IOC Export Guide

Supported Export Formats

CSV

Standard tabular format. Most broadly compatible.

indicator,type,first_seen,last_seen,confidence,access_level,claim_support,tlp,source,source_url,context,mitre_attack,tags
203.0.113.42,ipv4-addr,2026-01-15,2026-03-20,70,direct,firm,GREEN,"Mandiant report MAL-2026-001",https://vendor.example.com/mal-2026-001,C2 server for SUNBURST variant,T1071.001,"apt29;sunburst"
evil.example.com,domain-name,2026-02-01,2026-03-20,50,limited,tentative,GREEN,"Internal analysis",,"Phishing landing page",T1566.002,"phishing;apt29"

Column definitions:

A row is one claim about one indicator. If two primaries make different assertions about the same value, that is two rows, each with its own grade.

STIX 2.1 Bundle

See stix-bundle skill for full specification, including which object carries confidence (never the SCO), the x_liberty91_access_level and x_liberty91_claim_support properties and a worked example.

OpenIOC (XML)

Mandiant's legacy IOC format. Still used by some tools.

<?xml version="1.0" encoding="utf-8"?>
<ioc xmlns="http://schemas.mandiant.com/2010/ioc" id="[UUID]" last-modified="YYYY-MM-DDT00:00:00">
  <short_description>IOC Title</short_description>
  <description>Description</description>
  <authored_by>CTI Platform</authored_by>
  <authored_date>YYYY-MM-DDT00:00:00</authored_date>
  <definition>
    <Indicator operator="OR" id="[UUID]">
      <IndicatorItem id="[UUID]" condition="is">
        <Context document="Network" search="Network/DNS" type="mir"/>
        <Content type="string">evil.example.com</Content>
      </IndicatorItem>
      <IndicatorItem id="[UUID]" condition="is">
        <Context document="FileItem" search="FileItem/Md5sum" type="mir"/>
        <Content type="md5">abc123...</Content>
      </IndicatorItem>
    </Indicator>
  </definition>
</ioc>

MISP Format (JSON)

For import into MISP instances.

{
  "Event": {
    "info": "IOC collection: [context]",
    "threat_level_id": "2",
    "analysis": "2",
    "distribution": "1",
    "Tag": [
      {"name": "tlp:green"},
      {"name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\""}
    ],
    "Attribute": [
      {
        "type": "ip-dst",
        "category": "Network activity",
        "value": "203.0.113.42",
        "to_ids": true,
        "comment": "C2 server",
        "Tag": [
          {"name": "cti-skills:access-level=\"direct\""},
          {"name": "cti-skills:claim-support=\"firm\""},
          {"name": "misp:confidence-level=\"usually-confident\""}
        ]
      },
      {
        "type": "domain",
        "category": "Network activity",
        "value": "evil.example.com",
        "to_ids": true,
        "comment": "Phishing landing page",
        "Tag": [
          {"name": "cti-skills:access-level=\"limited\""},
          {"name": "cti-skills:claim-support=\"tentative\""},
          {"name": "misp:confidence-level=\"fairly-confident\""}
        ]
      }
    ]
  }
}

Grades on export

Applies when the IOCs come with evidence items from /quality-of-information-check. Grades are exported per claim, never per event: each indicator carries the grade of the claim it came from.

The evidence grade is two words, access level and claim support. It is not the Admiralty scale and is never exported under Admiralty labels. Admiralty ratings apply to lookup results and single items; the evidence grade applies to claims from documents; neither is converted into the other.

The STIX values are the pack's own mapping, chosen to sit inside the bands of /confidence-levels (High 80 to 100, Moderate 60 to 79, Low 40 to 59). The MISP confidence tag is derived from claim support. It is not a separate judgement.

MISP tags, at attribute level. Each attribute gets three tags:

• cti-skills:access-level="direct", or "limited", "indirect", "untraced", "adversary"
• cti-skills:claim-support="established", or "firm", "tentative", "disputed", "unverified"
• the misp:confidence-level tag from the table

The cti-skills: tags are plain tags. They belong to no MISP taxonomy. Do not tag graded claims with the admiralty-scale taxonomy. The misp:confidence-level strings were verified on 2026-09-27 against misp/machinetag.json (version 14) in github.com/MISP/misp-taxonomies.

Event-level tags. Optional. If set, they are the weakest link, the grade of the lowest-graded load-bearing claim, never an average. They are there for consumers that filter on event tags. The attribute tags are the record.

Pushing to MISP. The target instance needs the misp taxonomy enabled, and the account needs permission to create the cti-skills: tags if they do not exist yet. /lookup-misp add-attribute --tags applies them per attribute. Quote the whole list for the shell, since the tag names contain double quotes and commas separate tags. Do not rely on upload-stix to turn STIX confidence into these tags. That conversion is not verified here, so tag the attributes explicitly.

Import. Reading graded data in, a STIX confidence or a misp:confidence-level tag becomes claim support with the table below. An imported value never gives established, since that level needs counted independent primaries (rubric rule R5).

Access level for an imported item is indirect unless the primary is resolved. The item is flagged derived_from_confidence, so /quality-of-information-check re-grades it when a primary is available (rubric rule R11).

An Admiralty rating that arrives on imported data, for example admiralty-scale tags set by another organisation, is kept as that party's Admiralty rating and shown as such. It is not converted into an evidence grade.

Ungraded IOCs. Without evidence items, set confidence per the confidence-levels skill and leave the access_level and claim_support columns and the cti-skills: tags off. Do not invent a grade to fill the column.

MISP Attribute Types

Export Workflow

1. Collect all IOCs from the investigation/analysis
2. Deduplicate (same indicator + same type = one entry)
3. Validate format (IP regex, hash length, URL format)
4. Apply TLP marking (inherit from source or set explicitly)
5. Set confidence: from the claim's grade when evidence items exist (see Grades on export), otherwise per the confidence-levels skill
6. Attach the primary source to each indicator (source, URL)
7. Generate export in requested format
8. Write to data/exports/YYYY-MM-DD-<context>.<format>

Output Location

Write exports to: data/exports/

• CSV: YYYY-MM-DD-<context>.csv
• STIX: data/stix-bundles/YYYY-MM-DD-<context>.json
• OpenIOC: YYYY-MM-DD-<context>.ioc
• MISP: YYYY-MM-DD-<context>.misp.json