BSD 3-Clause "New" or "Revised" License

项目介绍

Bert-JanP/Open-Source-Threat-Intel-Feeds 是一个托管在 GitHub 上的开源项目,主要使用 Python 编写,采用 BSD 3-Clause "New" or "Revised" License 许可证,目前获得 856 个 Star、92 次 Fork。

仓库全名
Bert-JanP/Open-Source-Threat-Intel-Feeds
开源许可证
BSD 3-Clause "New" or "Revised" License
Star 数
856
Fork 数
92

README 摘要

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds are described below. The following feed categories are available: SSL IP DNS URL MD5 SHA1 SHA256 CVEID JA3 NamePipes The content is served as is. When…

完整内容见 GitHub 原始 README 或本页 。

常见问题

Open-Source-Threat-Intel-Feeds 用什么语言开发?

主要使用 Python 编写,采用 BSD 3-Clause "New" or "Revised" License 许可证,目前有 856 个 Star。

Open-Source-Threat-Intel-Feeds 可以免费商用吗?

仓库采用 BSD 3-Clause "New" or "Revised" License 许可证,可免费使用与修改,商业使用请遵守许可证条款(例如保留版权声明与许可声明)。

如何获取 Open-Source-Threat-Intel-Feeds 的源码?

可以直接克隆仓库:git clone https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds.git;安装与运行步骤见仓库 README。

Open-Source-Threat-Intel-Feeds 最近还在维护吗?

仓库最近一次更新为 6月26日,当前没有未关闭的 Issue;Star 数为 856,可作为社区活跃度的参考。

关于

GitHub 原始描述(英文)

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

描述取自 GitHub 官方 API,保持仓库作者书写的原文。

简要分析

热度分
1896
价值分
626
活跃状态
活跃

语言占比

Python

README

Free Threat Intel/IOC Feeds Tweet

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds are described below. The following feed categories are available:

  • SSL
  • IP
  • DNS
  • URL
  • MD5
  • SHA1
  • SHA256
  • CVEID
  • JA3
  • NamePipes

The content is served as is. When using the content in a business environment the conditions have to be researched before using the content, it might be that some content cannot be used freely under certain conditions. It is your own responsibility to research if that is the case or not.

Category Count
DNS 17
IP 78
MD5 12
SHA1 5
SHA256 8
SSL 1
URL 23
CVEID 4
RANSOMWARELEAK 1
JA3 1
NamePipe 1

Combine Threat Intel in your EDR and SIEM

The feeds available in this repository can be used to perform threat hunting in your EDR or SIEM solution to hunt for malicious activity. For Defender For Endpoint and Sentinel, some KQL hunting rules have already been written to be implemented in your EDR or SIEM. See: KQL Hunting Queries

KQL

You can easily implement the open-source feeds in KQL for M365D Advanced Hunting or Sentinel. This is done by using the externaldata operator. This operator can take an external link as input and parse the result to a data table that can be used to join or to filter based on your other tables. An example is shown below and the output is a table just like any other.

let C2IntelFeeds = externaldata(IP: string, ioc:string)[@"https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s-30day.csv"] with (format="csv", ignoreFirstRecord=True);
C2IntelFeeds
| take 100

alt text

The documentation explains the different parameters that are used, such as if you want to ignore the first row or not.

Combining EDR Network Traffic and IOC Feeds

The results of combining the EDR Network Traffic and the IOC feed is shown below. This detection can help you identify devices that connect to IPs that host command and control servers.

let C2IntelFeeds = externaldata(IP: string, ioc:string)[@"https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s-30day.csv"] with (format="csv", ignoreFirstRecord=True);
let IPList = C2IntelFeeds
| project IP;
DeviceNetworkEvents
| where RemoteIP in (IPList)
| join kind=inner C2IntelFeeds on $left.RemoteIP == $right.IP
| extend GeoIPInfo = geo_info_from_ip_address(RemoteIP)
| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, ioc

Contributions

Contributions are much appreciated to make this list with free Threat Intel/IOC feeds as big and as up-to-date as possible. You can contribute by creating a pull request. This PR must contain the following content:

  1. Add the link to the feed in the README.md file. If there is not a section yet in which the source fits, create a new section.
  2. Add the details to the ThreatIntelFeeds.csv file, the format which is used is shown below. The Category refers to the feed categories shown above.
    Vendor;Description;Category;Url
    
  3. The source must be free and usable without any account or API token needed.
  4. Use the Validator.py script to validate the content of the CSV file. This can be done by running it in the script directory.
  5. Update the IOC Feed Statistics table by running the GenerateTableStatistics.py which will save the markdown table in the StatisticsTable.md file. This table can then be pasted above.

Abuse.ch

Terms of Service: https://sslbl.abuse.ch/blacklist/, https://feodotracker.abuse.ch/blocklist/

Blocklist.de

Terms of Service: https://www.blocklist.de/en/index.html

IPSum

C2IntelFeeds

Montysecurity Feeds

Carbon Black

tweetfeed.live

Botvrij

Proofpoint

CINSscore

Phishing Army

Alienvault

Cisco Talos

Binarydefense

CISA

eCrimeLabs

MISP Feed CERT-FR

Mr. Looquer IOC Feed

SNORT

ELLIO: IP Feed (Community version)

Terms of Service: https://ellio.tech/beta-terms-and-conditions

CyberCure

DigitalSide Threat-Intel

OpenPhish

PhishTank

Cert.PL

GreenSnow

NIST

Other Github based feeds

Url Abuse

virtualfabric

threatcluster.io

threatview.io

SiberKapan

VPN

Tor

Ransomware Live

NamePipes

Sources with multiple feeds depending on threat

Spamhaus Don’t Route Or Peer Lists (DROP) lists

评论

暂无评论