Validate an IOC before blocking it
A practical SOC workflow for checking indicator provenance, age, local sightings and false positives before making a blocking decision.
Download checklistSOC analyst guides and checklists
Use public threat intelligence to answer a specific investigation question. These workflows show how to use ThreatFilter's tools, record evidence and recognise the limits of a result. No signup is needed. Downloads are plain text; keep completed worksheets in your approved internal system.
Export IOCs to STIX 2.1 and MISP
Select a ThreatFilter indicator window, export STIX or MISP JSON, and review counts, timestamps, sharing and detection settings before import.
Download checklistUse ATT&CK group profiles during triage
Turn documented threat-group techniques into testable hunting hypotheses, check original references and export an ATT&CK Navigator layer.
Download checklistSet up CVE and vendor advisory RSS feeds
Choose feeds for the products you run, import OPML and distinguish advisory coverage from NVD and CISA KEV.
Choose a starting point
- A reported domain, address or hash: start with IOC validation.
- A named actor or technique: start with ATT&CK group triage.
- A CVE or patching question: use the cross-source CVE index and original vendor advisories.
- A daily watchlist: choose a small RSS starter bundle.
These guides do not upload your evidence, query your security systems or automate blocking. Public data is a lead; a local sighting, business impact and corroborating evidence determine the next action.