Observed sources. Transparent context.
Hunt where these source IPs appear in your own telemetry. Wazuh alerts, reputation and catalog membership guide investigation; none independently establishes exploitation or compromise.
At a glance
UTC batch metrics; the most recent completed run may be the preceding scheduled cycle.
Alert volume · last 7 days
Exact Wazuh Indexer count; daily buckets from the same query (first/last calendar days may be partial).
Per-agent totals are private.
Top observed source IPs
Full MISP membership will be checked when data loads.
| Loading sources… |
On small screens, scroll horizontally to read every column.
Checking the separate 24-hour pipeline source limit…
Recently updated MISP attributes
Shows up to 12 of 30 recent-attribute previews; not the full Event 1932 list.
Pipeline runs
Completed prior cycles; operational health is not incident status.
From observation to decision
The public feed is a review queue, not a confirmed-incident or automatic-blocking feed.
Explaining why the public watchlist is smaller than MISP…
1 · Observe
Match a source against your own UTC telemetry. Counts and catalog membership are leads, not verdicts.
2 · Corroborate privately
Check the original rule, affected asset, authentication/process outcomes and a bounded NDR time window. Missing enrichment is not a benign result.
3 · Analyst decision
Record rationale, evidence reference and expiry before enabling an IDS indicator. New automated MISP attributes start with IDS use disabled; legacy flags still need review.
4 · Respond with approval
Only verified outcomes justify an incident or containment decision. Case state and victim details are not published here.
Use this intelligence
Public lookups and review-only feeds. Detailed evidence requires authorized access.