- These IOC's are focusing only on the COVID-19 and they are updated every 2 days, so in case you have been using old IOC's, you can chose to clear the entries and input new values from the feeds from SCAN TITAN.

Also, all the rules are configured to trigger on the first match, so if you have observed false positives then please report back with details, I have have them updated so everyone can benefit from the same.

Thanks

We had the feeds ingested before, and found that the ScanTitan indicators, mostly IP addresses, were causing a lot of false positives, as they also contained CDN IPs, not very high fidelity. The others will of course be better.

  - Yes, your correct.

The content is to help those who dont have MISP setup yet. 

Also, the content may be leveraged to verify both MISP lists and the lists within this package by few customization.

Nice,

However I prefer if we can import these data into MISP Circl, thus we don't need to create or change anything on the ESM