The IOC Stream view is an evolution to the previous Livehunt Notifications view. This view allows users to digest the incoming VT flux into relevant threat feeds that you can study here or easily export to improve detection in your security technologies.

You will see different tabs for different Threat Feeds. Currently the only Threat Feed available is the "Files" feed, which comes to replace the previous Livehunt Notifications

Files

Files notifications are listed in the IoC stream view, sorted by the matching date in descending order as shown in the image below. Additionally, you will receive notifications in your email if you configured your ruleset as described in the previous section. You can also access your notifications via the VirusTotal API. Notifications are deleted automatically after 10 days.

1. List with matches notifications generated by your YARA rule(s).
2. You can click to filter the notifications based on the matching YARA rule name or YARA ruleset name.
3. You can refresh and delete notifications.
4. You can sort by the matching date in ascendent or descendent order.
5. You can filter the notifications by a searching string, specific Yara rulesets, Start date or end date.
6. You can export IOCs by downloading the matching files or copying the hashes to the clipboard.
7. In the Tool menu you can
   1. Create a diff session with the selected files.
   2. Create a VT Graph with the selected files.
   3. Find commonalities in the selected files.
   4. Add the selected files to a collection.
8. Feature Icons:
   1. If your YARA rule is based on strings, if you hover the eye icon , you can see the Match context.
   2. If the matching file trigger network connections, if you hover the globe icon, you can see the Related network locations.
   3. If the matching file comes from a known distributor, if you hover the source icon, you will see the known distributor name.
   4. If the matching file have more than one name on its different submissions, if you hover the last name you can see the list of names.