{"id":"ec3b6866-939a-4c1e-99a2-3aaca733a243","task":"Automate ingestion of abuse.ch feeds (URLhaus, ThreatFox) into detection pipelines","domain":"abuse.ch","steps":["Register on abuse.ch to obtain an Auth-Key for ThreatFox API access; URLhaus bulk export does not require authentication but ThreatFox query and submission endpoints do.","Download the URLhaus full URL list or recent additions in CSV or JSON format from https://urlhaus.abuse.ch/downloads/csv_recent/ (no auth required) on a scheduled basis to ingest newly observed malware distribution URLs.","Query ThreatFox for IOCs by type (ip:port, domain, url, md5_hash, sha256_hash) with POST https://threatfox-api.abuse.ch/api/v1/ with body {\"query\": \"search_ioc\", \"search_term\": \"VALUE\"} and Authorization: Bearer YOUR_AUTH_KEY.","Filter ingested IOCs by first_seen date and confidence_level; since May 2025, abuse.ch expires IOCs older than 6 months from API responses — design your pipeline to handle the shrinking historical window.","Load active IOCs into your SIEM, NGFW, or DNS resolver blocklist; store the abuse.ch malware_family and tags fields as context labels to improve alert quality."],"gotchas":["Since 2025-05-01, abuse.ch expires IOCs older than 6 months from the ThreatFox API and exports; if your pipeline relies on historical IOCs, snapshot and retain them locally before expiry.","URLhaus CSV exports use semicolons as delimiters (not commas) in some download formats; verify the delimiter before parsing to avoid silent field misalignment.","ThreatFox IOC confidence_level ranges from 0-100 and is community-sourced; blindly blocking all IOCs without a confidence threshold can generate significant false positives."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:40.623Z"},"url":"https://mcp.waymark.network/r/ec3b6866-939a-4c1e-99a2-3aaca733a243"}