From 1e67a343cab036087b30819d4e50352e772a9b39 Mon Sep 17 00:00:00 2001 From: besendorf Date: Fri, 5 Jun 2026 20:27:42 +0200 Subject: [PATCH] Document network access options (#808) --- docs/iocs.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/docs/iocs.md b/docs/iocs.md index 5bdb8a6..be9ca4e 100644 --- a/docs/iocs.md +++ b/docs/iocs.md @@ -34,6 +34,25 @@ It is also possible to load STIX2 files automatically from the environment varia export MVT_STIX2="/home/user/IOC1.stix2:/home/user/IOC2.stix2" ``` +## Network Access + +When checking URL indicators, MVT follows recognized shortened URLs with an +HTTP `HEAD` request. The following environment variables control these +requests: + +- `MVT_NETWORK_ACCESS_ALLOWED` enables or disables network requests. It defaults + to `true`. Set it to `false` to prevent MVT from attempting to resolve + shortened URLs. +- `MVT_NETWORK_TIMEOUT` sets the request timeout in seconds. It defaults to + `15`. + +For example, to run IOC checks without resolving shortened URLs: + +```bash +MVT_NETWORK_ACCESS_ALLOWED=false mvt-ios check-iocs \ + --iocs ~/iocs/malware.stix2 /path/to/iphone/output/ +``` + ## STIX2 Support So far MVT implements only a subset of [STIX2 specifications](https://docs.oasis-open.org/cti/stix/v2.1/csprd01/stix-v2.1-csprd01.html): @@ -55,4 +74,3 @@ You can automaticallly download the latest public indicator files with the comma Please [open an issue](https://github.com/mvt-project/mvt/issues/) to suggest new sources of STIX-formatted IOCs. -