Name: SwiftIOC Threat Intelligence Feed
Creator: SwiftIOC
License: https://opensource.org/licenses/MIT

Your next useful action

Today, in your environment

Manage product watches →

Loading your local briefing…

Make this useful to you: follow a product, watch a group or CVE, or import your inventory.

What if we patch this? Preview findings and reported group associations

A planning aid, not a scanner. Assumes successful remediation of selected CVEs on matching assets; verify applicability and patch success separately.

Find a product or CVEMatching targets

Search to narrow the available targets.

Data coverage & evidence gaps

Get started or resume an investigation

Investigate an indicator

Look up an IP, domain, URL or hash.
Review its sources, dates and score; add useful records to your queue.
Open Workspace, map your event fields, then copy the IOC SPL or export your list.

Review a vulnerability

Review known exploited CVEs and provider evidence.
Compare a software inventory, or follow a vendor and product.
Verify installed versions and applicability with the vendor advisory or your vulnerability scanner.

Resume a saved investigation

Import an exported queue JSON file. Merges up to 50 indicators, keeps existing evidence for duplicates, and stays in this browser. Maximum 500 KB.

Check an indicator

Raw and defanged IPs, domains, URLs, hashes, and CVEs are supported.

Private analyst workspace

Investigation queue 0

Shortlist indicators while you triage.

Live hunt builder

Hunt this queue in Splunk

Settings stay in this tab

Map event fields

Use * for every index, a wildcard such as security_*, or commas for multiple indexes. Use extracted, single-valued event fields. Dotted names such as source.ip are supported. Query text updates as you type.

Source IPDestination IPDNS questionFull URLMD5SHA-1SHA-256

Choose the indexes and map event fields before running. Each result lists every matching queued IOC.

Splunk setup & full-feed hunts

IP/CIDR matching checks both endpoints. Domains match exact DNS names; URL paths and queries retain case and require exact event values. No match does not mean safe. Validate field mappings in Splunk before scheduling.

Total indicators

—

Across active sources

High-confidence

—

Score ≥80 or 2+ reporting groups

Multi-group reporting

—

Listed by 2+ reporting groups

Avg score

—

— indicator types

Collection overviewScore distribution and changes since the previous run

01 / Vulnerabilities

Vulnerabilities to watch

Known exploitation first, newest KEV additions at the top. Each CVE keeps its own evidence.

Collection JSON ↗

Exposure report · match your software inventory

Import up to 200 assets as JSON. Your inventory stays in this tab and is never uploaded or saved to browser storage. Explicit CPE mapping enables conservative version checks; product-only matches need verification.

Inventory JSON

Import an inventory to begin. No match does not mean safe.

Order: findings needing review first, known exploitation, internet exposure, then critical assets. Outside-range findings come last. Exposure and importance are supplied by you.

Software components · optional SBOM review

Import a CycloneDX or SPDX JSON SBOM in this tab. Parsing stays local. Only if you choose “Check with OSV” will package URLs and versions be sent directly from your browser to OSV.dev; SwiftIOC does not receive or save the SBOM.

SBOM JSON

Import a supported SBOM to begin. No match is not proof of safety.

Personal briefing · follow vendors & products

Match exact CISA vendor and product fields. NVD-only records without these fields cannot be matched. Watches stay in this browser; a product match does not confirm your installed version is affected.

Confirmed KEV records only, newest catalog additions first. An empty result means this collection has no matching KEV evidence; other CVEs are available in All CVEs.

Reported ransomware group Only show group-linked CVEs in this view

Loading the published ransomware.live evidence snapshot…

Analyst tools · compare groups, affected products & shortcuts

Severity Local review

Compare group A Compare group B Group C (optional)

Focus a result to use J/K for navigation, Enter for details, and X for selection. Escape closes details. Priority guides review; check your affected versions before acting.

Include NVD rejected records

Loading the vulnerability collection…

Page 0 of 0

KEV records known exploitation; it does not confirm an attack is happening now.

Coverage, evidence & integration notes

This collection covers the retained feed, not the complete KEV or NVD catalogs. Source windows, outages, and retention affect coverage. KEV membership records known exploitation; it does not date an attack or confirm one is happening now. Severity alone does not establish exploitation. These filters are independent of the IOC preview.

Building an IOC integration? Download the observable-only collection. Existing combined exports remain available.

Group intelligence / ransomware.live

Follow the group evidence

Loading group coverage…

Explore reported IOCs, CVEs and techniques, or trace shared evidence in the group map.

Open workbench Explore groups Evidence map →

02 / Discovery

Follow the evidence

Follow the evidence behind the score. Compare reporting groups, recent sightings, and uncommon tags in the loaded preview.

Refine the sample ↓

Loading the discovery sample…

Observables from the compact preview, not the complete feed. CVEs are listed in the vulnerability collection above. Preview filters apply here. Nothing is uploaded when you explore or export.

Relationship graphExplore shared tags and reporting sources

Reporting map · provider coverage

Reporting & relationship graph

Compare reporting providers and shared behavior tags in the filtered sample. Start with a suggested connection, then isolate its direct links when the map gets busy. Known adapter aliases are grouped, and raw feed names remain in the evidence panel. Shared reporting does not establish a campaign or independent verification.

Explore group-linked IOCs, CVEs and techniques in the evidence map →

Connect through

Detail level

Layout

Hover or focus a node to preview links; select it for details. Use Focus links to isolate its direct connections. Zoom in, then drag empty space to pan; Fit resets the view. Press Escape to clear a selection. On small screens, swipe sideways.

Find in this graph

Search the displayed sample. Use the main filters to change its coverage.

100%

Behavior tag Reporting provider Aggregate feed Indicator

Live IOC preview

Filter and search the latest SwiftIOC feed.

Loading the latest indicators…

Current SwiftIOC indicators. Activate a column heading to sort.
					Row actions

Preparing live preview…

Sources & feed compositionSource contributions, indicator types, and tags

Sources & feeds

Active feeds and their contribution to this collection.

Sources

Top sources by indicator contribution.

Indicator contribution by source
Source	Indicators	Share

On phones we only show the top entries. Expand to browse the full list without endless scrolling.

Types

Indicator types observed in this IOC bundle.

Indicator totals by type
Type	Count	Share

Expand for the full breakdown when you want the detailed view.

Exports & raw feeds

Download the same SwiftIOC bundle in your preferred format.

★ High-confidence CSV ★ High-confidence JSONL CSV TSV JSON JSONL STIX 2.1 bundle TAXII 2.1 envelope Splunk IOC hunts · copy SPL → Suricata rules DNS RPZ Detection manifest

The ★ high-confidence feeds contain only indicators scoring ≥80 or reported by 2+ distinct publisher groups. Review indicators against your environment before applying blocking rules. All files come from the same SwiftIOC collector run that powers the live dashboard above.

The threat intelligence desk.