isipsafe

OpenCTI

Import the list as STIX 2.1 indicators.

The blocklist is available as a STIX 2.1 bundle: one indicator per address, with the confidence score, category codes as labels, and a link back to the address page. OpenCTI imports it natively.

One-off import

  1. Download the bundle: 
    curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=stix&confidenceMinimum=90" -o isipsafe.stix.json
  2. In OpenCTI, go to Data › Import, upload the file and import it with the STIX file connector.

Keep it in sync

A short script with pycti, run from cron every few hours:

import os, requests
from pycti import OpenCTIApiClient

bundle = requests.get(
    "https://isipsafe.com/api/v1/blocklist",
    params={"key": os.environ["ISIPSAFE_KEY"], "format": "stix", "confidenceMinimum": 90},
    timeout=60,
).text

client = OpenCTIApiClient(os.environ["OPENCTI_URL"], os.environ["OPENCTI_TOKEN"])
client.stix2.import_bundle_from_json(bundle, update=True)

Indicator IDs are stable (derived from the address), so repeated imports update the same indicators instead of creating duplicates.

Need a hand?

If something here does not work with your version of OpenCTI, or you have improved it, tell us. We update these pages with what people send.

OpenCTI and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.