Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
79 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_c89c4b58b213548079Recent successful batchLast successful batch: Last attempt:
intelligence_src_c9021b111f15780880Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/55af7eb541f086c4e7d6d3182fb2bc4fbc2b9e21/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Cherry-pick suricata bpf fix and HOTFIX update by @TOoSmOotH in #15726 2.4.211 hotfix by @TOoSmOotH in #15731 Hotfix 2.4.211 by @TOoSmOotH in #15732 Full Changelog: 2.4.211-20260312...2.4.211-20260407
First reported Apr 07, 2026 17:24 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/d3c6fdce7e04cd981f1d3014af2ca35d0f8407f5/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Bump version from 3.1.0 to 3.2.0 by @TOoSmOotH in #15918 Add 3.2.0 option to discussion template by @TOoSmOotH in #15919 main to dev for hotfix by @TOoSmOotH in #15939 Remove outdated HOTFIX version number by @TOoSmOotH in #15940 Jertel/wip by @m0duspwnens in #15944 refactored soc config by @jertel in #15947 fix version by @jertel in #15949 check if there is a version or hotfix to upgrade to before verifiying elasticsearch compatibility by @reyesj2 in #15951 use so-config-backup script in soup by @reyesj2 in #15952 run elastic agent regen installer script in post_to_3.2.0 by @reyesj2 in #15954 config updates by @jertel in #15955 higstate on host start, not salt-minion start by @m0duspwnens in #15956 fix elasticsearch template generation issue by @reyesj2 in #15958 respect elasticfleet enable_auto_configuration setting for so-elastic… by @reyesj2 in #15961 use pipe exit status for update_docker_containers by @reyesj2 in #15964 remove startup states from salt config by @m0duspwnens in #15965 Jertel/wip by @jertel in #15967 update so-elastic-fleet-package-upgrade script by @reyesj2 in #15966 userid vs names by @defensivedepth in #15971 Data stream lifecycle management support by @reyesj2 in #15973 remove pillar merge by @reyesj2 in #15978 es|ql defaults by @jertel in #15974 add context to soup errors by @reyesj2 in #15979 Pin NIC names by MAC via udev (run-once) from the common state by @TOoSmOotH in #15970 don't create stack trace when set -e is disabled by @reyesj2 in #15982 wip by @m0duspwnens in #15983 Upgrade registry by @jertel in #15984 allow manager two full highstates during soup, improve elastic script runtime by @m0duspwnens in #15985 remove heayvnode FleetServer_* directory creation, and skip empty dir… by @reyesj2 in #16006 Fix premature fail_setup function call in so-setup by @triggerman86 in #16005 support multiple capinfos versions by @jertel in #16008 Add UEK8 kernel repo support across install and grid by @TOoSmOotH in #16000 Set transport for ssl.established:false logs by @defensivedepth in #16009 Switch boot default to UEK8 kernel and gate kernel repo on salt version by @TOoSmOotH in #16011 Serve /kernelrepo through nginx so minions can reach the kernel repo by @TOoSmOotH in #16012 update so-stop | so-start | so-restart scripts by @reyesj2 in #16013 soup upgrade kafka cluster metadata v4 by @reyesj2 in #16018 suricata: verify reloaded ruleset is newer than the rules file by @m0duspwnens in #16021 remove outdated eval script and associated salt utility state by @reyesj2 in #16024 update airgap soup to sync uek repo from iso by @reyesj2 in #16023 increase wait_for_so-kibana timeout to 10m by @reyesj2 in #16027 duplicate repo name in so-repo-sync by @reyesj2 in #16028 only reload suricata rules if all-rulesets.rules exists by @m0duspwnens in #16029 avoid setup failure reason ambiguity by @jertel in #16033 update default hunt query by @reyesj2 in #16035 support sigma playbooks by @defensivedepth in #16019 Add cluster_health option to telegraf.conf by @TOoSmOotH in #16039 Add repo names by @defensivedepth in #16041 Feature/agentic by @coreyogburn in #16030 recollate databases by @jertel in #16046 verify elastic-agent reports healthy status before completing install… by @reyesj2 in #16045 add missing so-logs-soc annotation by @reyesj2 in #16049 restart soc after re-initing db by @jertel in #16050 elastic fleet server persistence by @reyesj2 in #16052 exit so-setup early for issues with so-elastic-fleet-setup by @reyesj2 in #16055 toggle pg metrics by @jertel in #16058 status messages for so-elastic-fleet-setup by @reyesj2 in #16059 ES 9.3.7 by @reyesj2 in #16062 prevent login redirect to any API url by @jertel in #16064 soup: make failed upgrades and hotfixes resumable by @TOoSmOotH in #16069 Install UEK8 in so-kernel-upgrade when no UEK kernel is p
