We’re very excited to announce this project! IFIN Lists is intended as a community effort to provide lists of long-term observables that should be blocked in most environments.
This is just the start. We’re soft-launching this project withing the community to get feedback, improve the structure, and add some more lists.
We hope you all find this useful, and if you can, consider contributing to the effort.
Project Structure
The repo contains a folder called lists/. Inside are YAML files that are structured kind of like Sigma rules, but these are not Sigma rules. These lists are primarily for blocking, not for hunting. The YAML is just a light structure on top of data that, when run through a build pipeline, produces multiple output formats. Currently, those are:
- Markdown (the site pages)
- Plain text (split by domains/IPs)
- JSON
- CSV
With more to come.
Please, let us know what you’d want out of this project. Our ultimate hope is that many defenders with repositories such as this will decide that IFIN is a responsible steward of this information, and contribute efforts to a community-driven repository.
