Skip to main content

The missing link to connect open-source threat intelligence tools.

Project description

Threat Bus

A threat intelligence dissemination layer for open-source security tools.

PyPI Status Build Status Total alerts Language grade: Python Development Status Latest Release Chat License

Getting StartedContributing GuidelinesWriting PluginsLicenseDocumentation

Chat with us on Matrix.

Key Features

  • Connect Open-Source Security Tools: Threat Bus is a pub-sub broker for threat intelligence data. With Threat Bus you can seamlessly integrate MISP intelligence with the Zeek intel framework or report sightings from IDS deployments to some data base.

  • Plugin-based Architecture: The project is plugin-based and can be extended easily. Read about the different plugin types and how to write your own. We welcome contributions to adopt new open source tools!

  • Official Plugins: We maintain many plugins right in the official Threat Bus repository. Check out our integrations for MISP, Zeek, CIFv3, and generally apps that connect via ZeroMQ, like pyvast-threatbus.

  • Snapshotting: The snapshot feature allows subscribers to directly request threat intelligence data for a certain time range from other applications. Threat Bus handles the point-to-point communication of all involved apps.

Getting Started

The config.yaml.example file provides a working configuration for Threat Bus with all existing application plugins enabled together with the RabbitMQ backbone.

The following example shows how to connect MISP, Zeek via Threat Bus. There are more integrations available, so make sure to check out all Threat Bus projects on PyPI.

Start Threat Bus

mv config.yaml.example config.yaml   # rename example config file
venv/bin/threatbus -c config.yaml

Start Zeek as Threat Bus app

zeek -i <INTERFACE> -C ./apps/zeek/threatbus.zeek

Start Zeek and request a snapshot

zeek -i <INTERFACE> -C ./apps/zeek/threatbus.zeek -- "Tenzir::snapshot_intel=30 days"

Threat Bus also ships as pre-built Docker image and is available on Docker Hub.

Use the Threat Bus Docker container

docker run tenzir/threatbus:latest --help

Start Threat Bus container with a custom config file

docker run -p 47661:47661 -v $PWD/my-custom-config.yaml:/opt/tenzir/threatbus/my-custom-config.yaml tenzir/threatbus:latest -c my-custom-config.yaml


Install threatbus and all plugins that you require. Optionally, use a virtual environment.

virtualenv venv                       # optional
source venv/bin/activate              # optional
pip install threatbus
pip install threatbus-inmem           # inmemory backbone plugin
pip install threatbus-rabbitmq        # RabbitMQ backbone plugin
pip install threatbus-misp            # MISP application plugin
pip install threatbus-zeek            # Zeek application plugin
pip install threatbus-<plugin_name>


Use the Makefile to run unit and integration tests.

make unit-tests
make integration-tests

The integration tests require a local Zeek and Docker installation.

Plugin Development

Setup a virtual environment and install threatbus and some plugins with the in development mode:

virtualenv venv
source venv/bin/activate
make dev-mode

Configuration & Extension

A plugin must define a Whenever a plugin is installed, you have to add a corresponding configuration section to threatbus' config.yaml. That section has to be named after the name in the entrypoint declaration of the plugin's file.

Please adhere to the plugin naming conventions and always prefix your plugin name with threatbus-.

Plugins can either be apps or backbones. Application plugins (apps) add new functionality to threatbus and allow communication to a threat-intelligence-enabled app (e.g., Zeek or Suricata). Backbone plugins add a new storage and distribution backend to threatbus (e.g., in-memory or Kafka).


  • plugin folder structure:
    ├── apps
    |   └── threatbus-myapp
    │       ├──
    |       └──
    └── backbones
        └── threatbus-inmem
    from setuptools import setup
      entry_points={"": ["myapp = threatbus_myapp"]},
  • config.yaml entry for threatbus

Threat Bus API

Plugins specifications are available in threatbus/ and threatbus/, respectively. For any plugin, you should at least implement the run function.

App plugins are provided two callback functions to use for subscription management. Internally, Threat Bus will propagate subscription requests to all installed backbone plugins.

The subscription callback allows applications to request an optional snapshot time delta. Threat Bus will forward snapshot requests to all those apps that have implemented the snapshot feature (see threatbus/


Please use the StoppableWorker base class to model your plugin's busy work. Plugins should never block the main thread of the application. Implementing that class also facilitates a graceful shutdown.

All officially maintained Threat Bus plugins implement StoppableWorker. Refer to any of the existing plugins for an example.


Threat Bus comes with a 3-clause BSD license.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for threatbus, version 2021.2.24
Filename, size File type Python version Upload date Hashes
Filename, size threatbus-2021.2.24-py3-none-any.whl (14.5 kB) File type Wheel Python version py3 Upload date Hashes View
Filename, size threatbus-2021.2.24.tar.gz (15.4 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page