Extract and aggregate IOCs from threat feeds.
Project description
iocingestor
An extendable tool to extract and aggregate IoCs from threat feeds.
This tool is a forked version of InQuest's ThreatIngestor focuses on MISP integration.
Key differences
- Better MISP integration.
- Working with the latest version of MISP.
- Smart event management based on
reference_link.
- MISP warninglist compatible whitelisting.
- Using ioc-finder instead of iocextract for IoC extraction.
- YARA rule extraction is dropped.
Installation
iocingestor requires Python 3.6+.
Install iocingestor from PyPI:
pip install iocingestor
Usage
Create a new config.yml file, and configure each source and operator module you want to use. (See config.example.yml as a reference.)
iocingestor config.yml
By default, it will run forever, polling each configured source every 15 minutes.
Plugins
iocingestor uses a plugin architecture with "source" (input) and "operator" (output) plugins. The currently supported integrations are:
Sources
- GitHub repository search
- RSS feeds
- Generic web pages
Operators
- CSV files
- MISP
- SQLite database
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file iocingestor-0.3.3.tar.gz.
File metadata
- Download URL: iocingestor-0.3.3.tar.gz
- Upload date:
- Size: 31.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: poetry/1.1.8 CPython/3.8.2 Darwin/20.6.0
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 7239316ce214662b2dae196d2b63f5e187d202652923e494fe818b6d524b2d30 |
|
| MD5 | 2d539adf5edfd032a4d16567e37717e4 |
|
| BLAKE2b-256 | 2708fe9ecd01997061fddb968bd5ac53528261171692fcc5a06fca2747cf20a5 |
File details
Details for the file iocingestor-0.3.3-py3-none-any.whl.
File metadata
- Download URL: iocingestor-0.3.3-py3-none-any.whl
- Upload date:
- Size: 40.2 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: poetry/1.1.8 CPython/3.8.2 Darwin/20.6.0
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 967740b6122aaab905c6c42ad574165947d9ada0e27adcc2e74fcc467c9f5d20 |
|
| MD5 | dec6b3a7a6bc9f4999ee4936b6b7c916 |
|
| BLAKE2b-256 | 35a7d494294385ee282bc3b712f72d23168548e6846fca14925b1eede67d8ccf |
