{"manifest_type":"hexfield-feed-manifest","version":"1.0","source":"hexfield","generated_at":"2026-08-19T12:55:06Z","public_base_url":"https://hexfield.io","integrity":{"signature_format":"minisign","public_key_url":"https://hexfield.io/hexfield.pub","fail_closed":true,"note":"Verify each artifact against its matching .minisig before applying enforcement."},"artifacts":[{"id":"ip-blocklist","description":"High-confidence mass-scanner IP blocklist; plain text for URL-table aliases.","url":"https://hexfield.io/blocklist.txt","signature_url":"https://hexfield.io/blocklist.txt.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.txt -p hexfield.pub","indicator_types":["ipv4","ipv6"],"install_hint":"OPNsense/pfSense URL Table aliases should use this raw URL, not the .minisig sidecar."},{"id":"ip-blocklist-cidr","description":"Same IP blocklist as /32 and /128 CIDR entries.","url":"https://hexfield.io/blocklist.cidr","signature_url":"https://hexfield.io/blocklist.cidr.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.cidr -p hexfield.pub","indicator_types":["ipv4","ipv6"]},{"id":"ip-blocklist-json","description":"Rich IP blocklist with confidence, tier, country, ASN, and listing basis fields.","url":"https://hexfield.io/blocklist.json","signature_url":"https://hexfield.io/blocklist.json.minisig","media_type":"application/json","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.json -p hexfield.pub","indicator_types":["ipv4","ipv6"]},{"id":"indicator-bulk-json","description":"Canonical multi-type threat-intel feed for IPs, domains, URLs, and SHA-256s.","url":"https://hexfield.io/indicators.json","signature_url":"https://hexfield.io/indicators.json.minisig","media_type":"application/json","count":4,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm indicators.json -p hexfield.pub","indicator_types":["ipv4","ipv6","url","domain","sha256"],"count_by_type":{"ipv4":0,"ipv6":0,"url":4,"domain":0,"sha256":0},"install_hint":"Use this for SDK, SIEM, enrichment, and TIP imports.","sdk":{"export_once":"hexfield delta --verified --format nft -o /etc/nftables.d/hexfield.nft","watch":"hexfield watch --verified --interval 300 --format ipset -o /etc/hexfield.ipset --reload-cmd 'ipset restore < /etc/hexfield.ipset'"}},{"id":"firewall-nftables","description":"nftables set definitions for IPv4 and IPv6 enforcement.","url":"https://hexfield.io/blocklist.nft","signature_url":"https://hexfield.io/blocklist.nft.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.nft -p hexfield.pub","indicator_types":["ipv4","ipv6"],"install_hint":"Include then reference @hexfield_v4/@hexfield_v6 from your ruleset."},{"id":"firewall-ipset","description":"ipset restore input for Linux firewall enforcement.","url":"https://hexfield.io/blocklist.ipset","signature_url":"https://hexfield.io/blocklist.ipset.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.ipset -p hexfield.pub","indicator_types":["ipv4","ipv6"],"install_hint":"Apply with: ipset restore < blocklist.ipset"},{"id":"ids-suricata","description":"Suricata/Snort drop rules for inbound and outbound mass-scanner traffic.","url":"https://hexfield.io/blocklist.suricata.rules","signature_url":"https://hexfield.io/blocklist.suricata.rules.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.suricata.rules -p hexfield.pub","indicator_types":["ipv4","ipv6"]},{"id":"ids-zeek-intel","description":"Zeek Intel Framework TSV feed for IPs, URLs, domains, and SHA-256s.","url":"https://hexfield.io/hexfield.zeek.intel","signature_url":"https://hexfield.io/hexfield.zeek.intel.minisig","media_type":"text/tab-separated-values","count":4,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm hexfield.zeek.intel -p hexfield.pub","indicator_types":["ipv4","ipv6","url","domain","sha256"],"install_hint":"Load through Zeek's Intel framework with tab-separated headers intact."},{"id":"cti-stix","description":"STIX 2.1 bundle for TIP/OpenCTI/TAXII-style consumers.","url":"https://hexfield.io/hexfield.stix.json","signature_url":"https://hexfield.io/hexfield.stix.json.minisig","media_type":"application/stix+json","count":4,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm hexfield.stix.json -p hexfield.pub","indicator_types":["ipv4","ipv6","url","domain","sha256"]},{"id":"cti-misp","description":"MISP Event export with IP and payload attributes plus Hexfield tags.","url":"https://hexfield.io/hexfield.misp.json","signature_url":"https://hexfield.io/hexfield.misp.json.minisig","media_type":"application/json","count":4,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm hexfield.misp.json -p hexfield.pub","indicator_types":["ipv4","ipv6","url","domain","sha256"]},{"id":"router-mikrotik","description":"MikroTik RouterOS address-list import script.","url":"https://hexfield.io/blocklist.rsc","signature_url":"https://hexfield.io/blocklist.rsc.