Before
Analysts had to retrieve indicator records and observations from storage, convert them into a common exchange format, and assemble the resulting files by hand. They also had to track the files produced and the filters or counts associated with each export.
How it works
- Receive an export request and collect the relevant indicator buckets and observation records.
- Apply the requested filters and build STIX 2.1 bundles with the available indicators, sources, relationships, and sightings.
- Write the bundles and manifest, then return the export locations, counts, details, and status.
Workflow details
- Trigger and scope: A webhook request starts the export and can include confidence, indicator-type, and chunk-size filters.
- Intelligence collection: The workflow lists stored indicator buckets, reads their contents, identifies observation records, and retrieves available observations for inclusion.
- STIX construction: The collected intelligence is transformed into STIX 2.1 bundles containing observables, indicators, source identities, and related malware or sightings when those records are available.
- Repeatable packaging: Deterministic identifiers support consistent re-exports, while the workflow creates one or more bundle files for the selected intelligence.
- Manifest and handoff: A manifest records the filters, counts, bundle locations, and export details, then the workflow returns the manifest, manifest location, written files, and operation status.
What changed
A single request now performs collection, filtering, STIX packaging, file writing, and manifest creation, leaving analysts with a documented export and its locations instead of a manual multi-step handoff.
Work removed
Manually retrieving indicator buckets and observations, reformatting intelligence into STIX bundles, assembling an inventory of output files, and recording export filters and counts.
Expected outcome
Each export can replace at least three recurring manual actions—retrieving records, reformatting indicators, and assembling an output inventory—while producing a consistent handoff package.
