{
  "schema_version": "1.0",
  "name": "DarkWick enrichment feeds",
  "generated": "2026-08-11T00:01:08.119Z",
  "source_generated": "2026-08-11T15:40:03.738Z",
  "indicators": 3713,
  "provenance": {
    "observed": 591,
    "inferred": 22,
    "feed": 3100
  },
  "tlp": "GREEN",
  "honesty": "provenance_class distinguishes witnessed (observed), evidence-derived (inferred), and aggregated (feed) indicators. Blocked-egress destinations are would-be victims and are never published as indicators.",
  "feeds": [
    {
      "format": "stix2.1",
      "url": "https://darkwick.netlify.app/enrichment/darkwick.stix2.json",
      "consumers": [
        "OpenCTI",
        "MISP",
        "Microsoft Sentinel TI import",
        "ThreatConnect",
        "Anomali"
      ]
    },
    {
      "format": "splunk-lookup-csv",
      "url": "https://darkwick.netlify.app/enrichment/darkwick-splunk.csv",
      "consumers": [
        "Splunk automatic lookups"
      ]
    },
    {
      "format": "sentinel-watchlist-csv",
      "url": "https://darkwick.netlify.app/enrichment/darkwick-sentinel.csv",
      "consumers": [
        "Microsoft Sentinel watchlists"
      ]
    },
    {
      "format": "ecs-ndjson",
      "url": "https://darkwick.netlify.app/enrichment/darkwick-elastic.ndjson",
      "consumers": [
        "Elastic Security (Filebeat threat intel / bulk import)"
      ]
    }
  ],
  "api": {
    "name": "DarkWick enrichment lookup API",
    "url": "https://darkwick.netlify.app/api/enrich",
    "usage": "GET /api/enrich?ip=<ip> (also ?url=, ?domain=) — returns { found, indicator, dossier, related_detections, provenance_note }. Miss returns found:false with HTTP 200.",
    "example": "https://darkwick.netlify.app/api/enrich?ip=91.92.42.168",
    "auth": "none (public, TLP:GREEN)",
    "consumers": [
      "SOAR playbooks",
      "analyst triage",
      "custom integrations"
    ]
  },
  "related": {
    "blocklist": "https://darkwick.netlify.app/blocklist.txt",
    "detections": "https://darkwick.netlify.app/detections.json",
    "globe": "https://darkwick.netlify.app/"
  }
}