Threat intelligence and indicators
Indicators of compromise, from STIX 2.1 bundles or plain lists.
In the consoleIndicators
vaigil intel import bundle.json --source "isac"
vaigil intel add 203.0.113.7 --source "case 12"
vaigil intel list
vaigil intel remove IDA STIX 2.1 bundle's indicators are read from their patterns. A pattern with AND, a time qualifier, a wildcard or a range is reported as not read, never guessed at. A plain list carries one value to a line, defanged or not. Each indicator keeps the source it came from, so a match says who said it was bad, and the events already held are searched for it when it arrives.