First reported Jul 29, 2026 18:12 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/141a61f5b53d44e647350ac2c4b48be1708fd807/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Version Bump by @TOoSmOotH in #15699 Update SOUP_BRANCH to use 3/main instead of 2.4/main by @TOoSmOotH in #15701 soup fix by @TOoSmOotH in #15702 pr/workflow changes by @jertel in #15704 Merge pr/workflow changes back to dev by @jertel in #15705 Fix JA4+ license link in soc_zeek.yaml by @TOoSmOotH in #15724 License Link to dev by @TOoSmOotH in #15725 ES 9.3.2 by @reyesj2 in #15727 foxtrot version by @reyesj2 in #15728 filestream integration policy updates by @reyesj2 in #15733 ensure max-files is 1 at minimum by @m0duspwnens in #15741 define options in annotation files by @m0duspwnens in #15745 Assistant: charsPerTokenEstimate by @mc-wright in #15742 rework elasticsearch index template generation by @reyesj2 in #15751 initialize vars by @reyesj2 in #15754 rework elasticsearch template load script -- for core templates by @reyesj2 in #15761 only append "-mappings" to component template names as needed by @reyesj2 in #15762 start loading addon integration index templates by @reyesj2 in #15763 elasticsearch ilm policy load script by @reyesj2 in #15764 3/dev by @reyesj2 in #15765 support minion node descriptions containing spaces by @jertel in #15766 ES 9.3.3 by @reyesj2 in #15768 enable elastic agent patch release for 9.3.3 by @reyesj2 in #15770 Improve test scenario for node descriptions by @jertel in #15769 soup to 3.1.0 by @reyesj2 in #15772 check for addon-index templates dir before attempting to load addon i… by @reyesj2 in #15775 ES 9.3.3 by @reyesj2 in #15776 supress noisy warning from ES 9.3.3 by @reyesj2 in #15780 add wait_for_so-elasticsearch state and split elasticsearch cluster c… by @reyesj2 in #15786 fix template annotation by @jertel in #15797 more error handling during image updates by @jertel in #15803 urlencode elasticsearch version by @reyesj2 in #15807 postgres follow-ups: fan manager cred + so-yaml.py replace fix by @TOoSmOotH in #15806 monitor raid for vms by @m0duspwnens in #15800 Fix soup by @TOoSmOotH in #15712 split up Elastic Fleet state by @reyesj2 in #15813 numeric test description by @jertel in #15822 typo by @reyesj2 in #15823 fix reinstall issue with salt by @m0duspwnens in #15824 readonly soc and kratos enabled by @m0duspwnens in #15828 heavynode should run es cluster state by @reyesj2 in #15826 fix reinstall by @m0duspwnens in #15829 exclude more transform job errors by @reyesj2 in #15833 fix sominion_setup reactor by @m0duspwnens in #15835 Add so-postgres Salt states and infrastructure by @TOoSmOotH in #15749 check current fleet policy cert against cert on disk by @reyesj2 in #15837 Fix/docker refresh multiarch pull by @TOoSmOotH in #15838 drop postgres module from soc defaults injection by @TOoSmOotH in #15839 Open postgres in DOCKER-USER firewall everywhere influxdb is open by @TOoSmOotH in #15840 so-elastic-fleet-outputs-update now checks for cert drift. Remove run… by @reyesj2 in #15842 update default elastic agent logging level to warning by @reyesj2 in #15844 reauthorize unhealthy transform jobs using kibana 9.3.3 auth flow by @reyesj2 in #15851 fleet package registry health check by @reyesj2 in #15857 Fix unsafe PyYAML load in filecheck by @TOoSmOotH in #15858 Ensure python3-pyyaml is installed before continuing setup by @TOoSmOotH in #15846 update grok type conversion to convert processor by @reyesj2 in #15864 Management bond1 by @TOoSmOotH in #15866 sanitize minion ids for hypervisor reactors / orchestration by @m0duspwnens in #15867 cleanup status code by @defensivedepth in #15872 proc_creation per OS type by @defensivedepth in #15875 New Sigma rules pipeline mapping for M365 and Fortigate by @marcopedrinazzi in #15579 Initial commit by @defensivedepth in #15880 add ingest latency metrics by @reyesj2 in #15878 use temp files to prevent jq arg too long by @reyesj2 in #15883 rename strelka ScanLNK - ScanLnk by @reyesj2
