Wildcard Observables

ThreatStream supports STIX 2.1-compatible wildcard patterns for domain and URL observables. This capability enables you to ingest, manage, and distribute wildcard observables while maintaining consistent intelligence workflows.

Wildcard observables allow multiple related observables to be represented using a single pattern instead of maintaining large numbers of similar observables.

Wildcard Observables Usage

Wildcard observables are useful in the following cases:

To block an entire malicious domain or all subdomains
To cover all URLs under a known malicious path or host
To have a protocol-agnostic matching for a known malicious path
To use received STIX data that already uses LIKE patterns

Using wildcard observables helps you:

Avoid maintaining large lists of near-duplicate indicators.
Preserve the structure and intent of STIX indicator patterns from external feeds.
Ensure full downstream blocking coverage in EDR and other integrated tools.

Supported Wildcard Expressions

ThreatStream supports wildcard expressions for:

Domain observables
URL observables

ThreatStream uses the percent symbol (%) instead of the asterisk (*) as the wildcard character.

Wildcard Expression Examples

Wildcard Type	ThreatStream Value	STIX Pattern	Description
Subdomain wildcard	%.baddomain.com	[domain-name:value LIKE '%.baddomain.com']	Matches any subdomain of baddomain.com. For example, login.baddomain.com mail.baddomain.com
Domain suffix wildcard	%baddomain.com	[domain-name:value LIKE '%baddomain.com']	Matches any domain ending baddomain.com. For example, evilbaddomain.com foo-baddomain.com
Path wildcard URL	http://malicious.com/%	[url:value LIKE 'http://malicious.com/%']	Matches any URL starting with http://malicious.com/.
Query parameter match	http://phish.com/page?%	[url:value LIKE 'http://phish.com/page?%']	Matches any URL that starts exactly with http://phish.com/page?.
Top-level domain wildcard	%.gov	[domain-name:value LIKE '%.gov']	Matches any subdomain under .gov.
Protocol-agnostic path	%://malware.site/data	[url:value LIKE '%://malware.site/data']	Matches any protocol such as HTTP, HTTPS, FTP, and so on, used to access /data on malware.site.

Note: Top-level domain wildcard patterns (for example, %.gov) may be overly broad and can result in false positives or performance impacts. Use these patterns with caution.

Wildcard iTypes

ThreatStream supports the following wildcard iTypes:

Indicator Name	iType	Severity	Threat Type
Malware Wildcard Domain	mal_wildcard_domain	High	Malware
Suspicious Wildcard Domain	sus_wildcard_domain	Medium	Suspicious
Malware Wildcard URL	mal_wildcard_url	High	Malware
Suspicious Wildcard URL	sus_wildcard_url	Medium	Suspicious

For more information on wildcard itypes, refer to Indicator Types in ThreatStream.

Supported Workflows

Wildcard observables are supported across the following workflows:

CSV imports. See Importing Structured Data for details.
STIX 2.x import. See Importing STIX Data into the Anomali Threat Model for details.
STIX 2.x export. See Exporting Observables for details.
Import via ThreatStream API. See Import Observables from STIX files and Structured Data for details.
ThreatStream Integrator. Wildcard indicator types are supported for the Palo Alto Networks destination. For details, see the Anomali ThreatStream Integrator Installation & Administration Guide for version 8.5.6 or later.