soc/wazuh-docker/single-node/config/wazuh_cluster/rules/soc-ioc-cdb-...

<!--
  SOC IOC CDB Lookup Rules
  ========================
  These rules fire when a network field matches an entry in the threat-intel CDB lists
  maintained by soc-integrator (/wazuh/ioc-lists/refresh).

  Lists (compiled by wazuh-analysisd at startup/restart):
    etc/lists/malicious-ioc/malicious-ip      — known-bad IPs  (feodo, threatfox, local hits)
    etc/lists/malicious-ioc/malicious-domains — known-bad domains (threatfox, urlhaus, local hits)
    etc/lists/malicious-ioc/malware-hashes    — malware SHA256 hashes (bazaar, threatfox, local hits)

  Rule IDs: 110600–110605
  Level    : 10  (above log_alert_level=3, below critical=12)
-->

<group name="soc_mvp,threat_intel,ioc,cdb,">

  <!-- ── IP: FortiGate source IP matched threat-intel list ── -->
  <rule id="110600" level="10">
    <if_sid>81603</if_sid>
    <list field="srcip" lookup="match_key">etc/lists/malicious-ioc/malicious-ip</list>
    <description>CDB: FortiGate source IP matched threat-intel list</description>
    <group>soc_prod,a2,ioc,threat_intel,cdb,</group>
    <mitre>
      <id>T1071</id>
    </mitre>
  </rule>

  <!-- ── IP: FortiGate destination IP matched threat-intel list ── -->
  <rule id="110601" level="10">
    <if_sid>81603</if_sid>
    <list field="dstip" lookup="match_key">etc/lists/malicious-ioc/malicious-ip</list>
    <description>CDB: FortiGate destination IP matched threat-intel list</description>
    <group>soc_prod,a2,ioc,threat_intel,cdb,</group>
    <mitre>
      <id>T1071</id>
    </mitre>
  </rule>

  <!-- ── Domain: DNS query matched malicious-domains list ── -->
  <!-- Parent: 100250 (soc-prod-dns decoder, extracts url from query= field) -->
  <rule id="110602" level="10">
    <if_sid>100250</if_sid>
    <list field="url" lookup="match_key">etc/lists/malicious-ioc/malicious-domains</list>
    <description>CDB: DNS query matched malicious-domains threat-intel list</description>
    <group>soc_prod,a1,ioc,threat_intel,cdb,dns,</group>
    <mitre>
      <id>T1071.004</id>
    </mitre>
  </rule>

</group>