Skip to main content

Intelligence Update Queue

This page summarizes the latest no-key public CTI feed pull. It is a review queue, not an automatic source of truth.

Feed candidates must be reviewed before they are promoted into data/sources.csv, actor profiles, evidence records, TTP mappings, hunts, or detections.

Generated: 2026-06-22

Connected Feeds​

  • MITRE ATT&CK Enterprise STIX: actor taxonomy and modified-date drift checks.
  • CISA Known Exploited Vulnerabilities: exposure-prioritization leads.
  • CISA Cybersecurity Advisories RSS: new government advisory leads.
  • Optional: OTX subscribed pulses when OTX_API_KEY is configured.
  • Optional: MISP and OpenCTI connector targets when trusted instance secrets are configured.

Summary​

MetricValue
Total candidates29
FEED-CISA-ADVISORIES candidates10
FEED-CISA-KEV candidates1
FEED-MISP-OPTIONAL candidates1
FEED-MITRE-ATTACK-ENTERPRISE candidates15
FEED-OPENCTI-OPTIONAL candidates1
FEED-OTX-OPTIONAL candidates1
Needs analyst review25
Needs exposure review1
Not configured3

Candidate Review Rules​

  • Treat feed items as collection leads until a human analyst reviews source relevance.
  • Do not create actor attribution from KEV or surface matches alone.
  • Use CISA KEV matches for exposure review and asset-owner routing first.
  • Use MITRE matches to check alias, description, and technique drift.
  • Add a normal source/evidence record before changing an actor page or detection mapping.

Actor Update Candidates​

ActorCandidatesFeedsLatest candidate date
G00491FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
G00591FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
G00691FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
G00871FEED-MITRE-ATTACK-ENTERPRISE2024-04-11
G10011FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
G10281FEED-MITRE-ATTACK-ENTERPRISE2024-11-17
G10301FEED-MITRE-ATTACK-ENTERPRISE2024-08-29
G10441FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
HANDALA1FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
IMPERIALKITTEN1FEED-MITRE-ATTACK-ENTERPRISE2024-10-02
LEBANESECEDAR1FEED-MITRE-ATTACK-ENTERPRISE2025-04-16
PIONEERKITTEN1FEED-MITRE-ATTACK-ENTERPRISE2026-05-12
TA4022FEED-MITRE-ATTACK-ENTERPRISE2025-04-18
WIRTE1FEED-MITRE-ATTACK-ENTERPRISE2026-04-23

Surface And Exposure Candidates​

Candidate TypeCandidatesFeedsMatched terms
Government advisory10FEED-CISA-ADVISORIEScheck point, fortinet, hmi, ivanti, rockwell
Known exploited vulnerability1FEED-CISA-KEVivanti
Optional connector status3FEED-MISP-OPTIONAL, FEED-OPENCTI-OPTIONAL, FEED-OTX-OPTIONALNone

