AbuseCH integration

This integration is for AbuseCH logs. It includes the following datasets for retrieving indicators from the AbuseCH API:

• url dataset: Supports URL based indicators from AbuseCH API.
• malware dataset: Supports Malware based indicators from AbuseCH API.
• malwarebazaar dataset: Supports indicators from the MalwareBazaar from AbuseCH.
• threatfox dataset: Supports indicators from AbuseCH Threat Fox API.

From February 2025, AbuseCH recommends using an optional Auth Key (API Key) in the requests to avoid rate limiting issues. More details on this topic can be found here. For versions 2.6.1, 2.8.0 and above, we have added an optional Auth Key configuration option that can be used to avoid rate limiting.

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to Agentless integrations and the Agentless integrations FAQ.

Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

All AbuseCH datasets now support indicator expiration. For URL dataset, a full list of active indicators are ingested every interval. For other datasets namely Malware, MalwareBazaar, and ThreatFox, the indicators are expired after duration IOC Expiration Duration configured in the integration setting. An Elastic Transform is created for every source index to facilitate only active indicators be available to the end users. Each transform creates a destination index named logs-ti_abusech_latest.dest_* which only contains active and unexpired indicators. The indiator match rules and dashboards are updated to list only active indicators. Destinations indices are aliased to logs-ti_abusech_latest.<datastream_name>.

To facilitate IOC expiration, source datastream-backed indices .ds-logs-ti_abusech.<datastream_name>-* are allowed to contain duplicates from each polling interval. ILM policy logs-ti_abusech.<datastream_name>-default_policy is added to these source indices so it doesn't lead to unbounded growth. This means data in these source indices will be deleted after 5 days from ingested date.

The AbuseCH URL data_stream retrieves full list of active threat intelligence indicators every interval from the Active Indicators URL database dump https://urlhaus.abuse.ch/downloads/json/.

The AbuseCH malware data_stream retrieves threat intelligence indicators from the payload API endpoint https://urlhaus-api.abuse.ch/v1/payloads/recent/.

The AbuseCH malwarebazaar data_stream retrieves threat intelligence indicators from the MalwareBazaar API endpoint https://mb-api.abuse.ch/api/v1/.

The AbuseCH threatfox data_stream retrieves threat intelligence indicators from the Threat Fox API endpoint https://threatfox-api.abuse.ch/api/v1/.