13,051 ready-to-deploy Sigma detections, 9,310 CVEs, and 62,549 threat indicators from RedEye Security, served over STIX 2.1 / TAXII 2.1 and as plain bundle downloads. Point any TIP at one URL.
Tell us where to reach you and we’ll email a confirmation link. Click it to activate your access token plus ready-to-use TAXII 2.1 + STIX 2.1 + enrichment-API URLs. New CVE Forge detections flow into your SIEM automatically.
This is your access key to the RedEye feeds. Save it now, then point any TAXII client at the URL below.
In a TAXII client (MISP, OpenCTI, Sentinel), use this token as the API key / Bearer credential. The download URLs above already include it. The token is required for every feed endpoint — discovery, collections, and all data.
Use this if you’re building broad detection coverage across attacker techniques.
The community Sigma detection corpus (SigmaHQ) as STIX 2.1 indicators (pattern_type=sigma), redistributed under the Detection Rule License (DRL 1.1) with attribution to SigmaHQ and rule authors.
171 ATT&CK techniques (397 incl. sub-techniques) of coverage, ready to transpile to any SIEM query language (Splunk, Sentinel, Elastic, QRadar, and more).
Use this if you want to catch attacks exploiting the newest vulnerabilities (CVEs).
Sigma detections (STIX indicators) for published CVEs, paired with the related CVE vulnerability objects (NVD-backfilled, CISA-KEV and EPSS enriched).
9,310 carry a generated Sigma detection so far; the rest gain detections automatically as CVE Forge runs.
Use this if you want to block or flag traffic to/from known-malicious IPs, URLs, domains, and file hashes.
Malicious IPs, URLs, domains, file hashes, and botnet C2 infrastructure, aggregated and de-duplicated across RedEye Security's threat-intelligence sources, as STIX 2.1 indicators. Paginated: this collection serves the latest page; the full set is downloadable page-by-page.
Paginated. The TAXII collection and bundle below serve the latest 5,000; the full 62,549 indicators span 13 pages — grab them from the page index. TLP:CLEAR.
Pass your token as ?token= or an Authorization: Bearer header. The response tells you whether the IP is in our threat-indicator feed, plus labels, a confidence score, and first-seen. The observed_scanning and benign_service fields are reserved for future upstream context and currently return null (unknown).
{
"ip": "172.105.103.223",
"verdict": "malicious",
"confidence": 85,
"in_redeye_feed": true,
"observed_scanning": null,
"benign_service": null,
"labels": ["c2", "malicious-activity", "sliver"],
"first_seen": "2026-07-05T09:00:11Z",
"sources": 1,
"tlp": "CLEAR"
}Rate limits & fair use. 100 queries/hour per token (with a per-source-IP backstop) by default — need more? Tell us your use case and we’ll raise your token’s limit. Responses carry X-RateLimit-Remaining; over the limit you get 429 with Retry-After. Usage is monitored — tokens that abuse the service (excessive pulls or scraping) are deactivated and return 403 until you request a new one.
Most feeds hand you indicators (IPs, hashes, domains) and leave the detection engineering to you. The public Sigma corpus is excellent but human-written for known techniques, so a freshly disclosed CVE can sit for weeks, or forever, with no rule.
CVE Forge closes that gap. The moment a CVE lands on NVD, our Etairos-powered pipeline reads the vulnerability and uses an LLM to author a Sigma detection for that specific CVE, then transpiles and validates it. Ready-to-deploy content for vulnerabilities no public rule set has reached yet. Curated breadth from the Sigma Library, plus CVE-specific coverage within minutes from the Forge.
Alongside the portable Sigma rule, each STIX indicator now carries a Sentinel-ready query in the x_sentinel_kql field, transpiled by the Forge to the Microsoft ASIM schema. No hand-conversion. Pull the feed, read the field, drop it into a Sentinel Analytics rule.
Want a Sentinel-flavored feed? Add ?x=sentinel to any feed URL. Each indicator is slimmed to just the portable Sigma pattern plus its x_sentinel_kql, so your pipeline gets exactly the query it needs.
Not every logsource maps to Sentinel telemetry yet, so an indicator the ASIM pipeline could not translate simply omits the field. Detections that carry a query are ready to deploy as-is.
title: "CVE-1999-0612 \u2014 Finger service exposes valid user information over the\ \ network" id: cve-1999-0612-finger-port79 status: experimental description: 'Detects network connections to TCP port 79 (the finger protocol), which indicates a finger service is reachable and may disclose valid user account information to any host on the network. Detection is based on destination port and transport protocol from network syslog telemetry. ' references: - https://nvd.nist.gov/vuln/detail/CVE-1999-0612 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-1999-0612 logsource:
title: Credentials In Files
id: 53b1b378-9b06-4992-b972-dde6e423d2b4
status: test
description: Detecting attempts to extract passwords with grep and laZagne
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
author: 'Igor Fits, Mikhail Larin, oscd.community'
date: 2020-10-19
modified: 2021-11-27
tags:
- attack.credential-access
- attack.t1552.001
logsource:
product: macosThe detection rule. The logic ("if these log fields match, alert"). Vendor-neutral; transpiles to any SIEM. The content.
The format. A standard JSON envelope. A Sigma rule rides inside a STIX Indicator; CVEs are STIX Vulnerability objects. The packaging.
The transport. The HTTP API your tools poll to discover and pull STIX. The delivery. The LLM only authors Sigma; STIX/TAXII are deterministic.
?token=YOUR_TOKEN.?token= or an Authorization: Bearer header. Only this landing page is open.# TAXII 2.1 discovery — token required, like everything else curl -H "Authorization: Bearer rdi_YOUR_TOKEN" \\ https://feeds.redeyesecurity.com/taxii2/ # CVE detections (STIX bundle) — token via Bearer header curl -H "Authorization: Bearer rdi_YOUR_TOKEN" \\ https://feeds.redeyesecurity.com/stix/cve-detections.json | jq . # Sigma library bundle — token in the URL curl "https://feeds.redeyesecurity.com/stix/sigma-detections.json?token=rdi_YOUR_TOKEN" # TAXII 2.1 objects (what a TAXII client polls) — Bearer curl -H "Authorization: Bearer rdi_YOUR_TOKEN" \\ https://feeds.redeyesecurity.com/taxii2/feed/collections/redeye-cve-detections/objects/
External exposure intelligence — passive attack-surface and CVE-exposure scans for any organization.
Open Lighthouse →RedEye's threat-intel briefings and ICS / critical-infrastructure security research.
Read the blog →The Splunk-compatible SIEM and security data-lake engine behind the CVE Forge and these feeds.
Explore Caver →