Curation and indicators

Malware verdicts come from the Vulnetix VDB pipeline and from your own malscan runs. Curation is how a person overrules them. It happens in the console, on two pages:

Page	Use it to
Malware	See the malicious packages in your dependencies, with the advisory and threat actor behind each, and record a decision from the finding.
Malware curation	Configuration group. Tabs: Decisions (every decision, with change and retract), Indicators (your organisation’s own IOCs, and a read-only list of the ones your malscan runs found), Activity (the audit log).

Any signed-in member of the organisation can use both pages, on any plan including Community. Every query is scoped to your organisation.

Decisions

A decision is a verdict on one subject:

Verdict	Meaning
false_positive	This is not malware.
confirmed	This is malware. Recorded for your organisation; it does not raise a verdict for others.

You can only decide on a subject your organisation has met. The API checks this before writing and returns 403 otherwise.

Subject	Your organisation must have	Effect of a false positive	Reach
Package version	Scanned the package (ecosystem and name) with the CLI	Consensus fp_cleared	Every customer
Indicator (type and value)	Owned the IOC, or a malicious finding on the advisory it belongs to	Consensus fp_cleared; the indicator is disabled	Every customer
Threat actor	A malicious finding on an advisory attributed to the actor	One organisation: downgraded. Three: allowed	Every customer, escalating
Advisory	A malicious finding carrying the advisory id or alias	Your findings and triage	Your organisation
Finding	The finding	That finding’s triage	Your organisation

A false positive also sets analysisState = not_affected on your organisation’s matching findings, so the next API or console read shows them resolved. A newer decision on the same subject replaces the older one; retracting a decision recomputes the consensus without it.

What reads the consensus

Consumer	What changes
Package firewall	Stops blocking an fp_cleared package version or indicator. An fp_cleared file hash is left out of its known-bad hash set. Downgraded and allowed threat actors are relaxed.
vulnetix malscan	Before reporting, fetches the consensus from POST /v2/cli.malware-curation-get and drops findings and IOCs whose indicator is fp_cleared, printing N malware indicator(s) cleared by false-positive curation. Package-version decisions do not filter local findings; use an ignore rule for those. Offline runs skip this step.
VDB processors	The AUR and OSM malware processors skip subjects the consensus has cleared when they mint advisories.

Your organisation’s indicators

The Indicators tab adds, edits and deletes IOCs your organisation tracks itself, stored as MalwareIoc rows with managedByOrg = true.

Field	Values	Limit
Type	domain, url, ipv4, ipv6, file-hash, email, wallet, exfil-endpoint, install-command, package-name	64 characters; stored lower-case
Value	The indicator	4,096 characters
Ecosystem	Optional, e.g. npm	128 characters

Each new indicator gets an advisory id MAL-ORG-<uuid> and source vulnetix-org-ioc; an id you supply is ignored. Adding a type and value your organisation already has returns the existing row. Only indicators you created can be edited or deleted. The ones malscan found (source vulnetix-cli-malscan) are listed read-only.

Activity log

Every write is audited. Actions: fp_set, fp_confirm, fp_reason (a reason-only edit), fp_retract, ioc_add, ioc_edit, ioc_delete. The actor is recorded as the signed-in principal’s organisation email label, because the console token carries no member id. Times are Unix seconds.

API

The console calls these endpoints on the account API (https://www.vulnetix.com/api/site/v1) with your session. Bodies are JSON, at most 16 KiB.

Method and path	Body or query	Returns
POST /malware/fp	subjectType (package_version, ioc, threat_actor, advisory, finding), verdict (false_positive, confirmed), the subject fields (ecosystem, packageName, packageVersion; iocType, iocValue; threatActorUuid; cveId; findingUuid), optional repositoryFullName, reason (at most 1,000 characters)	200 {"ok":true,"uuid":…}; 400 for a missing field; 403 when your organisation has not met the subject
GET /malware/curation	Paginated	{"entries":[…],"pagination":{…}}
POST /malware/curation/retract	uuid	200 {"ok":true}; 404 active decision not found
GET /malware/curation/audit	Optional action, subjectType filters	{"entries":[…],"pagination":{…}}
GET /malware/iocs		{"iocs":[…]}, newest first, at most 2,000
POST /malware/iocs	iocType, value, optional ecosystem	200 {"uuid":…}, or {"uuid":…,"existing":true}
PATCH /malware/iocs/{uuid}	Any of iocType, value, ecosystem	200 {"ok":true}; 404 if not yours
DELETE /malware/iocs/{uuid}		200 {"deleted":true}; 404 if not yours

An unauthenticated request gets 401.