First reported May 21, 2026 19:45 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/2cde9abec26bb2d5a00fab1459c0813b26aaf563/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Bump version from 3.2.0 to 3.3.0 by @TOoSmOotH in #16126 nginx configuration improvements by @jertel in #16133 fix template collation mismatches by @jertel in #16142 add some extra logging to so-minion log by @reyesj2 in #16147 Use newer /api/joblookup endpoint by @jertel in #16149 remove thehive scripted field from kibana saved objects by @reyesj2 in #16146 allow airgap installs to reuse previously extracted docker images by @reyesj2 in #16148 exclude test log WARNs by @jertel in #16150 Fix Telegraf metrics falling into pg_partman default partitions by @TOoSmOotH in #16143 soup: push a grid-wide highstate to remote nodes after upgrade by @m0duspwnens in #16151 more exclusions due to preproc refactor by @jertel in #16152 Lower default auto_apply batch size to 10% by @m0duspwnens in #16153 Run zeekctl cron so LogExpireInterval and the other expire settings take effect by @m0duspwnens in #16159 Add fp check by @defensivedepth in #16160 Add another pcap job fp by @defensivedepth in #16161 Disable the Zeek stats log by @m0duspwnens in #16162 Agentic: Agent Studio Salt Annotations by @mc-wright in #16158 patch issue with fs.protected_symlinks by @reyesj2 in #16165 FIX: enable so-boot-highstate.service on non-manager nodes by @m0duspwnens in #16170 Update Sigma template by @defensivedepth in #16175 FEATURE: Allow for tuning multiple Logstash pipelines in SOC by @m0duspwnens in #16180 Expose Logstash log.level and log.format in SOC by @m0duspwnens in #16182 Cogburn/memory by @coreyogburn in #16187 add vector ext for agentic memory by @jertel in #16189 Remove the stock EL9 kernel once a node is running UEK8 by @TOoSmOotH in #16188 Use argv arrays for telegraf inputs.exec commands by @TOoSmOotH in #16192 Memory and Reconcile Persona Annotations by @mc-wright in #16191 Detect hand-placed local/salt files in Auto State Apply by @m0duspwnens in #16194 Revert "patch issue with fs.protected_symlinks" by @reyesj2 in #16195 fix well-known paths by @jertel in #16199 add log rotation for hypervisor logs by @m0duspwnens in #16200 UPGRADE: Elasticsearch 9.4.5 by @reyesj2 in #16190 fix salt batching command by @reyesj2 in #16201 Cogburn/memory metrics by @coreyogburn in #16203 Fix Regex by @coreyogburn in #16205 Define ToolTurn Defaults by @coreyogburn in #16206 Run estshoot if cluster is not green by @defensivedepth in #16207 Batch Size and Retries by @coreyogburn in #16209 Fix soup by @defensivedepth in #16210 drop remapped sentinel_one_cloud_funnel.login index template by @reyesj2 in #16212 3.3.0 by @TOoSmOotH in #16213 3.3.0 by @TOoSmOotH in #16214 3.3.0 by @TOoSmOotH in #16215 Full Changelog: 3.2.0-20260729...3.3.0-20260908
First reported Sep 08, 2026 19:02 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/2131e7d45087c39cb15c4aa12b8f631c23d51d24/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Add version number to HOTFIX file by @TOoSmOotH in #15924 use multiple or combined input by @reyesj2 in #15925 check for stale logstash pipeline name in local pillar by @reyesj2 in #15930 keep logstash lumberjack pipeline name update unified by @reyesj2 in #15934 3.1.0 hotfix by @TOoSmOotH in #15936 Full Changelog: 3.1.0-20260521...3.1.0-20260528
First reported May 28, 2026 14:30 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/79b30e43d9a0c553a87cbcf24ed4c44c58fad925/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Add date to HOTFIX file by @TOoSmOotH in #15570 Bump version from 2.4.210 to 2.4.211 by @TOoSmOotH in #15582 fix enable/disable suricata pcap by @m0duspwnens in #15583 remove 10T virtual disk limit. URL_BASE to vm hosts file by @m0duspwnens in #15584 clear HOTFIX file by @m0duspwnens in #15588 Add support for version 2.4.211 in soup script by @TOoSmOotH in #15586 set container ulimits to default by @m0duspwnens in #15593 2.4.211 by @TOoSmOotH in #15597 Full Changelog: 2.4.210-20260302...2.4.211-20260312
