Integrate more Stalkerware IOCs

[Te-k]

Hi,

I would like to submit a PR to integrate IOCs from this repo https://github.com/Te-k/stalkerware-indicators in order to add more appids to your detection. Would that be ok ?

[naman]

Great suggestion! Do you have a preferred way to integrate IoC with isdi?

[naman]

@Tek feel free to provide feedback on the above PR

[Te-k]

Hey, apologies for not following through on this. Is there any reason for you to get IOCs in static data in the repository instead of having the app download the file regularly? It would be more likely to have the last version of IOCs. Something like :

• On startup, the app check if therer is an IOC file and when it was created. if it doesn't exist or is older than a week, download it from github
• Then load the IOC file in the IOCs directly What do you think?

[naman]

@Te-k the PR proposes a Github action to pull IOC file every week

[Te-k]

Thanks, is there any reason to have the file in the repository rather than downloaded on use?