{% extends "base.html" %} {% block title %}Threat Intel · SD RMM{% endblock %} {% block content %} {% include "_security_nav.html" %}

Threat Intelligence

Open IOC feeds matched against agent telemetry (file hashes, destination IPs/domains). {% if saved %}refreshed ✓{% endif %}

‹ Security
{{ "{:,}".format(stats.total) }}
Total IOCs
{{ "{:,}".format((stats.by_type.get('hash_sha256',0)) + (stats.by_type.get('hash_md5',0)) + (stats.by_type.get('hash_sha1',0))) }}
Malware hashes
{{ "{:,}".format((stats.by_type.get('url',0)) + (stats.by_type.get('domain',0))) }}
Bad URLs / domains
{{ "{:,}".format(stats.by_type.get('ip',0)) }}
Bad IPs (C2)

Feeds

{% for f in feeds %} {% endfor %}
FeedSourceIOCsLast fetched (PT)Status
{{ f.name }} {{ f.desc }} {{ "{:,}".format(f.count) }} {% if f.last_fetched %}{{ f.last_fetched| pt('%Y-%m-%d %H:%M') }}{% else %}—{% endif %} {% if f.status == 'ok' %}ok{% elif f.status and f.status.startswith('error') %}error{% else %}{{ f.status }}{% endif %}{% if not f.enabled %} (disabled){% endif %}

By type / source

By type

{% for t, c in stats.by_type.items() %}{{ t }} {{ "{:,}".format(c) }}{% endfor %} {% if not stats.by_type %}none yet{% endif %}

By source

{% for s, c in stats.by_source.items() %}{{ s }} {{ "{:,}".format(c) }}{% endfor %} {% if not stats.by_source %}none yet{% endif %}

Sources: abuse.ch (Feodo, URLhaus, ThreatFox, MalwareBazaar) — free, community-standard threat-intel feeds, auto-refreshed every 6 hours. Coverage is each feed's recent/online window; full historical dumps would need a free abuse.ch Auth-Key. A match raises a critical “known malware / known-bad infrastructure” detection on the device, alongside the behavioural Sigma rules.

{% endblock %}