Before
An endpoint or security analyst had to read the intelligence store, select supported and still-valid indicators, check which entries had already been exported, and assemble submissions manually. They also had to track accepted and failed batches and update the export record so the next run would not repeat successful submissions.
How it works
- Read threat-indicator buckets and the previous export state, then filter for valid, supported indicators meeting the confidence threshold.
- Prepare batches of up to 200 indicators and submit them with consistent detection, expiration, and source settings, using limited parallel processing.
- Validate write results, record only accepted indicators, preserve failed batches for retry, and return the run summary.
Workflow details
- Trigger and collection: A scheduled or on-demand run reads the available threat-intelligence buckets and the state of the previous export, allowing the workflow to evaluate indicators across the stored collection.
- Eligibility filtering: The flow selects valid SHA-256, MD5, and domain indicators with confidence of at least 75, while accepting IP addresses only when identified as command-and-control and excluding URLs. Indicators already recorded as exported are skipped, and processing is limited to 10,000 selected indicators per run.
- Batch preparation: Eligible indicators are ordered by hashes, domains, and then IP addresses, enriched with detection settings, expiration dates, source information, and supporting context, and grouped into batches of up to 200.
- Submission and validation: Batches are submitted as custom IOCs with detection enabled, retroactive detection requested, and warning rejection preserved; up to five batch calls can run in parallel. The workflow then checks the response codes to distinguish accepted writes from failures.
- State and reporting: Only accepted batches are added to the export state, while failed batches remain eligible for the next run. The workflow records run statistics and write results, returns the export summary, and reports an error when the state or journal cannot be written.
What changed
Indicator selection, deduplication against the previous export, batching, submission, and write validation now happen in one controlled run. Successful indicators are recorded automatically, failed batches are retried in a later run, and the workflow exposes whether the export state and journal were written successfully.
Work removed
Reading indicator buckets one by one, checking confidence, type, validity, and prior export status, assembling 200-item batches, submitting each batch, reviewing response codes, and updating the export state and journal manually.
Expected outcome
The workflow can process up to 10,000 selected indicators per run in batches of 200, with successful exports recorded and failed writes retained for follow-up.
