toolkit
ARPA
A Turkish-language observability-harvesting and correlation platform built on an AI agent framework. Named by 2 reports, 9 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: ARPA-Observability-Harvester, ARPA-observability-harvester, ARPA / ARPA Korelasyon Motoru, custom ARPA correlation platform. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Multi-Actor AI-Agent Framework Abuse (8 Operators)
MAL_Linux_ARPA_Observability_Harvester_Systemd
Detection rules
Turkish ARPA AI-Augmented Observability Compromise (209.38.205.158)
MAL_PowerShell_Instana_Local_Collector_Family, MAL_Python_ARPA_Observability_Harvester_Platform, MAL_PSScript_Insider_TunnelSetup_Turkish, MAL_Python_Instana_SolarWinds_Zabbix_VMwareAria_Polling, MAL_Python_ARPA_CrossSource_Correlation_ETL, MAL_Markdown_ARPA_OperatorNote_Family, MAL_SystemdUnit_ARPA_Platform_Services, MAL_Python_ARPA_AI_Service_NaturalLanguage_Query
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-013: Espionage-flavoured operator harvesting a state-affiliated insurer's observability stack through an AI agent platform
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.