diff --git a/README.md b/README.md index 4ba00ab..6c90d5a 100644 --- a/README.md +++ b/README.md @@ -5,13 +5,12 @@ A curated list of Awesome Threat Intelligence resources - [Parsers](#parsers) - [Standards](#standards) - [Frameworks](#frameworks-and-platforms) +- [Tools](#tools) - [Research](#research) ## Sources -## Parsers - ## Standards @@ -60,6 +59,14 @@ A curated list of Awesome Threat Intelligence resources The Collective Intelligence Framework (CIF) allows you to combine known malicious threat information from many sources and use that information for IR, detection and mitigation. Code available on GitHub. + + + + + + + + - +
+ IntelMQ + + IntelMQ is a solution for CERTs for collecting and processing security feeds, pastebins, tweets using a message queue protocol. It's a community driven initiative called IHAP (Incident Handling Automation Project) which was conceptually designed by European CERTs during several InfoSec events. Its main goal is to give to incident responders an easy way to collect & process threat intelligence thus improving the incident handling processes of CERTs. +
MISP @@ -92,14 +99,22 @@ A curated list of Awesome Threat Intelligence resources The Threat Analysis, Reconnaissance, and Data Intelligence System (TARDIS) is an open source framework for performing historical searches using attack signatures.
+ + + ThreatCrowd is a system for finding and researching artefacts relating to cyber threats. +
ThreatExchange - Facebook created ThreatExchange so that participating organizations can share threat data using a convenient, structured, and easy-to-use API that provides privacy controls to enable sharing with only desired groups. This project is still in *beta*. + Facebook created ThreatExchange so that participating organizations can share threat data using a convenient, structured, and easy-to-use API that provides privacy controls to enable sharing with only desired groups. This project is still in beta.
XFE - X-Force Exchange @@ -110,4 +125,61 @@ A curated list of Awesome Threat Intelligence resources
+ + +## Tools + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ Combine + + Combine gathers Threat Intelligence Feeds from publicly available sources. +
+ IOC Editor + + A free editor for Indicators of Compromise (IOCs). +
+ ioc_writer + + Provides a python library that allows for basic creation and editing of OpenIOC objects. +
+ threataggregator + + ThreatAggregrator aggregates security threats from a number of online sources, and outputs to various formats, including CEF, Snort and IPTables rules. +
+ ThreatTracker + + A Python script designed to monitor and generate alerts on given sets of IOCs indexed by a set of Google Custom Search Engines. +
+ tiq-test + + The Threat Intelligence Quotient (TIQ) Test tool provides visualization and statistical analysis of TI feeds. +
+ + + ## Research \ No newline at end of file