IoCs: what they are, how they work, and how to integrate them

IoCs, or Indicators of Compromise, are technical indicators used to identify signs associated with malicious activity. In practice, the CTI IoC base gathers evidence such as hashes, IPs, and domains already linked to threats monitored by the platform.

These indicators help security teams validate suspicions, enrich investigations, and connect technical signs to campaigns, actors, and vulnerabilities already known within CTI.

→ All IoCs

In CTI, the IoC base works as a complete repository of indicators of compromise. It can be used either from a specific bulletin or directly as part of technical investigation workflows.

Each indicator may include useful analysis fields such as "Confidence score," which shows how trustworthy the evidence is, and "Detected on," which indicates when the indicator was identified.

The interface also allows filtering by Confidence level, Tag, Type, and Detected, helping narrow large volumes of data and focus on the most relevant indicators.

IoCs are also connected to bulletins. When you follow a bulletin, you can receive alerts about new IoCs related to that threat, turning the bulletin into a continuous technical tracking point.

The confidence level of an IoC indicates how strongly the available evidence supports the classification of that indicator as malicious.

It is calculated through a multi-source analysis that considers how many security vendors identify the IoC as malicious. That information is then mapped to an internal scoring system that classifies the indicator as Low, Medium, or High confidence.

Axur provides different ways to consume and integrate IoCs depending on the workflow and destination tool.

For direct programmatic consumption, the main reference is the IoC Collection API. This option is best suited for custom integrations, internal automations, SIEMs, and enrichment workflows that need controlled and programmatic access to the IoC collection.

For OpenCTI, a dedicated guide explains how to ingest Axur IoCs through TAXII without custom development, using OpenCTI's native connector. In that flow, you create a TAXII Feed in OpenCTI, use the endpoint and collection ID from the Axur documentation, and authenticate the integration with your platform token.

For MISP, a separate guide explains integration through an IOC Feed in Pull mode, created in the Axur platform and then consumed as a network feed in MISP. The guide explains how to create an API key, generate an IOC Feed in Pull mode, use the feed URL with the format=csv parameter, and configure the authorization header in MISP as Bearer YOUR_AXUR_API_KEY.

CTI includes API options for structured intelligence consumption, including CTI TAXII Server and the IoC Collection API.

CTI TAXII Server is the API interface used to consume CTI intelligence in a structured format, including the bulletins made available by the product.

This documentation is the main reference if you want to feed another platform, centralize bulletins and intelligence in an external repository, or incorporate CTI data into your own threat intelligence workflows.

Main IoC integration references:

If you have any questions, feel free to reach out at [email protected] 😊