These practical, step-by-step examples show how security teams, SOC analysts, threat hunters, and compliance officers use Silent Push Data Export in their day-to-day operations to solve real cybersecurity challenges.
Organization Export – Everyday Workflows
1. Rapid Phishing Blocklist Deployment
Scenario: Your organization is experiencing a targeted phishing wave. You need to block known phishing domains and IPs across your DNS and perimeter firewalls within minutes.
How to do it:
Go to Data Export
Click the Category button at the top and select Organization Export
Use the search bar to quickly locate your pre-built “Phishing Indicators” or “High-Confidence Phishing” feed
Click Download File and choose:
RPZ format — ideal for DNS firewalls (BIND, Infoblox, Cisco Umbrella)
TXT format — perfect for pfSense, iptables, Palo Alto, or Fortinet ACLs
Upload the file directly to your firewall or DNS security policy and apply changes
Outcome: Immediate blocking of most phishing traffic, often within 5–15 minutes, giving your team time for deeper investigation.
2. Continuous Malicious IP Enrichment for SIEM
Scenario: Your SIEM needs real-time or near-real-time malicious IP feeds to enrich logs, improve alert correlation, and reduce analyst triage time.
How to do it:
Go to Data Export
Click Category → select Organization Export
Find your “Malicious IPs” or “C2 Infrastructure” feed
Click Automate Export
Choose CSV format (includes IP, threat category, confidence score, timestamps)
Copy the provided Python, cURL, or PHP code snippet
Paste it into a scheduled script (cron job, Azure Function, AWS Lambda, etc.) that runs every 3–6 hours
Configure the script to ingest the data into your SIEM
Outcome: More accurate SIEM alerts, reduced false positives (often 20–40%), and faster detection of compromised accounts or data exfiltration.
3. Secure Sharing of Campaign Intelligence with Partners
Scenario: You are collaborating with an MSSP, ISAC, or industry peer to track and disrupt a ransomware or APT campaign.
How to do it:
Go to Data Export
Click Category → select Organization Export
Search for your custom “Ransomware Campaign X” or “APT29 Indicators” feed
Click Download File and select STIX format
Review and remove any sensitive internal metadata if needed
Share securely via encrypted email, MISP, TAXII server, or secure file portal
Outcome: Partners can immediately ingest the intelligence into their tools, accelerating joint disruption efforts and strengthening collective defense.
Tips
Use clear, descriptive feed names and tags for fast searching
Prefer CSV or JSON for automation, RPZ for DNS blocking, and STIX for sharing
API endpoints expire after 3 hours — schedule your automations accordingly