First reported Mar 12, 2026 17:24 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Download the ISO https://github.com/Security-Onion-Solutions/securityonion/blob/a9d2be8131ac1cf7eb5ee175c1eab20da8cd2b18/DOWNLOAD_AND_VERIFY_ISO.md What's Changed Update VERSION by @TOoSmOotH in #15320 Un-Advanced Assistant ApiUrl by @coreyogburn in #15323 expose login form lifespan in config scr by @jertel in #15347 update kratos index template by @reyesj2 in #15353 exempt kratos online check by @jertel in #15358 suppress config diffs to avoid false positive errors by @jertel in #15359 Assistant: Session Report Template by @mc-wright in #15355 ES 9.0.8 by @reyesj2 in #15363 Case Report Update for AI Session Attachments by @mc-wright in #15367 Add version 2.4.201 to discussion template by @jertel in #15389 Fixmerge201210 by @m0duspwnens in #15390 2.4.201 into dev by @TOoSmOotH in #15387 follow symlinks for docker cp by @reyesj2 in #15391 add additional retries within scripts before salt re-runs the entire … by @reyesj2 in #15393 remove usage of deprecated 'logs' integration in favor of 'filestream' by @reyesj2 in #15394 Fstes by @m0duspwnens in #15397 break out ssl state by @m0duspwnens in #15400 allow logstash.ssl for eval and import. fix soup create_ca_pillar by @m0duspwnens in #15402 create dir if nonexistent by @m0duspwnens in #15405 reinstall agent on grid nodes when service wasn't cleanly removed. eg… by @reyesj2 in #15404 fix include by @m0duspwnens in #15406 more better by @reyesj2 in #15407 fix kafka state by @reyesj2 in #15408 fix auto soup - check for compatible versions and fallback to a known… by @reyesj2 in #15410 add retries to so-resources repo pull by @reyesj2 in #15411 missing updates to variables by @reyesj2 in #15412 ignore kratos file mapping error by @reyesj2 in #15414 exclude known error by @reyesj2 in #15420 update redis log file path by @reyesj2 in #15424 update heavynode's elastic-agent standalone policy by @reyesj2 in #15418 include all so-grid-nodes_* policies in automatic EA upgrades by @reyesj2 in #15435 run fleet ssl state in fleet.config to ensure all required certs are … by @reyesj2 in #15436 ensure exclude_files excludes log rotation pattern by @reyesj2 in #15438 initialize specific indices as needed by @reyesj2 in #15442 use logstash merged values for logstash metric collection by @reyesj2 in #15447 keep logsdb disabled by @reyesj2 in #15448 Cogburn/gemini by @coreyogburn in #15443 allow network installs to use ISO for faster soupin by @reyesj2 in #15465 don't set is_airgap when using nonairgap_useiso: not a true airgap sy… by @reyesj2 in #15468 default roles by @jertel in #15472 Remove QWEN 235B model from defaults.yaml by @TOoSmOotH in #15473 clarify url_base description by @jertel in #15482 Config Tweaks for AI by @coreyogburn in #15481 Upgrade Salt 3006.19 by @m0duspwnens in #15491 fix sensor and heavynode first highstate failure by @m0duspwnens in #15494 Revert "don't set is_airgap when using nonairgap_useiso: not a true airgap sy…" by @reyesj2 in #15496 Revert "allow network installs to use ISO for faster soupin" by @reyesj2 in #15497 Assistant: Investigated Query Toggle Filter by @mc-wright in #15492 upgrade docker by @m0duspwnens in #15500 Add OpenAI Protocols by @coreyogburn in #15501 rework autosoup for intermediate upgrades by @reyesj2 in #15499 upgrade docker by @m0duspwnens in #15506 healthTimeoutSeconds should be an int by @coreyogburn in #15507 upgrade docker by @m0duspwnens in #15509 New so-yaml.py Functions for Gemini Cypress Test Support by @mc-wright in #15505 upgrade docker by @m0duspwnens in #15510 migrate managed_integrations pillar by @reyesj2 in #15503 upgrade analyzer deps by @reyesj2 in #15511 fix consecutive comments by @m0duspwnens in #15513 fix soup failure if salt-relay isn't running by @m0duspwnens in #15519 Add Support for upgrading to 3.0 by @TOoSmOotH in #15517 Rename model ID from 'sonnet-4.5' to 'sonnet' by @TOoSmOotH in #15522 fix field conflicts by @reyesj2 in #15524 fix suricata filestream dataset by @reyesj2 in #15523 fix agentstatus scrip
First reported Mar 02, 2026 20:07 UTCCatalog metadata updated Oct 16, 2026 16:37 UTCOpen evidence record
Details about the Hugging Face hack, critical infrastructure under attack, a spoofed in-flight Wi-Fi network, and more of this month's cybersecurity news
First reported Aug 31, 2026 08:55 UTCCatalog metadata updated Oct 16, 2026 16:35 UTCOpen evidence record
Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.
First reported Oct 12, 2026 09:00 UTCCatalog metadata updated Oct 16, 2026 16:35 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.