You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
bad endpoint in misp_modules/modules/expansion/intel471.py #796
From my own observations, the /v1/ioc endpoint seems to only contain a small subset of IOCs only the IOCs in Intel471's intelligence reports, not data from other data streams on their platform (Malware, Sources, News, Search, etc.). /v1/indicators or /v1/search seem to hit a much larger set of IOCs, similar to using the search function on their platform. /v1/search might be the better option.
I don't know if this result is from a change in the API, or a design choice for the module to only use adversary reports. But I can say from our use case, this module returns primarily "Nothing has been found" on every IOC in our MISP, even though there is data about the IOC on Intel471's platform if i use the search function.
Activity
adulau commentedon Aug 11, 2026
Did Intel471 change their API recently?
MathiasVbech commentedon Aug 11, 2026
I do not know if the API changed recently.
From my own observations, the /v1/ioc endpoint seems to only contain a small subset of IOCs only the IOCs in Intel471's intelligence reports, not data from other data streams on their platform (Malware, Sources, News, Search, etc.). /v1/indicators or /v1/search seem to hit a much larger set of IOCs, similar to using the search function on their platform. /v1/search might be the better option.
I don't know if this result is from a change in the API, or a design choice for the module to only use adversary reports. But I can say from our use case, this module returns primarily "Nothing has been found" on every IOC in our MISP, even though there is data about the IOC on Intel471's platform if i use the search function.
adulau commentedon Oct 26, 2026
Can you test the draft PR #1008 ? before I merge it. Thanks a lot.