This feature is only available for the Platform plan users.

Maltiverse allows users to upload and manage IoCs directly through the platform. This feature streamlines the process of parsing IoCs from raw text, associating them with relevant metadata, and storing them in a private database accessible only to the Enterprise Customer. The uploaded IoCs can then be utilized through threat intelligence feeds or accessed via API.

How to use the IoC upload feature

1. Accessing the IoC upload form

To use the IoC upload feature, navigate to the Maltiverse platform and locate the Upload IoC (1) section in the menu. This section provides an input textbox where you can paste any text.

2. Pasting IoCs

Copy and paste the IoCs you want to upload into the designated text input form. Maltiverse will automatically parse the input and identify the IoCs within the provided text that you will notice in the Indicators draft. Once you have added the IoCs, click Next (1).

3. Complete information

After parsing the IoCs, Maltiverse will prompt you to enter metadata associated with each IoC. The following metadata options are available:

• Blacklist Description: Describe any information related to blacklists associated with the IoCs.
• Classification: Choose a classification for each IoC, such as Malicious, Suspicious, Neutral, or Whitelist.
• Mitre Attack Threat Actor: Specify any Mitre Attack Threat Actor relevant to the IoCs.
• Tags: Add any additional tags that can help categorize and identify the uploaded IoCs.
  

4. Review and confirmation

Review the parsed IoCs along with their associated metadata. Ensure that all relevant information has been entered accurately. Once satisfied with the IoCs and metadata, click Publish Indicators (1). This action will upload the IoCs and their associated metadata to a private database accessible only to you as the customer.

Accessing uploaded IoCs

1. Access them through the Platform Search Engine, you can learn how to use the engine in our documentation. 
   
2. Create custom feeds with your new IoC so they can be disseminated to you security tools. Learn how to create custom threat intelligence feeds following our documentation.