概要
Periodically imports malicious file indicators from Stairwell's global corpus (MalEval verdicts), with their extracted IPs, domains, and URLs as related observables, into OpenCTI for proactive threat hunting.
The Stairwell external-import connector periodically pulls high-confidence malicious indicators from Stairwell's global file corpus into OpenCTI. On a configurable schedule it queries Stairwell MalEval verdicts for newly-seen malicious files and emits a STIX Indicator for each file hash, with the IP addresses, domain names, and URLs extracted from the file as related observables, wrapped in a Grouping or Report so every run is auditable. Filtering by MalEval probability bucket and time window is configurable, enabling proactive threat hunting against fresh, vendor-attributed intelligence.