MalwareIoc

An indicator of compromise the tenant manages itself, beside the ones its malware scans found. Only org-managed indicators are declarable: scanner-found ones, and the global malware curation verdicts, are not configuration. Every apply writes the malware curation audit.

apiVersion	vulnetix.com/v1
kind	MalwareIoc
Group	Malware
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists MalwareIoc in its kinds. See Management tokens.
Terraform resource	vulnetix_malware_ioc, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.157.0 and later.
Pinned schema	v1.15.0/MalwareIoc.schema.json
Newest schema	latest/MalwareIoc.schema.json
First released in	v1.1.0
Print the built-in copy	vulnetix config schema MalwareIoc

Minimal

Only the fields the kind requires. From examples/MalwareIoc/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/MalwareIoc.schema.json
apiVersion: vulnetix.com/v1
kind: MalwareIoc
metadata:
  name: c2-exfil-domain
spec:
  type: domain
  value: telemetry-cdn.example.net

HCL (resource vulnetix_malware_ioc)

# Only the arguments the kind requires. From config-schemas examples/MalwareIoc/minimal.yaml.

resource "vulnetix_malware_ioc" "c2_exfil_domain" {
  name  = "c2-exfil-domain"
  type  = "domain"
  value = "telemetry-cdn.example.net"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/MalwareIoc.schema.json
apiVersion: vulnetix.com/v1
kind: MalwareIoc
metadata:
  name: c2-exfil-domain
spec:
  type: domain
  value: telemetry-cdn.example.net
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/MalwareIoc/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/MalwareIoc.schema.json
apiVersion: vulnetix.com/v1
kind: MalwareIoc
metadata:
  name: typosquat-reqeusts
  labels:
    source: incident-response
  annotations:
    ticket: https://tracker.example.com/IR-517
spec:
  type: typosquat
  value: reqeusts
  ecosystem: pypi

HCL (resource vulnetix_malware_ioc)

# Every argument the kind supports. From config-schemas examples/MalwareIoc/advanced.yaml.

resource "vulnetix_malware_ioc" "typosquat_reqeusts" {
  name      = "typosquat-reqeusts"
  ecosystem = "pypi"
  type      = "typosquat"
  value     = "reqeusts"
  labels = {
    source = "incident-response"
  }
  annotations = {
    ticket = "https://tracker.example.com/IR-517"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/MalwareIoc.schema.json
apiVersion: vulnetix.com/v1
kind: MalwareIoc
metadata:
  name: typosquat-reqeusts
  labels:
    source: incident-response
  annotations:
    ticket: https://tracker.example.com/IR-517
spec:
  type: typosquat
  value: reqeusts
  ecosystem: pypi
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly MalwareIoc	Always MalwareIoc.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.type	string	yes		pattern ^[^A-Z\s]+$; length 1 to 64	The kind of indicator, in lower case. An open set; the common ones are listed in examples. A tenant has one indicator per type and value. Examples: package-name, typosquat, domain, url, ipv4, ipv6, file-hash, install-command, exfil-endpoint, email, wallet.
spec.value	string	yes		pattern ^\S([\s\S]*\S)?$; length 1 to 4096	The indicator itself: the package name, the domain, the C2 URL, the hash.
spec.ecosystem	string	no		pattern ^\S([\s\S]*\S)?$; length 1 to 128	The package ecosystem, for package-name and typosquat indicators (npm, pypi, aur and so on).

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• Only indicators the tenant manages are read or written. Scanner-found indicators, feed indicators and the global curation verdicts are never touched.
• Every apply writes the malware curation audit, as a console edit does.
• A tenant has one managed indicator per type and value. A document for a pair the console already created adopts that row.
• The spec is replaced whole: leaving ecosystem out clears it.
• The table has no name column, so metadata.name is kept on the ownership record, and an indicator made in the console exports under a name derived from its fields.

Terraform and OpenTofu

The resource is vulnetix_malware_ioc in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_malware_ioc.

Import an object that already exists by its name:

# Import an existing MalwareIoc by its name (metadata.name).
terraform import vulnetix_malware_ioc.c2_exfil_domain c2-exfil-domain

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/MalwareIoc/c2-domain.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/MalwareIoc.schema.json
apiVersion: vulnetix.com/v1
kind: MalwareIoc
metadata:
  name: c2-exfil-domain
spec:
  type: domain
  value: telemetry-cdn.example.net
---
apiVersion: vulnetix.com/v1
kind: MalwareIoc
metadata:
  name: typosquat-reqeusts
spec:
  type: typosquat
  value: reqeusts
  ecosystem: pypi

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.