These practical, step-by-step examples show how real security teams, SOC analysts, threat hunters, and compliance officers use Silent Push Data Export features in their day-to-day operations to solve real cybersecurity challenges.
Organization Exports – Everyday Workflows
1. Rapid Phishing Blocklist Deployment
Scenario: Your organization experiences a targeted phishing wave. You need to block known phishing domains and IPs across your DNS and perimeter firewalls within minutes.
Navigate to Data Export > Organization Exports.
Use the search bar to quickly locate your pre-built “Phishing Indicators” or “High-Confidence Phishing” feed.
Click Download and select either:
RPZ format (ideal for DNS firewalls such as BIND, Infoblox, or Cisco Umbrella)
TXT format (simple list for pfSense, iptables, Palo Alto, or Fortinet ACLs)
Upload the file directly to your Firewall or DNS security policy, then apply the changes.
Outcome: Immediate blocking of the majority of phishing traffic, often within 5–15 minutes, significantly reducing successful deliveries while the incident response team performs deeper analysis.
2. Continuous Malicious IP Enrichment for SIEM
Scenario: Your SIEM platform needs real-time or near-real-time malicious IP feeds to enrich logs, improve alert correlation, and reduce analyst triage time.
Go to Data Export > Organization Exports and find your “"Malicious IPs” or “C2 Infrastructure” feed.
Click Automate Export, choose CSV format (perfect for structured data including IP, threat category, confidence score, and timestamps).
Copy the provided Python code snippet (or cURL/PHP if preferred).
Paste the snippet into a scheduled automation script (cron job, Azure Function, AWS Lambda, etc.) that runs every 3–6 hours.
Configure the script to ingest the CSV directly into your SIEM (via API, file drop, or lookup table refresh).
Outcome: Your SIEM alerts become far more accurate and contextual, often reducing false positives by 20–40% and enabling faster detection of Lateral movement or exfiltration attempts.
3. Secure Sharing of Campaign Intelligence with Partners
Scenario: You're collaborating with an MSSP, ISAC, or industry peer to track and disrupt a specific ransomware or APT campaign.
In Organization Exports, search for your custom “Ransomware Campaign X” or “APT29 Indicators” feed.
Click Download, then select the STIX format (the industry-standard for structured cyber threat intelligence exchange).
Review the exported file to remove any internal-only tags or sensitive metadata.
Share the STIX file securely (encrypted email, MISP instance, TAXII server, or secure file transfer portal).
Outcome: Your partner can immediately ingest the intelligence into their tools for automated detection, blocking, or hunting—accelerating joint disruption efforts and strengthening mutual defense.