ThreatFilter — STIX / MISP import checklist
Guide: https://threatfilter.dev/guides/stix-misp-exports/
Keep completed copies in your approved internal system.

[ ] Record dataset generation date, search and selected time window.
[ ] Compare exported counts and a sample of each type with the master list.
[ ] Remember export timestamps are not source first-seen dates.
[ ] Validate syntax and test destination compatibility with a small sample.
[ ] Check duplicates: fresh UUIDs are generated with each export.
[ ] Review provenance notes and source reuse terms.
[ ] Confirm MISP event is private/unpublished and detection use remains off.
[ ] Review local import/sync policies; file defaults cannot enforce them.
[ ] Validate candidates before promotion to detections or blocking.
[ ] Record reviewer, result, expiry policy and rollback procedure.

STIX file = bundle of indicator patterns, not TAXII or a full evidence graph.
MISP file = candidate event; to_ids=false and published=false at export.