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.rsc -p hexfield.pub","indicator_types":["ipv4","ipv6"]},{"id":"dns-rpz","description":"DNS RPZ IPv4 trigger zone for DNS-layer policy.","url":"https://hexfield.io/blocklist.rpz","signature_url":"https://hexfield.io/blocklist.rpz.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.rpz -p hexfield.pub","indicator_types":["ipv4"]},{"id":"cloud-aws-waf","description":"AWS WAFv2 IPSet import helper with IPv4 /32 and IPv6 /128 entries.","url":"https://hexfield.io/blocklist.awswaf.json","signature_url":"https://hexfield.io/blocklist.awswaf.json.minisig","media_type":"application/json","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm blocklist.awswaf.json -p hexfield.pub","indicator_types":["ipv4","ipv6"]},{"id":"siem-sigma","description":"Sigma rule over VT-confirmed dropper URL paths.","url":"https://hexfield.io/hexfield.sigma.yml","signature_url":"https://hexfield.io/hexfield.sigma.yml.minisig","media_type":"application/x-yaml","count":4,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm hexfield.sigma.yml -p hexfield.pub","indicator_types":["url"]},{"id":"edr-yara","description":"YARA rule over VT-confirmed malware sample SHA-256s.","url":"https://hexfield.io/hexfield.yara","signature_url":"https://hexfield.io/hexfield.yara.minisig","media_type":"text/plain","count":0,"generated_at":"2026-08-19T12:55:06Z","verify_command":"minisign -Vm hexfield.yara -p hexfield.pub","indicator_types":["sha256"]}],"packs":[{"id":"opnsense-pfsense","title":"OPNsense / pfSense URL-table alias","description":"Raw IP feed for firewall URL-table aliases.","artifact_ids":["ip-blocklist"],"primary_artifact_id":"ip-blocklist","warning":"Do not paste .minisig sidecars into firewall blocklists; they are verification files."},{"id":"linux-firewall","title":"Linux firewall enforcement","description":"Ready-to-apply nftables and ipset exports from the same signed IP set.","artifact_ids":["firewall-nftables","firewall-ipset","ip-blocklist-cidr"],"primary_artifact_id":"firewall-nftables"},{"id":"ids-detection","title":"IDS / detection engineering","description":"Suricata/Snort rules, Zeek Intel, Sigma URL paths, and YARA sample hashes.","artifact_ids":["ids-suricata","ids-zeek-intel","siem-sigma","edr-yara"],"primary_artifact_id":"ids-suricata"},{"id":"cti-tip","title":"CTI / TIP imports","description":"STIX, MISP, and canonical multi-type JSON for enrichment platforms.","artifact_ids":["cti-stix","cti-misp","indicator-bulk-json"],"primary_artifact_id":"cti-stix"},{"id":"router-cloud-dns","title":"Router, cloud, and DNS policy","description":"MikroTik, AWS WAF, and RPZ policy exports.","artifact_ids":["router-mikrotik","cloud-aws-waf","dns-rpz"],"primary_artifact_id":"router-mikrotik"}],"sdk":{"export_once":"hexfield delta --verified --format nft -o /etc/nftables.d/hexfield.nft","watch":"hexfield watch --verified --interval 300 --format ipset -o /etc/hexfield.ipset --reload-cmd 'ipset restore < /etc/hexfield.ipset'"},"feedback":{"policy_type":"hexfield-review-feedback-summary","version":1,"source_kind":"approved_overlay","source_status":"missing","source_generated_at":"","source_export_count":0,"source_overlay_id":"","source_policy_id":"","source_packet_id":"","source_review_id":"","approval_id":"","approved_by":"","action_count":0,"ignored_action_count":0,"by_action":{},"targets":{"suppress":0,"promote":0,"tag":0},"applied":{"suppressed":0,"promoted_existing":0,"tagged_existing":0,"created_feedback_indicators":0,"conflicts_suppressed":0}},"publish_manifest":{"available":false},"api":{"openapi_url":"https://hexfield.io/api/v1/openapi.json","lookup_url_template":"https://hexfield.io/api/v1/indicator/{type}/{value}","delta_url":"https://hexfield.io/api/v1/delta","feed_manifest_url":"https://hexfield.io/api/v1/feed-manifest","taxii_discovery_url":"https://hexfield.io/taxii2/","taxii_api_root_url":"https://hexfield.io/taxii2/api1/","taxii_collection_id":"hexfield-public-stix-21"},"privacy":{"public_safety":"Aggregate counts only; sensor names, raw logs, and non-listed peers withheld.","listing_basis":["spread-gated-blocklist","vt-confirmed-payload-capture","not-enough-public-evidence"]}}