) print("Connected to:", server.title) for root in server.api_roots: for c in root.collections: print(root.url, "->", c.id, c.title) ``` ::: :::: ::::WorkflowBlockItem ### Import Indicators Run this script to validate the pipeline with a first import. It pulls the last day of indicators into a single MISP event and does not include relationships. :::ExpandableHeading View script ```python #!/usr/bin/env python3 import os, json, uuid, tempfile, datetime, urllib3 from taxii2client.v21 import Collection, as_pages from pymisp import PyMISP urllib3.disable_warnings() col = Collection(os.environ["FLARE_SDO_COLLECTION_URL"], user="api-key", password=os.environ["FLARE_API_KEY"]) since = (datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(days=1)).strftime("%Y-%m-%dT%H:%M:%S.000Z") objects = [] for env in as_pages(col.get_objects, per_request=100, added_after=since, type="indicator"): objects.extend(env.get("objects", []) or []) if len(objects) >= 1000: # keep the bundle modest objects = objects[:1000]; break print(f"pulled {len(objects)} indicators") bundle = {"type": "bundle", "id": f"bundle--{uuid.uuid4()}", "objects": objects} with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f: json.dump(bundle, f); path = f.name misp = PyMISP(os.environ["MISP_URL"], os.environ["MISP_KEY"], ssl=os.environ.get("MISP_VERIFY_SSL", "true").lower() == "true") print(misp.upload_stix(path=path, version="2")) ``` ::: :::: ::::WorkflowBlockItem ### Import Indicators With Relationships Once the pipeline is working, use this script for the full import. It pulls the relationships first, then the objects they reference, and uploads them together so that each indicator lands in MISP tagged with its related malware, campaign, or tool. It records a timestamp in a state file for incremental sync, so each run only pulls what is new. :::ExpandableHeading View script ```python #!/usr/bin/env python3 """Flare CTI -> MISP with relationships preserved. Incremental via a state file.""" import os, json, uuid, tempfile, datetime, urllib3 from taxii2client.v21 import Collection, as_pages from pymisp import PyMISP urllib3.disable_warnings() FLARE_KEY = os.environ["FLARE_API_KEY"] SDO_URL = os.environ["FLARE_SDO_COLLECTION_URL"] SRO_URL = os.environ["FLARE_SRO_COLLECTION_URL"] STATE = os.environ.get("STATE_FILE", "flare_state.json") REL_CAP = int(os.environ.get("FLARE_MAX_RELATIONSHIPS", "500")) # Standard STIX types MISP understands (Flare's actor/chat-channel/forum-thread do not map). ALLOWED = {"attack-pattern","campaign","indicator","infrastructure","intrusion-set", "location","malware","report","threat-actor","tool","vulnerability"} def now(): return datetime.datetime.now(datetime.timezone.utc) def iso(d): return d.strftime("%Y-%m-%dT%H:%M:%S.000Z") def added_after(): try: return json.load(open(STATE))["added_after"] except Exception: return iso(now() - datetime.timedelta(hours=24)) def col(url): return Collection(url, user="api-key", password=FLARE_KEY) def pull(url, cap=0, **f): out = [] for env in as_pages(col(url).get_objects, per_request=100, **f): out.extend(env.get("objects", []) or []) if cap and len(out) >= cap: return out[:cap] return out def resolve(url, ids, types, added=None): """Flare ignores match[id], so scan by type and keep the referenced objects.""" f = {"type": types} if added: f["added_after"] = added remaining, found = set(ids), {} for env in as_pages(col(url).get_objects, per_request=100, **f): for o in env.get("objects", []) or []: if o.get("id") in remaining: found[o["id"]] = o; remaining.discard(o["id"]) if not remaining: break return found start = now() since = added_after() sros = pull(SRO_URL, cap=REL_CAP, added_after=since) print(f"relationships: {len(sros)}") srcs = {r["source_ref"] for r in sros if r.get("source_ref","").split("--")[0] in ALLOWED} tgts = {r["target_ref"] for r in sros if r.get("target_ref","").split("--")[0] in ALLOWED} inds = resolve(SDO_URL, srcs, "indicator", added=since) # recent indicators ctx = resolve(SDO_URL, tgts, ",".join(sorted({i.split("--")[0] for i in tgts})) or "malware") # older context have = set(inds) | set(ctx) good = [r for r in sros if r.get("source_ref") in have and r.get("target_ref") in have] objects = list(inds.values()) + list(ctx.values()) + good print(f"uploading {len(objects)} objects") bundle = {"type": "bundle", "id": f"bundle--{uuid.uuid4()}", "objects": objects} with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f: json.dump(bundle, f); path = f.name misp = PyMISP(os.environ["MISP_URL"], os.environ["MISP_KEY"], ssl=os.environ.get("MISP_VERIFY_SSL","true").lower()=="true") print(misp.upload_stix(path=path, version="2")) json.dump({"added_after": iso(start)}, open(STATE, "w")) # advance state for next run ``` ::: :::: :::WorkflowBlockItem ### Schedule the Sync Run the import script on a schedule so that MISP stays current. This cron entry runs it hourly: ```bash # hourly, at :07 7 * * * * cd /opt/flare-misp && . .venv/bin/activate && ./ingest.py >> ingest.log 2>&1 ``` Keep the state file on a persistent path so that incremental sync survives restarts. You can also run the script in a loop inside a container. ::: ::::: ### What the imported intelligence looks like Once the import runs, the intelligence appears in MISP as a populated event. Here is an example of an event that came in with a campaign, several intrusion sets, malware, and a tool, along with the indicators and the relationships between them. Under the event's attributes, each imported indicator carries its confidence level and TLP tags, and its related malware appears as a galaxy on the attribute. These galaxies are filterable and pivotable, so you can move from an indicator to the malware family behind it. ::::Tabs :::Tab{title="Attribute Index"} Imported indicators appear as event attributes, each tagged with its confidence level, TLP, and related malware galaxy. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/6NWVUXLvNGGBAAWpAWMp1_image.png) ::: :::Tab{title="Group Cluster Detail"} Opening a galaxy cluster shows the full intelligence context, such as the Lazarus Group intrusion set and its description. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/kQpOhXfKyoisTmKXkvbxP_image.png) ::: :::Tab{title="Cluster References List"} Each cluster retains its external references, linking back to the source reporting behind the intelligence. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/JFskaL7BuLPM6Xmc6Gev-_image.png) ::: :::: :::hint{type="info"} ### Notes and troubleshooting Here are some important things to keep in mind: - **Test the scripts: **Review and test all scripts before running in production - **Pull both feeds together:** New indicators often reference older malware or campaign objects. If you pull only a narrow date window from both collections, those references will not resolve and MISP will show no relationships. The Step 4 script handles this by resolving referenced objects regardless of their age. - **Keep bundles modest and request only standard STIX types:** MISP rejects very large uploads with an HTTP 413 error. - **Relationships appear as galaxies:** In MISP, a linked indicator shows its related malware or campaign as a galaxy on the IOC, which you can filter and pivot on. ::: ###