Which delivery formats are supported?

STIX 2.1 bundles, a TAXII 2.1 server, Sigma rules converted to Splunk SPL, Microsoft Sentinel KQL or QRadar AQL, and plain-text EDLs for firewalls, the EDL filterable by confidence and severity. Delivery feeds are part of the Enterprise tier.

How do you keep the feed from going stale?

Every campaign carries a churn score that tracks how fast its infrastructure rotates, and every indicator a confidence score with first- and last-seen dates. You can pull only high-confidence active indicators, or the "expiring soon" set, so what reaches your blocklist is live rather than historical.

Can I use Malveine without the feeds?

Yes. The console (campaign pages, indicator search, analytics) is open on every tier, like every window but Sours. Feeds are the Enterprise-tier layer on top.

MODULE 04 · Threat Intel Console & FeedsFeed delivery: Enterprise tier

Does your threat intelligence live in a PDF, or in a rule?

Malveine is the operational end of the platform: malware campaigns scored by how fast their infrastructure churns, confidence-rated indicators carrying ASN and geography, MITRE and KEV context, delivered in the formats your stack actually runs.

See Malveine in a demo See pricing

01Capabilities

What Malveine sees

Built to run

STIX 2.1 bundles, a TAXII 2.1 server, and Sigma rules converted on demand to Splunk SPL, Microsoft Sentinel KQL or QRadar AQL, plus plain-text EDL blocklists you filter by confidence and severity. Your SOC consumes intelligence without a human copy-pasting indicators.

Campaigns and indicators, correlated

Every indicator arrives attached to its campaign, and every campaign carries its MITRE ATT&CK techniques, the CVEs it exploits (flagged when they are on CISA KEV), a severity, and a live sighting timeline. An IoC never reaches you as a bare string.

Freshness, scored

Each campaign gets a churn score for how fast its infrastructure rotates, and each indicator a confidence score with first- and last-seen dates. Sort by what is heating up, pull only what is about to expire, and feed your stack live intelligence instead of a graveyard.

Geography & ASN analytics

Each indicator resolves to its ASN, hosting organization and country; the aggregates show which networks recur and how targeting shifts. You learn where the infrastructure lives, as well as what it is.

The aggregate view

Infrastructure habits outlive campaigns

Six recent campaigns against the ASNs their infrastructure sat on: the same three networks keep coming back. This recurrence layer is the analytics behind every indicator Malveine ships, so you can block the habit rather than the single address.

CAMPAIGNS × ASN · TRAILING 90 DAYS

sample data · ASNs masked

CAMPAIGN

AS··41

AS··09

AS··23

AS··77

AS··18

AS··65

C-2607 · stealer delivery

→ finance

C-2605 · phishing kit

→ e-commerce

C-2604 · loader / C2

→ telecom

C-2602 · ransomware staging

→ logistics

C-2601 · C2 proxy layer

→ public sector

C-2598 · smishing wave

→ finance

SEEN IN … OF 6

×5

×4

×3

×2

×1

RECURRING ASN · ≥3 CAMPAIGNS SEEN ONCE OR TWICE

THREE NETWORKS CARRY FIVE OF SIX CAMPAIGNS

The geography

Where hostile infrastructure actually sits

Live indicator counts by hosting country, k-anonymised at the source: countries under the naming threshold fold into a single line rather than being named. Attacker infrastructure only; victim geography is never shown.

HOSTILE INFRASTRUCTURE BY COUNTRY

sample

US2,100

DE940

NL720

RU660

CN610

ATTACKER INFRASTRUCTURE ONLY · VICTIM GEOGRAPHY IS NEVER SHOWN

COUNTS FLOORED · SUB-THRESHOLD COUNTRIES FOLD, NOT NAMED

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/malveine/delivery/stix

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  -H "Accept: application/stix+json;version=2.1" \
  "https://console.generalintels.com/api/malveine/delivery/stix\
?severity=HIGH,CRITICAL&min_confidence=70"

RESPONSE · 200

{
  "type": "bundle",
  "id": "bundle--8f1c••••",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a7e••••",
      "created": "2026-07-10T04:02:11.000Z",
      "name": "••••••.top",
      "pattern": "[domain-name:value = '••••••.top']",
      "pattern_type": "stix",
      "indicator_types": ["malicious-activity"],
      "confidence": 84,
      "valid_from": "2026-07-10T00:00:00.000Z"
    },
    { "type": "malware", "spec_version": "2.1", "id": "malware--c04d••••",
      "name": "••••Stealer", "is_family": true },
    { "type": "relationship", "spec_version": "2.1",
      "relationship_type": "indicates",
      "source_ref": "indicator--3a7e••••", "target_ref": "malware--c04d••••" }
  ]
}

Active indicators only, with their campaign as a Malware object and an "indicates" relationship between them. STIX 2.1, TAXII 2.1, Sigma (SPL/KQL/AQL) and EDL delivery are an Enterprise-tier capability.

Full API reference ships with your workspace: every endpoint, versioned.

03In practice

Indicator to blocklist, no humans harmed

11:02

A stealer-delivery campaign targeting banks is confirmed and published in Malveine.

11:03

Your TAXII subscription pulls the new STIX bundle automatically.

11:05

The EDL endpoint updates; your firewall ingests the new domains on its next poll.

11:20

Sigma rules land in your SIEM repo as a merge request. An analyst reviews it, the only human step in the chain by design.

Questions

Malveine, honestly answered

Keep exploring

The other windows

Platform overview

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

Request a demo Explore the platform

NDA-friendly briefings · global coverage · no slideware