Important: ThreatFox IOC Feed Configuration Update

ThreatFox has changed the URL and authentication requirements for downloading its IOC database. The previous download URL is no longer supported, and an Auth-Key is now required.

To continue receiving threat intelligence updates in Suri Oculus, follow these steps:

1. Obtain your personal Auth-Key from the abuse.ch Authentication Portal.

2. Open the Suri Oculus backend configuration file:

   /etc/oculus/config++.conf

3. Find the ioc_full_link parameter and replace its value with:

   ioc_full_link = "https://threatfox-api.abuse.ch/v2/files/exports/YOUR-AUTH-KEY-HERE/full.csv.zip";

4. Replace YOUR-AUTH-KEY-HERE with your actual Auth-Key.

5. Save the configuration and restart the backend service:

   sudo systemctl restart suri-oculus-cpp-service

Security notice: Keep your Auth-Key private. Do not publish it in Git repositories, screenshots, or support requests. Restrict access to the configuration file.

This is a temporary configuration requirement. We are working on a new threat intelligence aggregation system for Suri Oculus that will reduce dependency on individual external IOC providers.