Malanta

No entries match these filters. Clear filters

1. announced Sep 16, 2026 · issue 078

   Malanta Attribution connector for OpenCTI converts flat apt: labels into pivotable Intrusion Set relationships via a live event stream.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Wire the Malanta pre-attack feed into OpenCTI's built-in TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. ingester so indicators arrive as STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. objects without a custom import connector.
   📍Name: Malanta Pre-Attack Indicators TAXII server URL: https://app.malanta.ai/feeds/taxii2/default TAXII version: TAXII 2.1 Collection: pre-attack-indicators Authentication: Bearer <malanta-api-key> Import from date: (leave empty)
   • Adds a new Malanta Attribution stream connector, listed in the Filigran OpenCTI Integrations Library, that listens to OpenCTI's live event stream and creates Intrusion Set entities plus indicates relationships for every Malanta indicator carrying an apt: label (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ apt:APT44, apt:APT38).
   • Supports a backfill.py script (dry-run then apply) to retroactively attribute indicators ingested before the connector started, with deterministic IDs making re-runs safe no-ops.
   • Configures Malanta's STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 / TAXII 2.1TAXII 2.1An OASIS-standard HTTP-based protocol for exchanging cyber threat intelligence, letting cyber tools publish and subscribe to structured threat data across organizations without custom integration work. feed via OpenCTI's built-in ingester at TAXII server URL https://app.malanta.ai/feeds/taxii2/default, collection pre-attack-indicators, using Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. (Malanta API key) authentication — no custom bulk-import connector required.
   • Preserves infrastructure cluster entities exactly as ingested — clusters are not rewritten into single-actor Intrusion Set objects — keeping multi-actor staging infrastructure accurate.

   4 details in Everything