Current Candidates​

CandidateFeedActorTypeTitleDateStatus
UPD-CISA-ADV-SURFACE-b687e1a326FEED-CISA-ADVISORIESSurfaceGovernment advisoryCISA Adds One Known Exploited Vulnerability to CatalogThu, 11 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-718ab308d6FEED-CISA-ADVISORIESSurfaceGovernment advisoryCISA Adds Two Known Exploited Vulnerabilities to CatalogMon, 08 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-ca68a80872FEED-CISA-ADVISORIESSurfaceGovernment advisoryCISA Urges Hardening Fortinet Devices After Reports of Credential ExposureThu, 18 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-d277e9bf8cFEED-CISA-ADVISORIESSurfaceGovernment advisoryRockwell Automation CompactLogixTue, 16 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-59af5c3f01FEED-CISA-ADVISORIESSurfaceGovernment advisoryRockwell Automation FLEX I/O EtherNet/IP AdaptersTue, 16 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-0d2a248ba7FEED-CISA-ADVISORIESSurfaceGovernment advisoryRockwell Automation FactoryTalk Analytics PavilionXTue, 16 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-b230769980FEED-CISA-ADVISORIESSurfaceGovernment advisoryRockwell Automation FactoryTalk Historian Site EditionThu, 18 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-790a63ac4cFEED-CISA-ADVISORIESSurfaceGovernment advisoryRockwell Automation Logix 5370 & 5570 Controllers Vulnerable To Denial of Service Via CIPTue, 16 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-a532b41623FEED-CISA-ADVISORIESSurfaceGovernment advisoryRockwell Automation RSLinx Tue, 16 Jun 26 12:00:00 +0000Needs analyst review
UPD-CISA-ADV-SURFACE-a4eb115e85FEED-CISA-ADVISORIESSurfaceGovernment advisorySchneider Electric Modicon Network Managed SwitchesTue, 09 Jun 26 12:00:00 +0000Needs analyst review
UPD-KEV-CVE-2026-10520FEED-CISA-KEVSurfaceKnown exploited vulnerabilityCVE-2026-10520 - Ivanti Sentry OS Command Injection Vulnerability2026-06-11Needs exposure review
UPD-CONNECTOR-FEED-MISP-OPTIONALFEED-MISP-OPTIONALSurfaceOptional connector statusMISP events2026-06-22Not configured
UPD-MITRE-G0049-60c08f71f0FEED-MITRE-ATTACK-ENTERPRISEG0049ATT&CK intrusion-set taxonomy updateOilRig2026-05-12Needs analyst review
UPD-MITRE-G0059-2eecb5256cFEED-MITRE-ATTACK-ENTERPRISEG0059ATT&CK intrusion-set taxonomy updateMagic Hound2026-05-12Needs analyst review
UPD-MITRE-G0069-03689cb0daFEED-MITRE-ATTACK-ENTERPRISEG0069ATT&CK intrusion-set taxonomy updateMuddyWater2026-05-12Needs analyst review
UPD-MITRE-G0087-01a9c7eebfFEED-MITRE-ATTACK-ENTERPRISEG0087ATT&CK intrusion-set taxonomy updateAPT392024-04-11Needs analyst review
UPD-MITRE-G1001-14a09dbf66FEED-MITRE-ATTACK-ENTERPRISEG1001ATT&CK intrusion-set taxonomy updateHEXANE2026-05-12Needs analyst review
UPD-MITRE-G1028-581b0024c5FEED-MITRE-ATTACK-ENTERPRISEG1028ATT&CK intrusion-set taxonomy updateAPT-C-232024-11-17Needs analyst review
UPD-MITRE-G1030-e96f8e578dFEED-MITRE-ATTACK-ENTERPRISEG1030ATT&CK intrusion-set taxonomy updateAgrius2024-08-29Needs analyst review
UPD-MITRE-G1044-e3ed64de89FEED-MITRE-ATTACK-ENTERPRISEG1044ATT&CK intrusion-set taxonomy updateAPT422026-05-12Needs analyst review
UPD-MITRE-HANDALA-72d63c6f04FEED-MITRE-ATTACK-ENTERPRISEHANDALAATT&CK intrusion-set taxonomy updateVOID MANTICORE2026-05-12Needs analyst review
UPD-MITRE-IMPERIALKITTEN-bbb6cea576FEED-MITRE-ATTACK-ENTERPRISEIMPERIALKITTENATT&CK intrusion-set taxonomy updateCURIUM2024-10-02Needs analyst review
UPD-MITRE-LEBANESECEDAR-872e0d8dcfFEED-MITRE-ATTACK-ENTERPRISELEBANESECEDARATT&CK intrusion-set taxonomy updateVolatile Cedar2025-04-16Needs analyst review
UPD-MITRE-PIONEERKITTEN-03d5c9032eFEED-MITRE-ATTACK-ENTERPRISEPIONEERKITTENATT&CK intrusion-set taxonomy updateFox Kitten2026-05-12Needs analyst review
UPD-MITRE-TA402-976749cc0aFEED-MITRE-ATTACK-ENTERPRISETA402ATT&CK intrusion-set taxonomy updateFrankenstein2025-04-18Needs analyst review
UPD-MITRE-TA402-65b917d7e7FEED-MITRE-ATTACK-ENTERPRISETA402ATT&CK intrusion-set taxonomy updateMolerats2024-11-17Needs analyst review
UPD-MITRE-WIRTE-7cc1aa86dbFEED-MITRE-ATTACK-ENTERPRISEWIRTEATT&CK intrusion-set taxonomy updateWIRTE2026-04-23Needs analyst review
UPD-CONNECTOR-FEED-OPENCTI-OPTIONALFEED-OPENCTI-OPTIONALSurfaceOptional connector statusOpenCTI indicators and reports2026-06-22Not configured
UPD-CONNECTOR-FEED-OTX-OPTIONALFEED-OTX-OPTIONALSurfaceOptional connector statusAlienVault OTX pulses2026-06-22Not configured

Machine-readable queue: data/intel-update-candidates.csv.

Feed definitions: data/intel-feeds.csv.