Overview
Periodically imports malicious file indicators from Stairwell's global corpus (MalEval verdicts), with their extracted IPs, domains, and URLs as related observables, into OpenCTI for proactive threat hunting.
The Stairwell external-import connector periodically pulls high-confidence malicious indicators from Stairwell's global file corpus into OpenCTI. On a configurable schedule it queries Stairwell MalEval verdicts for newly-seen malicious files and emits a STIX Indicator for each file hash, with the IP addresses, domain names, and URLs extracted from the file as related observables, wrapped in a Grouping or Report so every run is auditable. Filtering by MalEval probability bucket and time window is configurable, enabling proactive threat hunting against fresh, vendor-attributed intelligence.